Auth & keys

Authentication

Use account API keys for unattended servers and OAuth for people. `app login` is a native public-client flow with PKCE; its api-scoped token works across the CLI, REST API, desktop cloud bridge, and MCP. To authenticate users in your own app, register a client at /developers. Browser, hosted subdomain, and mobile clients are secretless and require PKCE S256; server clients exchange with a one-time client secret. The hosted appnz-auth.js client provides Firebase-style sign-in, current-user, token, and auth-state helpers.

basehttps://app.nz
GET/api/keysList keys (metadata only, no secrets)API keyPOST/api/keysCreate a key; response includes the one-time secretAPI keyPOST/api/keys/rotateRotate by id, by name, or all at onceAPI keyDELETE/api/keys?id=key_123Revoke a keyAPI keyGET/api/meCurrent account for the supplied key or sessionAPI key
GET/authorizeStart Sign in with app.nz (Authorization Code + PKCE)public
POST/tokenExchange a one-use code for a scoped access tokenpublic
GET/userinfoLoad the profile granted to an OAuth access tokenAPI key
POST/introspectServer apps validate their app-scoped access tokens or API keyspublic
POST/revokeRevoke an OAuth token on sign-outpublic
GET/api/oauth/keysList API keys owned by the authorized app (keys:manage)API key
GET/.well-known/oauth-authorization-serverOAuth provider discovery metadatapublic
Create a key and call the API
# Create a key (secret returned once)
curl -sX POST https://app.nz/api/keys \
  -H "Authorization: Bearer $APP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name":"deploy bot"}'

# Use it on every other request
curl -s https://app.nz/api/me \
  -H "Authorization: Bearer pk_live_..."