Authentication

Every request to the NDI Platform API requires authentication via the X-API-Key header.

Getting an API key

API keys are minted by your organization administrator through the NDI console or via POST /v1/clients (admin-only). Once minted, a key is shown exactly once. Store it securely.

Using the key

Include it in every request. The SDKs read $NDI_API_KEY (and optional $NDI_BASE_URL) so a configured environment needs no extra headers.

curl -X GET "$NDI_BASE_URL/v1/jobs" \
  -H "X-API-Key: $NDI_API_KEY"

from ndi_sdk import NdiClient

with NdiClient() as client:
    page = client.jobs.list()

import { NdiClient } from "ndi-sdk";

const client = new NdiClient();
const page = await client.jobs.list();

See the Python SDK and TypeScript SDK for install and a first parse. Agents can use the same key through MCP.

Key scope

An API key carries:

Organization — which organization owns the key.
Visibility — which access labels the key can see (determines what files are visible in queries and tools).
Storage mode — managed (NDI-hosted) or bring-your-own bucket.

Keys are organization-scoped. Revoking a key does not affect other keys.

Security

Never commit keys to version control.
Rotate keys periodically.
Revoke keys that are exposed or no longer needed.
Treat API keys as secrets — they grant full access to your organization’s data.

All requests use HTTPS. Keys are transmitted as headers and never logged in full.

Errors

401 unauthorized — API key missing, invalid, or revoked.
403 access_denied — Key does not have permission for the requested operation.

Getting started

SDKs and agents

Concepts

Getting an API key

Using the key

Key scope

Security

Errors

​Getting an API key

​Using the key

​Key scope

​Security

​Errors

Getting an API key

Using the key

Key scope

Security

Errors