Authentication

In a nutshell

API keys identify your business in the Subscriptions Engine. They are not Nomba credentials and should only be used from trusted server-side environments.

API key header

Protected endpoints require this header:

X-Api-Key: sub_xxx

Example:

curl https://nombasub.oluwadunsin.dev/v1/plan/ \
  -H "X-Api-Key: sub_xxx"

Get an API key

Register your business:

curl -X POST https://nombasub.oluwadunsin.dev/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "businessName": "Acme SaaS",
    "accountId": "nomba_account_or_subaccount_id"
  }'

Or retrieve an existing key by account ID:

curl -X POST https://nombasub.oluwadunsin.dev/auth/login \
  -H "Content-Type: application/json" \
  -d '{
    "accountId": "nomba_account_or_subaccount_id"
  }'

Security rules

Keep API keys on your backend only.
Never expose keys in frontend JavaScript, mobile binaries, or public repositories.
Use HTTPS for all API calls and webhook endpoints.
Rotate keys if they are leaked.
The MCP server, when available, uses the same Subscriptions Engine API key model.