SyncNexaSyncNexa
Docs
v1.0 (Latest)

API Keys & Secrets

v1.0

Learn how to generate, manage, rotate, and revoke secret API keys in the SyncID Business Portal.

Last updated: August 2026

SyncNexa uses cryptographically generated secret API keys to authenticate and authorize server-to-server requests to the SyncNexa API Gateway.

Key Formats & Prefixes

API keys use standard prefix notation to allow instant identification of key type and target environment:

PrefixEnvironmentExample Masked HintScope
sk_test_Sandbox / Testingsk_test_****1a2bDevelopment & sandbox verification requests
sk_live_Production / Livesk_live_****9c8dLive verification & real student credential checks

Generating API Keys

In the Business Portal at business.syncnexa.co:

  • Navigate to API & OAuth $\rightarrow$ API Keys.
  • Click Create Key.
  • Enter a recognizable name (e.g., *Shopify Backend Server*), choose the parent Application, and select the Environment.
  • Click Generate Key. The creation modal displays the raw unmasked secret key (e.g., sk_test_YOUR_SECRET_KEY).
One-Time Secret Display
For security, SyncNexa stores only the cryptographic hash of your secret key in the database. The full key is shown only once in the modal. If you lose a key, you must generate a new one and revoke the previous one.

Authenticating API Requests

Include your API key as a Bearer token in the Authorization header of every HTTP request:

curl
1curl -X POST "https://api.business.syncnexa.co/verification/v1/sessions" \
2  -H "Authorization: Bearer sk_live_YOUR_SECRET_KEY" \
3  -H "Content-Type: application/json" \
4  -d '{
5    "appId": "app_8a7b6c5d4e3f",
6    "purpose": "Student Discount Eligibility Verification",
7    "requiredClaims": ["is_active_student", "university_domain"]
8  }'

Key Rotation & Revocation

If a key is compromised or needs periodic rotation:

  • Create a new API key in the portal and deploy it to your server configuration.
  • Verify that your application is communicating successfully using the new key.
  • Locate the old key in the API Keys table, click the action menu $(\cdots)$, and select Revoke Key.
  • Confirm the revocation in the modal dialog. The old key will immediately be blacklisted across all gateway endpoints.

Security Best Practices

  • Store keys in secure environment variables or a secret manager (e.g., AWS Secrets Manager, Vault, GCP Secret Manager).
  • Never commit API keys into version control (.git, git commit).
  • Use separate Sandbox keys for staging and automated CI/CD test suites.
  • Monitor the Last Used timestamp in the API Keys dashboard to identify inactive or orphaned keys.
Was this page helpful?