Authentication

The Nango API uses Bearer token authentication. Every request to https://api.nango.dev must include your secret key in the Authorization header.

API keys

Nango provides two types of API keys, each with a distinct purpose:

Secret key

Used for server-side API calls. Grants full access to your Nango environment. Never expose this key in client-side code or public repositories.

Public key

Used for frontend integrations (for example, initializing the Nango Connect UI). Has limited, read-only access scoped to the auth flow.

To find your keys, go to Settings > API Keys in the Nango dashboard.

Your secret key provides full access to your Nango environment. Treat it like a password — store it in environment variables, never in source code.

Authenticating requests

Pass your secret key as a Bearer token in the Authorization header on every API request.

Authorization: Bearer <your-secret-key>

curl

curl -H "Authorization: Bearer $NANGO_SECRET_KEY" \
  https://api.nango.dev/integrations

Node SDK

Install the SDK and pass your secret key when instantiating the client:

npm install @nangohq/node

import Nango from '@nangohq/node';

const nango = new Nango({ secretKey: process.env['NANGO_SECRET_KEY'] });

The secretKey field is required. The SDK throws an error at construction time if it is missing.

The Node SDK defaults to https://api.nango.dev as the host. If you are self-hosting Nango, pass the host option:

const nango = new Nango({
  secretKey: process.env['NANGO_SECRET_KEY'],
  host: 'https://nango.your-domain.com'
});

Environment variables

Store your secret key in an environment variable to keep it out of source code:

export NANGO_SECRET_KEY="<your-secret-key>"

Then reference it in your application:

const nango = new Nango({ secretKey: process.env['NANGO_SECRET_KEY'] });

curl -H "Authorization: Bearer $NANGO_SECRET_KEY" \
  https://api.nango.dev/integrations

Error responses

If a request is missing or includes an invalid secret key, the API returns a 401 Unauthorized response. Missing Authorization header:

{
  "error": {
    "code": "missing_auth_header"
  }
}

Malformed Authorization header (not a valid Bearer token):

{
  "error": {
    "code": "malformed_auth_header"
  }
}

Unknown or revoked secret key:

{
  "error": {
    "code": "unknown_account"
  }
}

Overview

Integrations & Connections

Functions & Proxy

SDKs

Authentication

API keys

Secret key

Public key

Authenticating requests

curl

Node SDK

Environment variables

Error responses

​API keys

Secret key

Public key

​Authenticating requests

​curl

​Node SDK

​Environment variables

​Error responses

API keys

Authenticating requests

curl

Node SDK

Environment variables

Error responses