Quickstart

1. Get an API key

Sign in to the Nora dashboard, switch to the Sandbox environment in the top bar, and open Settings → API Keys. Click New API key, copy the secret — it is shown exactly once.

See Dashboard → API keys for the full UI walkthrough. Two things the form asks for matter from the first call:

• Allowed IPs. Every key has an IP allowlist. Add your server's egress IP or CIDR before you call anything — see Core concepts → Authentication for the fail-closed 403 behavior.
• Expiry. Every key has a mandatory expiry date and the dashboard caps how far out it can be; plan the rotation from day one (Authentication).

2. Make a request

Every call uses the X-API-Key header. Let's hit the hello endpoint to confirm your key works:

curl https://sandbox.api.nora.finance/v2/hello \
  -H "X-API-Key: $NORA_API_KEY"

Expected response (text/plain):

Hello Hono!

A 401 means the header is missing, wrong, revoked or expired. A 403 means the key is valid but not allowed here: it belongs to the other environment, or your IP is not on its allowlist.

3. Fetch your workspace info

curl https://sandbox.api.nora.finance/v2/info \
  -H "X-API-Key: $NORA_API_KEY"

The response carries engine (always "v2"), legacy (always false), capabilities (onramp, offramp, approve-burn), flows (the version of each flow you will get) and chains (the chains your key can use). It does not name your organization or environment; the key prefix and the host you called do. Every intent names its chain with chainId — see BRS token for the chains and the Intents reference for the request.

Next steps

• Authentication — key lifecycle, sandbox vs prod
• Flows → Wallet whitelisting — the first call every integration makes
• Flows → Ethereum end-to-end — whitelist, mint and burn on Ethereum in one pass