Authentication

Every endpoint accepts an optional key header. In OpenAPI terms this is an apiKey scheme named ApiKeyAuth, sent in: header.

key: YOUR_API_KEY

If the operator has enabled require-key, requests without a valid key are rejected. Otherwise the header is ignored.

Send the header with every request:

curl https://mc.example.com/v1/server \
  -H "key: YOUR_API_KEY"

const res = await fetch("https://mc.example.com/v1/server", {
  headers: { key: process.env.NOXAE_API_KEY },
})
const server = await res.json()

• Never expose the key client-side. The key grants full server control. Keep requests on a trusted backend and store the key in an environment variable or secret manager.
• Whitelist trusted IPs. Restrict the API port to the IP addresses of your backend or automation hosts.
• Serve over HTTPS. Terminate TLS with a reverse proxy so keys are never sent in cleartext.
• Rotate keys. Change the key if you suspect it has leaked, and use distinct keys per integration where possible.

When a key is required but missing or invalid, the API rejects the request:

HTTP/1.1 401 Unauthorized
Content-Type: application/json

{ "error": "Invalid or missing API key" }