API authentication

Updated 2026-09-07

Every Integrations API call requires an API key owned by your Nitromule user. Keys never unlock other merchants’ data — even if your user role is admin in the dashboard.

Create a key

1. Sign in to Nitromule.
2. Open Settings → API.
3. Create a test key (nm_test_…) for integration work.
4. Create a live key (nm_live_…) only when you are ready for real postage.
5. Store the secret in your secrets manager. The full secret may be shown only once.

Send the key

Either header works:

Authorization: Bearer nm_test_xxxxxxxx

X-API-Key: nm_test_xxxxxxxx

Example:

curl -sS https://nitromule.com/api/integrations/v1/carriers \
 -H "Authorization: Bearer nm_test_xxxxxxxx" \
 -H "Accept: application/json"

Test vs live

See Test mode.

Security rules

• Server-side only — never ship full API keys in browsers, mobile apps, or public repos
• Rotate on leak; revoke old keys in Settings → API
• Embeds use separate public tokens — embed quote widget
• MCP can use OAuth tokens (nm_mcp_…) or the same Bearer API keys — MCP

Ownership boundary

The key’s owner is the merchant scope. Dashboard admin powers do not expand Integrations API access to other users’ orders.

Errors