Authentication

Nova accepts two credential types. Most endpoints accept either; some
require one specifically. The reference page for each endpoint lists the
schemes it accepts in the Authentication section.

When a reference page lists both Bearer JWT and API key,
send exactly one of them:

x-api-key: <api_key> for server-to-server integrations.
Authorization: Bearer <jwt> for interactive partner or MVNO admin
sessions.

Do not send both headers on the same request. If a page shows only one
credential type, that endpoint only supports the scheme shown, or the
published reference has not yet been refreshed from the latest OpenAPI spec.

API key (`x-api-key`)

Recommended for server-to-server integrations.

Created through the API key management surface.
Scoped to the role and owner it was issued for, such as partner, MVNO, or
super-admin automation.
Sent in every request as the x-api-key header.
Rotate at least annually, and immediately on suspected compromise.

curl https://megsapp-nova-stg.85.group/api/v1/wallets \
  -H 'x-api-key: nova_pk_live_xxx…'

Rotating a key

Create a new key in the portal.
Roll the new key out across your services.
Revoke the old key. There is no grace period — both keys are valid
simultaneously until the old one is revoked.

Bearer JWT (`Authorization: Bearer …`)

Used for interactive sessions (partner portal users, MVNO admin
users). Obtained from the relevant login endpoint:

Audience	Login endpoint
Partner portal user	`POST /api/v1/partner-auth/login`
MVNO admin	`POST /api/v1/mvno-auth/login`

curl https://megsapp-nova-stg.85.group/api/v1/partner-auth/login \
  -H 'content-type: application/json' \
  -d '{ "email": "[email protected]", "password": "…" }'

The response includes accessToken (short-lived) and refreshToken. Send
the access token on subsequent requests:

curl https://megsapp-nova-stg.85.group/api/v1/partners/me \
  -H 'authorization: Bearer eyJhbGciOi…'

Refresh access tokens via the dedicated refresh endpoint before they
expire — see the authentication tags in the API reference.

Which to use when

Scenario	Use
Backend service calling Nova on a schedule	API key
Webhook handler receiving Nova Svix deliveries	Svix endpoint signing secret
Browser session in the partner portal	JWT
MVNO operator dashboard	JWT
One-off script run by a human	Either

Common 401 / 403 causes

Missing x-api-key and Authorization headers.
API key revoked or belongs to a deleted partner.
JWT expired — refresh it.
Endpoint requires a role/permission your principal lacks.
Request to a resource owned by another partner subtree (RBAC).

See Errors for the full error code catalogue.