Authentication

All API requests require an API key. NPILayer uses the standard HTTP Bearer token scheme — pass your key in the Authorization header on every request.

Getting an API key

Create an account Sign up at npilayer.com/signup — no credit card required for the free plan.
Generate a key From your dashboard, click Create API Key, give it a name, and copy the key immediately. It is only shown once.
Store it securely Treat your API key like a password. Store it in an environment variable, never in source code or client-side JavaScript.

Making authenticated requests

Include your API key in the Authorization header with the Bearer scheme:

curl \
  -H "Authorization: Bearer npil_live_your_api_key_here" \
  "https://api.npilayer.com/v1/providers/1003000126"

$apiKey = getenv('NPILAYER_API_KEY');

$ch = curl_init('https://api.npilayer.com/v1/providers/1003000126');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => [
        'Authorization: Bearer ' . $apiKey,
    ],
]);
$data = json_decode(curl_exec($ch), true);
curl_close($ch);

const API_KEY = process.env.NPILAYER_API_KEY;

const response = await fetch(
  'https://api.npilayer.com/v1/providers/1003000126',
  {
    headers: {
      'Authorization': `Bearer ${API_KEY}`,
    },
  }
);
const { data } = await response.json();

import os
import requests

API_KEY = os.environ['NPILAYER_API_KEY']

r = requests.get(
    'https://api.npilayer.com/v1/providers/1003000126',
    headers={'Authorization': f'Bearer {API_KEY}'}
)
provider = r.json()['data']

Key format

API keys are prefixed with npil_live_ followed by a cryptographically random string. Keys are shown once at creation and cannot be retrieved again — if you lose a key, revoke it and create a new one.

Never include API keys in browser JavaScript, mobile app bundles, public repositories, or log files. Use environment variables or a secrets manager.

Revoking a key

To revoke a key, go to your dashboard and click Revoke next to the key. Revoked keys are rejected immediately. There is no delay or grace period.

Authentication errors

Requests with a missing or invalid API key receive a 401 response. The error code field tells you which:

HTTP	Code	Meaning
401	`missing_api_key`	No `Authorization` header was present on the request.
401	`invalid_api_key`	The key was present but did not match any active key (wrong key, revoked key, or typo).

{
  "error": {
    "code": "invalid_api_key",
    "message": "The API key provided is invalid or has been revoked."
  }
}