DEVELOPER DOCUMENTATION
Authentication
Every API call carries a key in the Authorization header.
The header
HTTP
Authorization: Bearer nbd_live_…Use HTTPS. A missing, unknown or revoked key answers 401 INVALID_API_KEY; a key without the needed permission, 403 KEY_SCOPE.
Server keys
Keys that start with nbd_live_ are secrets. Keep them on your server; never put them in a web page, an app, a URL or a public repository.
Browser keys
Keys that start with nbd_pub_ are meant for web pages. They only work from the website addresses they list (their origins), and only for search, parse and autocomplete. Requests from another site answer 403 ORIGIN_NOT_ALLOWED. The parse, autocomplete and index search endpoints answer CORS preflights for them.
The public playground uses its own protected route with a human check; it is not an API.