Every request must include your API key in the Authorization header:
Create a key
- Sign in to the Nadcab Labs Console.
- Open Settings → Key & Access.
- Create a key and copy it. It is shown in full only once.
Your API key can move funds and create cards. Keep it on your server, never in browser or mobile app code, and rotate it immediately if it leaks.
Example
Restrict access by IP
Limit API access to your servers with Set IP allowlist. Requests from other IP addresses are rejected once an allowlist is set.
Protect card data
Full card numbers and CVVs are returned encrypted with your RSA public key. See Card data encryption. 
