Authentication

Key types

Prefix	Use	Environment
nsk_test_	Development & testing	Watermarked / sandbox
nsk_live_	Production traffic	Billed, full quota

Web & server

On the web or a server you control, pass the key directly when constructing the client. Store it in an environment variable, never commit it to source control.

const nosmai = new Nosmai(process.env.NOSMAI_KEY)

Mobile (recommended)

Mobile binaries can be decompiled, so the iOS and Android SDKs authenticate with a public app ID instead of a secret. The SDK exchanges it for a short-lived token, and your secret provider keys stay on the Nosmai edge proxy.

import NosmaiSDK

Nosmai.configure(appId: "app_8f3a...")

Rotating keys

Create a new key, deploy it, then revoke the old one. There is no downtime, and both work during the overlap. Revoked keys stop authenticating immediately.