Authentication

Every API surface authenticates the same way — an x-api-key request header — but which key you send, and how it's validated, depends on which surface you're calling.

x-api-key: your_api_key_here

Taxpayer API keys

Taxpayer keys are prefixed tpk_ and are validated by hashing the key you send (SHA-256) and comparing it against the stored hash on your taxpayer account. A missing or invalid key returns 401 Unauthorized. Endpoints that create invoices additionally require an active subscription (403 Forbidden if inactive) and a complete business profile, including your NRS Business ID and NRS Service ID (403 Forbidden until the profile is complete on your Business Profile page).

System Integrator API keys

System Integrator keys are issued per SI account and checked directly against your account's stored key. A missing or unrecognized key returns 401 Unauthorized. Requests made with a valid SI key can act on behalf of any taxpayer the SI has onboarded.

Core & Access Point Provider API keys

The Core reference-data endpoints (under /v1/core/resources and /v1/core/commons/enums) and the Access Point Provider endpoints (under /v1/app) accept either a Taxpayer key (tpk_) or a System Integrator key (sik_) — the key's prefix determines which account type it's checked against. An unrecognized prefix, or a key that doesn't match any account, returns 403 Forbidden.

Where to find your key

Taxpayer and System Integrator keys are generated from your respective account dashboard after logging in to the portal, on your Business Profile page. The key field is masked by default — click the eye icon next to it to reveal the key at any time, or the copy icon to copy it directly.