API keys and scopes
Send the key as a bearer token: Authorization: Bearer nr_live_…. Keys look like nr_live_ followed by 43 characters and a 6-character checksum, so secret scanners can recognise them. A key is shown once, when it is created; NorReach keeps only a fingerprint.
Who can create keys
Owners and admins, in Settings › API & webhooks. A key can only carry scopes the creator role itself holds. Keys can never create keys.
Scopes
Red scopes reach people, spend money, publish or erase; creating a key with one needs a sign-in in the last 10 minutes. Presets: Read only (18 scopes), Build (23) and Full control (52).
| Scope | What it allows | Role needed |
|---|---|---|
| workspace:read | See the workspace, its senders and async jobs | any member |
| contacts:read | Read contacts, lists, tags and do-not-contact entries | any member |
| contacts:write | Create and update contacts, notes, tags, lists and consent | contacts.assign |
| contacts:export | Export contacts and leads in bulk | any member |
| ⚠ contacts:delete | Erase a person's data (keeps a do-not-contact entry) | settings.compliance |
| ⚠ suppressions:write | Add people and domains to do-not-contact | settings.compliance |
| campaigns:read | Read campaigns, sequences, automations and enrollments | any member |
| campaigns:write | Create and edit campaigns and automations | campaigns.edit |
| ⚠ campaigns:launch | Launch, pause and resume campaigns; enroll contacts | campaigns.launch |
| plans:read | Read plans, briefs and cards | any member |
| plans:write | File briefs, edit cards and ask for replans | plan.edit |
| ⚠ plans:approve | Approve or skip plan cards; start and pause plans | plan.approve |
| approvals:read | See the Approvals queue | any member |
| ⚠ approvals:decide | Approve or skip anything in the Approvals queue | approvals.decide, meetings.decide |
| inbox:read | Read inbox threads and messages | any member |
| ⚠ messages:send | Send messages and replies | inbox.reply |
| calls:read | Read calls, outcomes and summaries | any member |
| calls:recordings | Read call transcripts and recordings | calls.monitor |
| ⚠ calls:place | Request AI calls to saved contacts | calls.place |
| meetings:read | Read meetings, booking pages and availability | any member |
| meetings:write | Book, approve and decline meetings | meetings.own, meetings.decide, meetings.pages |
| deals:write | Move deals between stages | deals.move |
| pages:read | Read landing pages, versions, leads and analytics | any member |
| pages:write | Edit landing page drafts and site settings | pages.edit |
| ⚠ pages:publish | Publish and unpublish landing pages | pages.publish |
| pages:domains | Add and manage custom domains | pages.domains |
| ads:read | Read ad accounts, launches and results | any member |
| ⚠ ads:spend | Publish Nora's ad launches and manage live ads | ads.spend |
| Read social posts and connected profiles | any member | |
| Create and schedule social posts | social.publish | |
| nora:ask | Ask Nora questions | nora.ask |
| ⚠ nora:run | Give Nora work to do | nora.run |
| nora:autonomy | Change what Nora may do without asking | nora.autonomy |
| analytics:read | Read dashboards and analytics | any member |
| billing:read | See credits, usage and prices | billing.view |
| team:read | See members and invites | any member |
| team:write | Invite people to the workspace | team.invite |
| ⚠ team:admin | Change roles and switch people off | team.roles |
| ⚠ workspace:admin | Pause and resume all outreach; compliance settings | outreach.pause, outreach.resume, settings.compliance |
| webhooks:read | See webhook endpoints and deliveries | any member |
| webhooks:write | Add, change and test webhook endpoints | api.keys |
| audit:read | Read the audit log | audit.view |
| numbers:read | See phone numbers, numbers to buy and business verifications | any member |
| ⚠ numbers:verify | Submit business verification for phone numbers | numbers.verify |
| ⚠ numbers:buy | Buy phone numbers — within the daily cap, waiting in Approvals unless an owner switched that off | numbers.buy |
| templates:read | Read message and WhatsApp templates | any member |
| templates:write | Write message templates and send WhatsApp templates for review | channels.templates |
| ⚠ voice:write | Create and change voice agents | voice.agents |
| ⚠ calls:routing | Change who answers incoming calls | calls.routing |
| team:schedules | Set people's working hours and availability | team.schedules |
| team:requests | Read and handle the team's requests | team.requests |
| workspace:settings | Change the workspace's name and time zone | settings.workspace |
| ⚠ ads:limits | Change ad accounts' spending limits | ads.limits |
Expiry, rotation and revoking
- Expiry: never, 30, 90 or 365 days, or a date. An expired key answers 401 key_expired.
- Rotate: a replacement with the same settings; the old key keeps working for 0, 1, 24 or 168 hours, then stops.
- Revoke: immediate (401 key_revoked). Owners can revoke every key of the workspace at once.
- Suspended: NorReach stops a key after unusual activity (403 key_suspended) until an owner or admin resumes or revokes it — see unusual activity.
- Narrowing: scopes can be taken away from a key, never added — create a new key for more.
IP allowlists
Up to 20 addresses or ranges (IPv4 and IPv6). A request from anywhere else answers 403 ip_not_allowed.
Old-style keys
Keys that start with nrk_ come from before this API and answer 401 legacy_key. Create a new key and revoke the old one.