API keys & scopes

Key format

nz_sk_live_...   production key
nz_sk_test_...   sandbox key (no real money moves)

One key per agent

nuez is designed around one API key per agent. This gives you:

• Independent revocation — revoke one agent’s access without affecting others
• Per-agent policy — different thresholds and scopes per agent
• Per-agent audit trail — the dashboard shows all transactions per key

Creating a key

In the dashboard, go to API Keys → New key. Set:

1. Name — human-readable label (e.g. claude-supplier-agent, monitoring-bot)
2. Threshold — ARS amount above which WhatsApp approval is required
3. Scopes — permissions granted to this key
4. Allowlist (optional) — restrict to specific CVU/CBU/alias destinations

Caution

The full key value is shown once at creation. Copy it immediately — you cannot retrieve it later. If lost, revoke and create a new key.

Scopes reference

Scope	Required for
transfer:write	POST /v1/transfers · nuez.transfer
balance:read	GET /v1/balance · nuez.balance
transactions:read	GET /v1/transactions · nuez.list_transactions

Assign only the scopes the agent needs. A monitoring agent needs only balance:read. A payment agent needs transfer:write.

Revoking a key

In the dashboard, go to API Keys, find the key, and click Revoke. All subsequent requests with that key return 401 Unauthorized. Other keys are unaffected.