Authentication

The PierNode API authenticates every request with an API key, sent as a bearer token:

Authorization: Bearer pn_your_api_key

A request with no key, a malformed key, or an unknown key is rejected with 401 Unauthorized. The response is identical in all three cases.

Getting a key

Generate your key from the API key section of the dashboard. Make one key per integration; each can be revoked on its own.

A key can be shown again from the dashboard whenever you need it — it is kept encrypted, and only the account that owns it can read it. The list shows a masked form, such as pn_••••••••••••a1b2, until you ask for the full key.

Revoking a key

If a key is exposed, revoke it from the dashboard and create another. Revoking takes effect immediately: the key stops authenticating with no grace period, so switch your applications to the new key first, or expect requests to fail until you do.

Keeping the key secret

An API key acts on behalf of your account and can spend its balance. Treat it like a password:

• Send it only from your server, never from browser or mobile client code.
• Keep it in an environment variable or a secret manager, not in source control.
• Revoke it and create another if you suspect it has leaked.

The API deliberately does not send CORS headers to third-party origins, so a fetch from your own web page will be blocked by the browser. That is not an oversight to work around: anything the browser can send, the person using the browser can read, and a key shipped to a browser is a key you have published. Call PierNode from your backend and let your frontend talk to that.

Verifying your key

GET /api/v1/me returns the account the key belongs to and its current balance. Use it to confirm your credentials are wired up correctly.

curl https://app.piernode.com/api/v1/me \
  -H "Authorization: Bearer $PIERNODE_API_KEY"

{
	"id": "the-account-id",
	"balance": "0.000000",
	"currency": "USD"
}

Every endpoint under /api/v1/ accepts this key.