Authentication

Notebind supports two authentication methods: API keys for programmatic access and session cookies for browser-based access.

API key authentication

API keys are the recommended way to authenticate agents, scripts, and CI/CD pipelines.

Creating an API key

1. Sign in to notebind.com
2. Go to Settings → API Keys
3. Click Create API Key, give it a name (e.g., “Production Agent”)
4. Copy the key immediately — it’s only shown once

Or create one via API (requires existing session auth):

curl -X POST https://notebind.com/api/keys \
  -H "Content-Type: application/json" \
  -H "Cookie: your-session-cookie" \
  -d '{"name": "Production Agent"}'

Using an API key

Pass the key in the Authorization header:

curl https://notebind.com/api/documents \
  -H "Authorization: Bearer nb_sk_a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6"

Key format

API keys follow the format nb_sk_ followed by 32 hex characters:

nb_sk_a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6

• The nb_sk_ prefix identifies it as a Notebind secret key
• Keys are hashed with SHA-256 before storage — the plain key cannot be recovered
• The first 14 characters (prefix) are stored for display purposes
• last_used_at is updated on each successful authentication

Managing keys

Action	Endpoint
List keys	GET /api/keys
Create key	POST /api/keys
Delete key	DELETE /api/keys/:id

Caution

API keys grant full access to your account. Treat them like passwords — don’t commit them to version control or share them publicly.

Session cookie authentication

Browser-based requests use Supabase session cookies automatically. This is what happens when you use the Notebind web app.

The session is managed by @supabase/ssr and stored in an HTTP-only cookie named sb-<project-ref>-auth-token.

Auth methods

• Email/password — Sign up and sign in at notebind.com/auth/register
• Google OAuth — Click “Continue with Google” (coming soon)
• GitHub OAuth — Click “Continue with GitHub” (coming soon)

Share token access

Share links provide limited access to specific documents without authentication. See Share Links & Permissions for details.

Share tokens are passed as query parameters:

curl "https://notebind.com/api/documents/DOC_ID?share_token=TOKEN"

Share token permissions:

Permission	Can view	Can comment	Can edit	Can suggest
view	Yes	No	No	No
comment	Yes	Yes	No	No
edit	Yes	Yes	Yes	Yes

Error responses

All authentication failures return a consistent error format:

{
  "data": null,
  "error": {
    "message": "Unauthorized",
    "code": "UNAUTHORIZED"
  }
}

Status	Meaning
401	No valid credentials provided
403	Authenticated but insufficient permissions