Authentication

The Notca API uses a simple and secure API key authentication mechanism.
Every authenticated request must include an x-api-key header.

How Authentication Works

Authentication in Notca is intentionally minimalistic:

1. All private endpoints require the x-api-key header.
2. There is no OAuth, no sessions, and no refresh tokens.
3. API keys belong to your account and can be revoked at any time.
4. Missing or invalid keys immediately return 401 Unauthorized.

Getting an API Key

You can generate an API key from your Notca dashboard.

Settings → API Keys

Each API key allows:

• full authenticated access to all your resources
• secure communication from servers, workers, or backend applications
• instant revocation when needed

Making Authenticated Requests

Every authenticated request must include the following HTTP header:

x-api-key: <your-api-key>

Examples

curl -X GET "https://app.notca.co/api/v1/notes?page=1&pageSize=20" \
  -H "x-api-key: YOUR_API_KEY"

const res = await fetch("https://app.notca.co/api/v1/folders", {
  headers: {
    "x-api-key": process.env.NOTCA_API_KEY!,
  },
});

const data = await res.json();

import axios from "axios";

const res = await axios.get("https://app.notca.co/api/v1/folders", {
  headers: {
    "x-api-key": process.env.NOTCA_API_KEY!,
  },
});

const data = await res.json();