Authentication

The Nifty API accepts two kinds of bearer credentials on both the v1.0 and v3.0 surfaces: a Personal Access Token (PAT) for a single member's own access, and an OAuth 2.1 token for a third-party app acting on behalf of a team.

Every request carries the credential the same way, regardless of which kind it is or which API version you're calling:

Code
Authorization: Bearer <token>

v3.0 additionally requires a version header on every request (routes are unprefixed — do not put /v3 in the path):

Code
X-API-Version: 3

Personal Access Tokens (PAT)

A PAT authenticates as you — it carries your own team membership and permissions. Create one from your Nifty account settings; the token is shown once at creation time and looks like:

Code
nft_user_<prefix>_<secret>

Use it exactly like any bearer token:

Code
curl https://openapi.niftypm.com/api/v1.0/projects \
  -H "Authorization: Bearer nft_user_<prefix>_<secret>"

v1.0 scope requirement: v1.0 has no per-action scope model, so a PAT (or OAuth token — see below) must carry the Full access scope tier to authenticate on /api/v1.0/* at all. A narrower-scoped token is rejected — create the PAT with Full access if you plan to use it against v1.0. v3.0 endpoints, by contrast, check the specific scopes each token actually needs per resource and action.

OAuth 2.1 (third-party apps)

If you're building an integration rather than scripting your own account, register a Nifty app and take a team through the OAuth 2.1 authorization flow. The resulting access token is issued in the same shape as a PAT (nft_oauth_<...>) and is presented the same way — Authorization: Bearer nft_oauth_<...>.

Authorization (OAuth 2.1) documents the whole flow: the discovery document, authorization-code exchange with PKCE, refresh tokens and their lifetimes, the scope model, and redirect URI rules. Note the scope requirement called out there — an OAuth 2.1 token does not satisfy the v1.0 Full-access scope requirement above, so it is rejected on /api/v1.0/*. Existing legacy Nifty App integrations are unaffected and continue to work.

Trying it out here

Use the API tokens page (top navigation) to save a token in your browser and drive the "Try it" panel on any endpoint below — nothing is sent anywhere except the request you trigger.