Every request to /api/v1 needs a bearer token in the Authorization header:

Authorization: Bearer YOUR_TOKEN

There are two kinds of token. Both work on every /api/v1 endpoint.

Personal access token (PAT) OAuth 2.0 access token
Use it for Your own scripts, backends and no-code tools An app that other Nonverbia users connect to
Created by An organization owner, in the app The user, on a consent screen
Format nvb_pat_ followed by a random string A signed JWT
Lifetime Until revoked, or until the expiration date you set 1 hour, renewable with a refresh token for 30 days

<aside> 💡

A workspace in the app is a project in the API, and a meeting is a capture.

</aside>

How a token is scoped

A token is limited in four ways. A request must pass all of them.

  1. Organization. A token belongs to exactly one organization. Everything it touches is in that organization.
  2. Scopes. Each endpoint requires a scope. A token without it gets 403 insufficient_scope.
  3. Workspaces. A token is limited to the workspaces picked when it was created. This applies to workspace data (meetings, skills) served through the MCP server. Webhook subscriptions are organization-wide, so this limit does not narrow them.
  4. The user's role. A token acts as the user who created or authorized it, with that user's role. Changing webhooks requires the user to be an organization owner. If the user loses that role, is deactivated or leaves, the token stops working for those calls.

Scopes

Scope Grants Used by
profile:read Read the user's profile GET /api/v1/me, GET /oauth/userinfo
webhooks:read List and read webhook subscriptions GET /api/v1/webhooks, GET /api/v1/webhooks/{uuid}
webhooks:write Create, change, delete and test webhook subscriptions POST, PATCH, DELETE on /api/v1/webhooks, and POST /api/v1/webhooks/{uuid}/test
organizations:read Read organization details MCP server
projects:read Read workspaces and their skills MCP server
projects:write Create and update skills MCP server
captures:read Read meetings and their analysis MCP server
captures:write Create and complete action items MCP server

The organizations, projects and captures scopes have no /api/v1 endpoints yet. Today they only apply to the MCP server. Request the smallest set of scopes you need.

The live list is always available without authentication:

curl https://api.nonverbia.com/oauth/scopes

Personal access tokens

Create a token

Only an organization owner can create tokens, and only in the app:

  1. Open a workspace and go to Integrations → API access.