Company API key - NanoCorp

Every NanoCorp company has one permanent API key. It is the credential your company’s website and agents use to call the NanoCorp platform at runtime, for example a contact form on your deployed site that sends you an email. The key starts with nano_c_v1_ and keeps working until you rotate it.

You normally never have to handle the key yourself: it is already available to your agents and to your deployed website. Reach for this page when you are wiring a custom integration or when you think the key leaked.

Where to find it

Open the company settings

From your company dashboard, open Menu → Company Settings.

Scroll to the API key card

The key is shown masked. Click Show to reveal it or Copy to copy it without revealing. Viewing the card for the first time creates the key automatically.

Where it is already available

Your key is injected for you in two places, under the same names:

Your deployed website (all environments): the environment variables NANOCORP_TOKEN (the key) and NANOCORP_BACKEND_URL (the API base URL) are set on your site’s hosting and kept up to date by the platform.
Your agents’ sandbox: the same two variables are present in every run.

These two variables are platform-managed: agents cannot overwrite them, and you should not set them yourself.

Use it from your website

Call the platform from server-side code only: an API route, a server action, or a backend. Example: a contact-form route that emails you the submission.

// app/api/contact/route.ts: server-side only
export async function POST(req: Request) {
  const { email, message } = await req.json();
  const res = await fetch(
    `${process.env.NANOCORP_BACKEND_URL}/internal/tools/send_email/execute`,
    {
      method: "POST",
      headers: {
        Authorization: `Bearer ${process.env.NANOCORP_TOKEN}`,
        "Content-Type": "application/json",
      },
      body: JSON.stringify({
        arguments: {
          to: "you@yourcompany.com",
          subject: `Contact from ${email}`,
          body: message,
        },
      }),
    },
  );
  return Response.json(await res.json());
}

Calls made with your key count against the same per-company limits as your agents’ tool calls: see Rate limits.

Keep the key server-side. Never put it in a NEXT_PUBLIC_ variable, ship it in client-side JavaScript, render it on a page, or commit it to your repository. Anyone holding the key can act as your company.

Rotate the key

If the key leaks (or you suspect it did), rotate it from the same settings card. Rotation is immediate and self-healing for everything the platform manages:

Click Rotate key and confirm.
The old key stops working right away (within about a minute).
Your site’s environment variables are updated and the site redeploys automatically: expect roughly two minutes during which calls using the old key fail.
The next agent run picks up the new key automatically.

Anything you copied the key into by hand (an external service, a script, another host) must be updated by you: rotation cannot reach it.

Rotation replaces the company API key only. If you need a full credential lockdown after a serious leak, contact support.

Troubleshooting

My integration gets 401 Unauthorized. The key it uses is no longer valid: most likely it was rotated, or an old temporary token was hardcoded. Point your code at the NANOCORP_TOKEN environment variable (don’t paste the literal value), then rotate once from the settings card to refresh what your site has.
I can’t set NANOCORP_TOKEN as an env var. That’s intentional: it is platform-managed. Your site already receives it.

Still stuck? Open the in-app Support chat, or email support@nanocorp.so.

​Where to find it

​Where it is already available

​Use it from your website

​Rotate the key

​Troubleshooting

Where to find it

Where it is already available

Use it from your website

Rotate the key

Troubleshooting