---
key: choose-an-api-key-or-a-connected-app
title: Choose between an API key, a connected app and an AI teammate
audience: developer
section: api/authentication
routes: []
since: 0.0.1
updated: 0.0.1
status: published
summary: "Three ways into one API: an API key for your own software, an OAuth connected app for a product other people use, and an AI teammate for AI that works on its own. Which to pick and why."
keywords: [api key vs oauth, simple api, which auth, integration, connected app, agent, client credentials, decide]
related: [api-authentication, make-your-first-api-request, connect-an-ai-agent, run-an-ai-teammate, api-limits, api-overview]
---

There is one Nova API. What differs is who the caller is and how Nova knows
it. Pick the door that matches your situation; every door reaches the same
operations, documented in the [[api-reference]].

## API key: "our own software talks to our own Nova"

An admin creates the key in Nova and pastes it into your software. Nothing to
register, no browser round trip, no token refresh. Send it as
`Authorization: Bearer nova_live_…`.

- **Use it for:** a nightly export to your bookkeeping tool, a script that
  creates work orders from a spreadsheet, a dashboard on your office TV.
- **Acts as:** a hidden integration user in that one organization. What it
  may do is exactly what the admin chose, up to what that admin can do
  themselves; deletes, voids and settings can all be granted.
- **Cannot:** act in another organization, sign in to the app, or manage
  credentials.
- **Can be limited:** a daily cap, allowed addresses, branches, and actions
  that wait for a person to approve them ([[api-limits]]).
- **Ends when:** it expires or an admin revokes it.

Start here: [[make-your-first-api-request]].

## Connected app: "people connect our product to their Nova"

You build something other companies use, and each of their people connects
it to their own Nova account. That is OAuth 2.1 with PKCE: your app is
registered once, a person presses **Allow** on Nova's **Connect an app**
page, and you get a short-lived access token plus a refresh token for that
person in that organization.

- **Use it for:** a mobile app, a browser extension, an assistant such as
  ChatGPT or Claude (through MCP), any product with many customers.
- **Acts as:** the person who connected it, limited to the scopes they
  allowed. Nova writes every action to the audit log under their name.
- **Cannot:** exceed what that person can do themselves. The few actions
  Nova guards with an identity check (payout accounts, role changes, bulk
  exports) wait under **Approvals** ([[wait-for-a-person-to-approve]]).
- **Ends when:** the person disconnects it under **Connected apps**, an admin
  disconnects it for the organization, or the refresh token is replayed
  (Nova then revokes the whole connection).

Details: [[api-authentication]].

## AI teammate: "an AI works here on its own"

A person adds an AI teammate under **AI Teammates**, gives it a name, a
title and roles, and hands its `client_id` and secret to whoever runs the
AI. The software exchanges those for a token with
`grant_type=client_credentials`.

- **Use it for:** an AI that books follow-up visits every morning, an
  after-hours receptionist, a quote-chaser — anything that should show up on
  the team and in history under its own name rather than a person's.
- **Acts as:** its own user, with its own roles, answerable to an accountable
  person who hears when it hits a limit or is paused.
- **Can have:** working hours, a daily cap, work assigned to it, and a
  customer-facing name with an AI disclosure line on what it sends.
- **Cannot:** sign in to the app, be a platform admin, or do more than its
  roles allow. A person can pause it or retire it in one press.

Details: [[run-an-ai-teammate]].

## Quick decision

| You are… | Pick |
|---|---|
| Automating your own organization's data | API key |
| Shipping a product other companies connect | Connected app (OAuth) |
| Letting a person use an assistant on their own account | Connected app (OAuth, through MCP) |
| Running an AI that should have its own identity, hours and audit trail | AI teammate |
| Not sure | Start with an API key; the scopes and the API are the same, so switching later changes only how you get the token |