Choose between an API key, a connected app and an AI teammate

Three ways into one API: an API key for your own software, an OAuth connected app for a product other people use, and an AI teammate for AI that works on its own. Which to pick and why.

There is one Nova API. What differs is who the caller is and how Nova knows it. Pick the door that matches your situation; every door reaches the same operations, documented in the API reference.

API key: "our own software talks to our own Nova"

An admin creates the key in Nova and pastes it into your software. Nothing to register, no browser round trip, no token refresh. Send it as Authorization: Bearer nova_live_….

• Use it for: a nightly export to your bookkeeping tool, a script that creates work orders from a spreadsheet, a dashboard on your office TV.
• Acts as: a hidden integration user in that one organization. What it may do is exactly what the admin chose, up to what that admin can do themselves; deletes, voids and settings can all be granted.
• Cannot: act in another organization, sign in to the app, or manage credentials.
• Can be limited: a daily cap, allowed addresses, branches, and actions that wait for a person to approve them (Rate limits, daily caps and other limits on a credential).
• Ends when: it expires or an admin revokes it.

Start here: Make your first API request.

Connected app: "people connect our product to their Nova"

You build something other companies use, and each of their people connects it to their own Nova account. That is OAuth 2.1 with PKCE: your app is registered once, a person presses Allow on Nova's Connect an app page, and you get a short-lived access token plus a refresh token for that person in that organization.

• Use it for: a mobile app, a browser extension, an assistant such as ChatGPT or Claude (through MCP), any product with many customers.
• Acts as: the person who connected it, limited to the scopes they allowed. Nova writes every action to the audit log under their name.
• Cannot: exceed what that person can do themselves. The few actions Nova guards with an identity check (payout accounts, role changes, bulk exports) wait under Approvals (Handle an action that waits for a person's approval).
• Ends when: the person disconnects it under Connected apps, an admin disconnects it for the organization, or the refresh token is replayed (Nova then revokes the whole connection).

Details: Authenticate with OAuth 2.1 or an API key.

AI teammate: "an AI works here on its own"

A person adds an AI teammate under AI Teammates, gives it a name, a title and roles, and hands its client_id and secret to whoever runs the AI. The software exchanges those for a token with grant_type=client_credentials.

• Use it for: an AI that books follow-up visits every morning, an after-hours receptionist, a quote-chaser — anything that should show up on the team and in history under its own name rather than a person's.
• Acts as: its own user, with its own roles, answerable to an accountable person who hears when it hits a limit or is paused.
• Can have: working hours, a daily cap, work assigned to it, and a customer-facing name with an AI disclosure line on what it sends.
• Cannot: sign in to the app, be a platform admin, or do more than its roles allow. A person can pause it or retire it in one press.

Details: Run software as an AI teammate.

Quick decision