Authentication

The Entri API supports two authentication methods depending on how you access it.

Session-based authentication (web app)

When you sign in through the Entri web application, BetterAuth creates a cookie-based session. All requests made from the browser automatically include this session cookie, so no additional setup is required for web app usage. Session authentication supports:

Email + password sign-in
OAuth via Google or GitHub

Sessions are managed automatically — you do not need to handle tokens or headers when using the web app.

API token authentication (programmatic access)

For programmatic access — such as from the CLI, CI/CD pipelines, or your own integrations — use API tokens. API tokens are passed via the X-API-Key request header:

GET /api/v1/projects HTTP/1.1
Host: app.nt3.io
X-API-Key: entri_your_token_here

All token values begin with the prefix entri_.

Example: curl

curl https://app.nt3.io/api/v1/projects \
  -H "X-API-Key: entri_your_token_here"

Example: JavaScript fetch

const response = await fetch('https://app.nt3.io/api/v1/projects', {
  headers: {
    'X-API-Key': process.env.ENTRI_API_TOKEN,
  },
});
const projects = await response.json();

Example: CLI

The CLI handles token storage and injection automatically. After running nt3 login, the token is stored locally and attached to every outgoing request:

nt3 login -t entri_your_token_here
nt3 push  # token is sent automatically

You can also set the token via the NT3_API_TOKEN environment variable, which takes priority over stored credentials:

export NT3_API_TOKEN=entri_your_token_here
nt3 push

Token priority order

When the CLI determines which token to use, it checks sources in this order:

NT3_API_TOKEN environment variable (highest priority)
.nt3.local.json in the current directory (folder-scoped)
~/.nt3/config.json (global)

This allows you to override credentials per project or per CI environment without modifying the global config.

Security recommendations

Never commit API tokens to source control
Store tokens in environment variables or a secrets manager in CI/CD
Use short-lived or project-scoped tokens where possible
Run nt3 status to confirm which token is currently active

The GraphQL API at /graphql also supports API token authentication via the same X-API-Key header.

Getting Started

CLI

Integrations

Concepts

Open source

Authentication

Session-based authentication (web app)

API token authentication (programmatic access)

Example: curl

Example: JavaScript fetch

Example: CLI

Token priority order

Security recommendations

​Session-based authentication (web app)

​API token authentication (programmatic access)

​Example: curl

​Example: JavaScript fetch

​Example: CLI

​Token priority order

​Security recommendations

Session-based authentication (web app)

API token authentication (programmatic access)

Example: curl

Example: JavaScript fetch

Example: CLI

Token priority order

Security recommendations