Bot Authentication & Security

Authentication on NDC ensures that requests made to the API and Gateway are authorized and mapped to the correct user or bot.

---

Bot Tokens vs User Tokens

NDC distinguishes between human users and automated bots:

Token Type	Header Format	Use Case
Bot Token	Authorization: Bot <token>	Automated bots, background services, custom integrations
OAuth2 Bearer	Authorization: Bearer <token>	Third-party web applications acting on behalf of a human user
User Session	Handled via secure HTTP cookies	First-party NDC web, desktop, and mobile clients

Using Bot Tokens

Every HTTP request your bot makes to the NDC REST API must include the Authorization header with the Bot prefix:

GET /api/v1/users/@me HTTP/1.1
Host: chat.nexoriadevelopment.com
Authorization: Bot your_bot_token_here
User-Agent: MyBot (https://github.com/mybot, 1.0.0)

[!IMPORTANT] The space between Bot and <token> is required. Omitting Bot or providing an invalid token will result in 401 Unauthorized.

---

Token Security Best Practices

1. Never commit tokens to version control: Always add .env to your .gitignore file before pushing any code to GitHub, GitLab, or other public repositories.

2. Use Environment Variables: In Node.js, use process.env.NDC_BOT_TOKEN. In Python, use os.getenv("NDC_BOT_TOKEN").

3. Resetting Compromised Tokens: If your token is accidentally leaked or exposed:

   • Go immediately to the Developer Portal.
   • Select your Application → Bot tab.
   • Click Reset Token. The previous token is invalidated immediately, terminating any active Gateway connections.