Developers
API keys, the REST API, and the MCP server: how to authenticate, what you can call, and how to connect an AI client.
Everything in the app is reachable from outside it: a REST API for scripts and CI, an MCP server so AI clients such as Cursor and Claude can read and update your program, webhooks that tell your systems when something changes, and inbound hooks that let your systems start a workflow. Both live on the same host, share one permission model, and record every call in the organization's activity log.
Three ways to authenticate
| Method | Best for | How you get it | Who can set it up |
|---|---|---|---|
| OAuth | Interactive MCP clients (Cursor, Claude, ChatGPT, Copilot, and others) | The client opens a Noru sign-in; you pick an organization and approve scopes. Nothing to copy. | Any member. Scopes are capped by your role. |
| API key | REST calls, CI pipelines, scripts, and headless MCP clients | An admin creates it under SettingsDeveloper; the secret is shown once. | Admins only |
| CI token exchange | GitHub Actions and GitLab.com jobs | The job exchanges its OIDC ID token for a 15-minute token, under a CI trust record an admin creates in SettingsDeveloper. Nothing stored. | Admins only |
Viewers can only hold read scopes, whichever method they use. An API key acts as the admin who created it, but only inside the organization it was created in.
Endpoints
| What | URL |
|---|---|
| REST base URL | https://api.noru.tech |
| MCP endpoint | POST https://api.noru.tech/v1/mcp |
| OpenAPI document | https://api.noru.tech/openapi |
| Interactive API reference | https://api.noru.tech/ |
| Markdown reference for LLMs: index, one page per endpoint | https://api.noru.tech/llms.txt |
| Markdown reference for LLMs: one file | https://api.noru.tech/llms-full.txt |
| OAuth authorization server metadata | https://app.noru.tech/.well-known/oauth-authorization-server |
API keys
Create a scoped, optionally expiring key and use it as a bearer token.
CI token exchange
Give GitHub Actions and GitLab CI jobs a 15-minute token instead of a stored key.
REST API
Resources, pagination, errors, rate limits, and a first request.
Webhooks
Signed events when records change: the payload, verifying the signature, retries, and the delivery log.
Inbound hooks
Let another system start a workflow by posting signed JSON.
MCP server
Tools, resources, prompts, the OAuth flow, and how scopes follow roles.
MCP client setup
Per-client instructions for Cursor, Claude, ChatGPT, Copilot, and more.
Popular tasks
- Create an API key with only the scopes a client needs
- Make your first request and read the response envelope
- Verify a webhook signature in Node.js or Python
- Debug a failing webhook endpoint from its delivery log
- Add Noru to Cursor or another AI client
- Push a fideslang data map from CI with a
write:datamapskey - See which scopes a viewer can hold before you ask someone to approve a client
Last updated on