1. Get your API Key

1. Sign in and copy the key from the API Key area at the top of Personal space. This page also displays your own key while signed in. When signed out, YOUR_API_KEY is only a placeholder, not a working key. Personal space ↗
2. OpenAPI access requires an active membership.
3. Replace YOUR_API_KEY in every example with the complete key, without a Bearer prefix, extra quotes or whitespace. Resetting your API Key invalidates the old key; update every integration.

2. Send the request header

Use apiKey as the header name and the raw key as its value. OpenAPI does not read API Keys from Authorization: Bearer, JSON bodies, URL parameters or website login cookies. Signing in on the website does not replace this header. MCP Bearer authentication does not apply here.

apiKey: YOUR_API_KEY
Accept-Language: en-US

For POST endpoints, also set Content-Type: application/json and put business parameters in the JSON body. Keep apiKey in the header. GET queries normally do not need Content-Type.

Pass the API Key in the request header and keep it secure. Accept-Language takes priority for both success and error responses. If omitted or blank, the API Key owner language is used; unidentified accounts default to en-US. Supports zh-CN, zh-TW, en-US and language weights. Invalid or unsupported headers default to en-US. X-Language and website login preferences do not affect OpenAPI.

3. Make a read-only test request

This GET request only reads the account associated with the key. It creates no mailbox and deducts no credits. Active membership is required. HTTP 200 with code=0 indicates success; opening the public documentation is not API authentication. Examples keep placeholders and never insert your actual key.

curl --request GET 'https://app.nexmask.net/openapi/v1/user/info.cgi' \
  --header 'apiKey: YOUR_API_KEY' \
  --header 'Accept-Language: en-US'

Configure Postman

In Headers, add apiKey with your full key as Value; optionally add Accept-Language. Alternatively, select API Key in Authorization, set Key to apiKey, enter the key as Value and choose Header for Add to. Do not select Bearer Token. For POST, select raw / JSON under Body.

Common authentication errors

• HTTP 401 / code=-1210 — The API Key is missing or invalid, or the account is frozen. Check the placeholder, the apiKey header, any accidental Bearer prefix and whether the key was reset.
• HTTP 403 / code=-1300 — The key was recognized, but membership is missing or expired. Check membership status in Personal space.
• HTTP 415 — The POST content type is incorrect. Set Content-Type: application/json and send valid JSON. The JSON example contains business parameters only, not a complete HTTP request.

Keep and use the key on a trusted backend. Do not expose it in public pages, repositories, screenshots, shared logs or URLs. Reset it in Personal space if leaked, and never publicly share requests containing a real key.