Startup credit

Startup Program credit keys (https://nways.ng/developers/startup-credit): app attestation for mobile credit keys, and verifying a server egress address. Free, rate-limited per key and address.

On this page

A challenge for an app attestation (mobile credit key)
Prove the app is the startup's verified app (a 30-day session)
Verify a server egress address (server credit key, sent from it)

Note:

Send your key as key=YOUR_API_KEY on the address, or in the X-NWays-Api-Key header. API keys

Base address: https://nways.ng/maps/v1

A challenge for an app attestation (mobile credit key)

POST https://nways.ng/maps/v1/credit/attest/challenge

A one-time challenge, valid 5 minutes, for the key given. The app attests over SHA-256("nways-credit|" + challenge + "|" + keyId). The N-Ways iOS and Android SDKs call it for you (NWaysCredit.start()). Free.

cURL

curl -X POST "https://nways.ng/maps/v1/credit/attest/challenge" \
  -H "X-NWays-Api-Key: YOUR_API_KEY"

JavaScript

const res = await fetch('https://nways.ng/maps/v1/credit/attest/challenge', {
  method: 'POST',
  headers: { 'X-NWays-Api-Key': process.env.NWAYS_API_KEY },
})
const data = await res.json()

Python

import os
import requests

res = requests.post(
    "https://nways.ng/maps/v1/credit/attest/challenge",
    headers={"X-NWays-Api-Key": os.environ["NWAYS_API_KEY"]},
    timeout=10,
)
data = res.json()

Response

The challenge

Field	Type	Description
`challenge`	`string`	Required.
`expiresIn`	`integer`	Required. Seconds.

200 OK

{
  "challenge": "string",
  "expiresIn": 0
}

Errors

default Error

Prove the app is the startup's verified app (a 30-day session)

POST https://nways.ng/maps/v1/credit/attest

iOS: an App Attest attestation; Android: a hardware-backed Android Keystore key's certificate chain made with the challenge. The answer's token goes in X-NWays-Attestation on every call of the mobile credit key. Reasons: NOT_MOBILE_KEY, PLATFORM_MISMATCH, PRODUCT_UNVERIFIED, ATTESTATION_FAILED. Free.

Request body

Field	Type	Description
`platform`	`string`	Required. One of: `ios`, `android`.
`challenge`	`string`	Required.
`keyId`	`string`	Required. iOS: the App Attest key id (base64). Android: your own random id, the one in the hashed client data.
`attestation`	`string`	iOS: the attestation object, base64.
`chain`	`string[]`	Android: the key's certificate chain, base64 DER, leaf first.

cURL

curl -X POST "https://nways.ng/maps/v1/credit/attest" \
  -H "X-NWays-Api-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"platform":"ios","challenge":"string","keyId":"string","attestation":"string","chain":["string"]}'

JavaScript

const res = await fetch('https://nways.ng/maps/v1/credit/attest', {
  method: 'POST',
  headers: { 'X-NWays-Api-Key': process.env.NWAYS_API_KEY, 'Content-Type': 'application/json' },
  body: JSON.stringify({
    "platform": "ios",
    "challenge": "string",
    "keyId": "string",
    "attestation": "string",
    "chain": [
      "string"
    ]
  }),
})
const data = await res.json()

Python

import os
import requests

res = requests.post(
    "https://nways.ng/maps/v1/credit/attest",
    headers={"X-NWays-Api-Key": os.environ["NWAYS_API_KEY"]},
    json={"platform": "ios", "challenge": "string", "keyId": "string", "attestation": "string", "chain": ["string"]},
    timeout=10,
)
data = res.json()

Response

The session

Field	Type	Description
`token`	`string`	Required.
`expiresAt`	`string (date-time)`	Required.

200 OK

{
  "token": "string",
  "expiresAt": "2026-10-15T09:00:00+01:00"
}

Errors

default Error

Verify a server egress address (server credit key, sent from it)

POST https://nways.ng/maps/v1/credit/verify-ip

Sent from the server whose address or range was registered on startup.nways.ng, with a server credit key and the challenge shown when it was added (valid 48 hours, once). Reasons: NOT_SERVER_KEY, CHALLENGE_UNKNOWN, CHALLENGE_EXPIRED, IP_MISMATCH. Free.

Request body

Field	Type	Description
`challenge`	`string`	Required.

cURL

curl -X POST "https://nways.ng/maps/v1/credit/verify-ip" \
  -H "X-NWays-Api-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"challenge":"nwip_…"}'

JavaScript

const res = await fetch('https://nways.ng/maps/v1/credit/verify-ip', {
  method: 'POST',
  headers: { 'X-NWays-Api-Key': process.env.NWAYS_API_KEY, 'Content-Type': 'application/json' },
  body: JSON.stringify({
    "challenge": "nwip_…"
  }),
})
const data = await res.json()

Python

import os
import requests

res = requests.post(
    "https://nways.ng/maps/v1/credit/verify-ip",
    headers={"X-NWays-Api-Key": os.environ["NWAYS_API_KEY"]},
    json={"challenge": "nwip_…"},
    timeout=10,
)
data = res.json()

Response

Verified

Field	Type	Description
`verified`	`boolean`	Required.
`cidr`	`string`	Required.
`from`	`string`	Required.

200 OK

{
  "verified": true,
  "cidr": "string",
  "from": "string"
}

Errors

default Error