What is a workspace?
A workspace is the top-level container for everything in your NameGrid account. All of your domains, credits, and API keys belong to it — there is no concept of sharing resources across workspaces.- Domains — every domain you register is owned by your workspace.
- Credits — your billing balance is scoped to the workspace.
- API keys — all keys you generate operate within the same workspace.
Each NameGrid account has exactly one workspace. If you need strict environment separation (e.g. production vs. staging), use separate NameGrid accounts.
Workspace isolation
NameGrid enforces strict isolation between workspaces. An API key can only see and manage the domains that belong to its own workspace. If you send a request for a domain that exists in a different workspace — or doesn’t exist at all — the API returns404 Not Found.
The API deliberately returns
404 instead of 403 when you request a domain outside your workspace. Returning 403 would confirm that the domain exists and reveal ownership information. By returning 404, NameGrid prevents any information from leaking about which domains other workspaces own.404 on a domain endpoint as “not found or not yours” — you cannot distinguish between the two, by design.
Viewing workspace info
To retrieve details about your workspace, call theGET /v1/account endpoint. The response includes your workspace ID, display name, creation date, and current credit balance.
id field if you need to reference your workspace in support requests. The credits.balance field reflects your real-time credit balance and is covered in detail on the Credits page.
API keys
API keys are the credentials you use to authenticate every request to the NameGrid API. Each key is scoped to your workspace — it cannot access any other workspace’s resources. Generate and revoke keys under Settings → API tokens in the NameGrid dashboard. For full details on key creation, rotation, and security best practices, see the Authentication guide.Include your API key on every request using the
x-api-key header. Requests without a valid key receive a 401 Unauthorized response.