Authentication
API keys, scopes, and rotating credentials safely.
Every request to the Nexus API is authenticated with a bearer token. Keys are scoped to a single workspace and carry an explicit permission set.
Bearer tokens
BASH
curl https://api.nexus-ai.dev/v2/runs \
-H "Authorization: Bearer $NEXUS_API_KEY" \
-H "Content-Type: application/json" \
-d '{"model":"nexus-1-pro","input":"ping"}'Key scopes
Grant the narrowest scope that still lets the key do its job. A key used by a browser-facing service should never carry write scopes.
| Scope | Grants | Typical use |
|---|---|---|
| runs:write | Start and cancel agent runs | Backend services |
| runs:read | Read run history and traces | Dashboards |
| tools:write | Register and update tools | CI pipelines |
| admin | Everything, including billing | Owners only |
Rotation
Keys can overlap during a rotation window: create the new key, deploy it, then revoke the old one. Revocation propagates to every edge node within 30 seconds.
Never ship keys to the browser
A leaked key can burn your entire monthly quota in minutes. Proxy requests through your own backend, or mint short-lived session tokens with runs:write only.