Authentication Guide

Learn how to authenticate with the Nexus API using API keys, OAuth 2.0, and JWT tokens. This guide covers all supported authentication methods and best practices for securing your integration.

API Key Authentication

The simplest authentication method. Include your secret key in the Authorization header:

Authorization: Bearer sk_live_xxxxxxxxxxxxxxxx

Important: Never expose your secret key in client-side code. Use API keys only in server-side applications.

OAuth 2.0

For applications that need to act on behalf of users, implement the OAuth 2.0 authorization code flow:

1. Register your application in the Nexus Dashboard
2. Redirect users to the authorization endpoint
3. Exchange the authorization code for an access token
4. Use the access token for authenticated requests

GET https://auth.nexus.dev/authorize
  ?client_id=YOUR_CLIENT_ID
  &redirect_uri=YOUR_REDIRECT_URI
  &response_type=code
  &scope=read write

JWT Tokens

For microservice-to-microservice authentication, you can generate short-lived JWT tokens signed with your API secret. Tokens expire after 1 hour by default.

Best Practices

• Rotate API keys regularly (at least every 90 days)
• Use environment variables — never hardcode secrets
• Implement the principle of least privilege with scoped tokens
• Monitor your API key usage in the dashboard