Create and protect an API key

An API key identifies your model requests to NexusAPI.

Create a key

Setting	Recommendation
Name	Use a project or client name, such as `codex-work`.
Token group	Choose the group that contains the target model.
Limit	Set a sensible upper limit for the project.
Model restriction	Enable it only when you need to restrict the key to specified models.
IP allowlist	Use it only when your server has a stable outbound IP address.
Expiry	Set an expiry date for temporary test keys.

Send the key in the Authorization header:

Authorization: Bearer YOUR_API_KEY

Never commit an API key to a public repository.
Do not share a full key in screenshots, support tickets, or chat logs.
Use a separate key for each project, person, and environment.
In production, load it from environment variables or a secret manager instead of source code.
Review usage logs regularly. Disable a key immediately if you see unexpected use.
If a key may be exposed, disable or delete it first, create a replacement, and update the affected applications.

Credential	Purpose
API key	Calls model APIs such as Chat Completions, Responses, Messages, Images, and `/v1/models`.
System access token	Reads your account’s usage-log API. It cannot call models.
Console session / cookie	Signs you in through a browser. It cannot be used as a model API credential.

Treat the system access token as a secret too. Do not put either credential in a URL query string or send it in full to support.