> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nexusapi.link/llms.txt
> Use this file to discover all available pages before exploring further.

# Create and protect an API key

> Create a NexusAPI key with the right group, limits, and safety settings.

An API key identifies your model requests to NexusAPI.

## Create a key

1. Sign in to the NexusAPI console.
2. Open **Token Management** or **API Key Management**.
3. Select **Add token**.
4. Give the token a recognizable name.
5. Choose a token group.
6. Set an appropriate limit or restriction for its purpose.
7. Submit, then copy the generated API key.

## Recommended settings

| Setting           | Recommendation                                                        |
| ----------------- | --------------------------------------------------------------------- |
| Name              | Use a project or client name, such as `codex-work`.                   |
| Token group       | Choose the group that contains the target model.                      |
| Limit             | Set a sensible upper limit for the project.                           |
| Model restriction | Enable it only when you need to restrict the key to specified models. |
| IP allowlist      | Use it only when your server has a stable outbound IP address.        |
| Expiry            | Set an expiry date for temporary test keys.                           |

## Use the key

Send the key in the `Authorization` header:

```http theme={"system"}
Authorization: Bearer YOUR_API_KEY
```

## Keep it safe

* Never commit an API key to a public repository.
* Do not share a full key in screenshots, support tickets, or chat logs.
* Use a separate key for each project, person, and environment.
* In production, load it from environment variables or a secret manager instead of source code.
* Review usage logs regularly. Disable a key immediately if you see unexpected use.
* If a key may be exposed, disable or delete it first, create a replacement, and update the affected applications.

## API key and other credentials

| Credential               | Purpose                                                                                   |
| ------------------------ | ----------------------------------------------------------------------------------------- |
| API key                  | Calls model APIs such as Chat Completions, Responses, Messages, Images, and `/v1/models`. |
| System access token      | Reads your account's [usage-log API](/en/developer/usage-logs). It cannot call models.    |
| Console session / cookie | Signs you in through a browser. It cannot be used as a model API credential.              |

Treat the system access token as a secret too. Do not put either credential in a URL query string or send it in full to support.