Client Tokens
Create, rotate, limit, and revoke API keys for apps that call Nexus
Client tokens are bearer API keys for applications and services that call the selected Msty Nexus machine.
Create one token per client so access can be identified, limited, rotated, and revoked independently.
Create a token
- Open Client Tokens.
- Select the machine the app will call.
- Choose Add token.
- Give it a name that identifies the app or owner.
- Select the narrowest available role.
- Configure supported request or token-budget limits.
- Copy the plaintext key from the one-time handoff.
Nexus stores only a hash after the handoff closes. If the key is lost, rotate it or create a replacement.
Inference and admin roles
- Inference tokens call supported gateway routes and read only the state required by that client.
- Admin tokens can reach management APIs and should be reserved for trusted operators and management tools.
Free cannot create admin tokens. Always prefer an inference token when the client only needs model access.
Token limits
Where available, a token can restrict models, concurrent requests, pending requests, and daily or monthly token use.
Token-level restrictions combine conservatively with local Pro guardrails or Enterprise organization policy. Deny rules win, and the lowest applicable positive limit is enforced.
Rotate a token
Rotation replaces the credential without consuming another token slot. Update the client with the newly revealed key before discarding the old value.
Because the replacement is shown once, do not close the handoff until it is stored in the intended secret manager or client configuration.
Connection addresses
The page shows the addresses available to the selected machine, including loopback, private network, or Access from anywhere endpoints where configured.
An address does not grant access by itself. The client must still send its Nexus token as the API key.
Access from anywhere uses the same machine-issued client tokens as local and private-network access. Enabling it does not create a separate endpoint key. See Fleet for setup and security guidance.
Revoke access
Revoke a token when a client is removed, a device is lost, or ownership changes. Revocation affects that customer token without exposing or rotating provider credentials.
See Gateway for client configuration and Security for token handling guidance.