Client Tokens

Client tokens are bearer API keys for applications and services that call the selected Msty Nexus machine.

Create one token per client so access can be identified, scoped, rotated, and revoked independently.

Create a token

1. Open Client Tokens.
2. Select the machine the app will call.
3. Choose Add token.
4. Give it a name that identifies the app or owner.
5. Select the narrowest available role.
6. Configure model or tool access when those controls are available.
7. Copy the plaintext key from the one-time handoff.

Nexus stores only a hash after the handoff closes. If the key is lost, rotate it or create a replacement.

Inference and admin roles

• Inference tokens call supported gateway routes and read only the state required by that client.
• Admin tokens can reach management APIs and should be reserved for trusted operators and management tools.

Free cannot create admin tokens. Always prefer an inference token when the client only needs model access.

Model and tool access

Model allowlists can limit a key to named models where the selected workflow exposes that control. Tools Gateway access is always explicit: a new key has no tool access until you choose All tools, a custom rule set, or a tool profile.

Custom per-tool rules, approvals, and hourly limits require Pro or Enterprise. See Tools Gateway for precedence and approval behavior.

General per-token request, concurrency, and token-budget controls are not exposed in the 0.8 Console. Organization Guard policy can still enforce centrally managed limits where entitled.

Rotate a token

Rotation replaces the credential without consuming another token slot. Update the client with the newly revealed key before discarding the old value.

Because the replacement is shown once, do not close the handoff until it is stored in the intended secret manager or client configuration.

Connection addresses

The page shows the addresses available to the selected machine, including loopback, private network, or Access from anywhere endpoints where configured.

An address does not grant access by itself. The client must still send its Nexus token as the API key.

Access from anywhere uses the same machine-issued client tokens as local and private-network access. Enabling it does not create a separate endpoint key. See Fleet for setup and security guidance.

Revoke access

Revoke a token when a client is removed, a device is lost, or ownership changes. Revocation affects that customer token without exposing or rotating provider credentials.

See Gateway for client configuration and Security for token handling guidance.