Make API keys from a script

Pro

You’ll get: a script that makes an API key for one app, limited to the models you name, and removes it when the app no longer needs it. Use it to set up many apps or machines the same way.

You need:

• msty-nexusctl. It comes with the Nexus Runtime. See Command line.
• An Administration key. In Connections → Client API keys, click Create API key and set Access role to Administration. An Inference only key can’t make or remove keys.
• A model name or alias for the app, such as nexus-coder from Model Aliases.
• jq, to read the JSON output.

Steps

1. Copy your Administration key, then save it in a file only you can read. msty-nexusctl refuses a key file that others can read.

   mkdir -p ~/.config
   touch ~/.config/nexus-admin-key
   chmod 600 ~/.config/nexus-admin-key
   pbpaste > ~/.config/nexus-admin-key

   pbpaste is for macOS. On Linux, open the file in an editor and paste the key.

2. Check that the key works. You get a JSON list of your keys.

   msty-nexusctl --token-file ~/.config/nexus-admin-key tokens list

3. Create a key for the app, and keep its ID and the key itself:

   created=$(msty-nexusctl --token-file ~/.config/nexus-admin-key tokens create \
     --name "Support bot" \
     --role inference \
     --allowed-models nexus-coder)
   KEY_ID=$(printf '%s' "$created" | jq -r '.record.id')
   NEW_KEY=$(printf '%s' "$created" | jq -r '.token')

   The output has two parts: token, the key, and record, which holds id, name, role, allowedModels and tokenPrefix. To allow more than one model, separate the names with commas.

4. Put NEW_KEY in the app’s secret store. Nexus shows the key only in this output. Later, tokens get and tokens list show only its tokenPrefix.

5. When the app no longer needs the key, remove it:

   msty-nexusctl --token-file ~/.config/nexus-admin-key tokens delete "$KEY_ID"

   It prints nothing and exits with 0.

Always pass —role inference

Without --role, Nexus makes an Administration key when your plan allows one. That key could change all of Nexus.

Leave out --allowed-models and the key can use every model. Nexus doesn’t check the names you give, so a typo makes a key that can use nothing.

Check it worked

Before step 5, list the models the new key can see:

curl http://127.0.0.1:3939/v1/models -H "Authorization: Bearer $NEW_KEY"

You see only the model behind nexus-coder. The key also shows under its name in Connections → Client API keys. After step 5, the same call fails with UNAUTHORIZED.

If a command fails, msty-nexusctl prints one JSON object on stderr with the error code. FORBIDDEN means the key you signed in with isn’t an Administration key. CLIENT_TOKEN_LIMIT_REACHED means your plan’s key limit is reached. More in Command line and Connections.