API keys
Keys are created and managed from the dashboard, not the API itself — creating a key is a privileged, session-authenticated action, deliberately not something a leaked bearer token could ever do to itself.
Create a key
Go to Settings → API keys. You'll need to be an organization owner or admin. Give it a name you'll recognize later (which API consumer is this? which environment?) and an optional expiry.
The raw key — rk_live_... — is shown exactly once, in that creation response. Store it somewhere real (a secrets manager, not a Slack message) — Nexus never stores it in a recoverable form, only a SHA-256 hash. If you lose it, revoke it and create a new one; there's no "show key again."
What a key can do
A key is scoped to one organization, all-or-nothing — there's no per-key read/write or per-KB scoping today. Anyone holding the key can do anything the public API supports for that organization. Treat it like a password, not a public identifier: never commit it, never send it from a browser.
Revoke a key
Revocation is checked on every request — there's no cache window where a revoked key keeps working. Do this immediately if a key leaks; there's no faster mitigation available.
List your keys
Returns the prefix and metadata for every key — never the raw value again. Paginated; see Pagination.
{
"data": [
{
"id": "ak_01h...",
"name": "Production server",
"prefix": "rk_live_ab12",
"lastUsedAt": "2026-07-20T14:02:11.000Z",
"expiresAt": null,
"revokedAt": null,
"createdAt": "2026-06-01T09:00:00.000Z"
}
],
"nextCursor": null
}