Authentication

API keys, scopes, and how MCP clients sign in.

Every authenticated request uses:

code

Authorization: Bearer nxd_live_...

Create a key at app.nexdoc.design/keys. The secret is shown once. Store it as NXD_API_KEY. Never print a key.

Remote MCP at https://mcp.nexdoc.design/mcp uses browser OAuth instead — no key is stored in the client. See MCP server.

API keys

code

curl -sS -X POST "$NXD_API_URL/v1/auth/keys" \
  -H "Authorization: Bearer $NXD_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name":"CI"}' | jq

code

{
  "key_id": "key_...",
  "secret_key": "nxd_live_..."
}

List and revoke:

code

curl -sS "$NXD_API_URL/v1/auth/keys" -H "Authorization: Bearer $NXD_API_KEY" | jq
curl -sS -X DELETE "$NXD_API_URL/v1/auth/keys/$KEY_ID" \
  -H "Authorization: Bearer $NXD_API_KEY" | jq

Do not create or revoke keys unless you intend to.

Scopes

New keys default to:

Scope	Access
`files:rw`	Upload / read / delete files
`jobs:rw`	Create / read / delete jobs, publish, export
`runs:rw`	Create / read / cancel / delete runs

Who am I?

code

curl -sS "$NXD_API_URL/v1/auth/me" \
  -H "Authorization: Bearer $NXD_API_KEY" | jq