# NEXUS AI Authentication

NEXUS AI has separate authentication surfaces for the platform REST API, personal access tokens, and MCP.

## MCP authentication

The MCP service uses OAuth 2.0 with PKCE and dynamic client registration. Interactive MCP clients authenticate in a browser. Headless clients send an OAuth access token as `Authorization: Bearer <token>`.

## REST authentication

The REST API supports NEXUS authentication and scoped access tokens (`nxk_`). See [Access tokens](/docs/tokens.md). Access tokens do not work for MCP; MCP uses OAuth. Tokens are independently revocable and should be issued with the narrowest scopes needed for an agent workflow.

## Scope examples

- `deployments:read`, `deployments:logs`, `deployments:create`, `deployments:delete`
- `secrets:read`, `secrets:manage`, `secrets:delete`
- `domains:read`, `domains:manage`, `domains:delete`
- `db:read`, `db:query`, `db:admin`, `db:source:delete`
- `volumes:read`, `volumes:manage`, `volumes:delete`
- `buckets:read`, `buckets:manage`, `buckets:delete`
- `managed_db:read`, `managed_db:manage`, `managed_db:delete`
- `support:read`, `support:write`

`nexusai_whoami` requires authentication but no additional MCP scope. Destructive tools require separate delete or admin scopes and explicit confirmation in the calling agent workflow.

## Related resources

- [Security](/docs/security.md)
- [MCP](/docs/mcp.md)
- [MCP tools](/mcp/tools.json)