# NEXUS AI Access Tokens

Access tokens authenticate REST API and CLI calls from scripts, CI, and agents that do not use MCP.

## Format

Tokens start with `nxk_` and are sent as `Authorization: Bearer nxk_...`. The full value is returned once, when the token is created. Store it in a secret manager.

## Create

Dashboard: https://nexusai.run/settings/tokens.

CLI:

```bash
nexus token create --name ci-deploy --scopes deployments:read,deployments:create --expires 90d
```

API:

```http
POST https://api.nexusai.run/api/tokens
Content-Type: application/json

{ "name": "ci-deploy", "scopes": ["deployments:read", "deployments:create"], "expiresAt": "2026-12-31T00:00:00Z" }
```

`name` and `scopes` are required. `expiresAt` is optional; a token without it does not expire.

## List and revoke

```bash
nexus token list --show-last-used --unused-since 30
nexus token revoke <id> --yes
```

The API equivalents are `GET /api/tokens` and `POST /api/tokens/{id}/revoke`. A revoked token stops working for all later requests.

## Permissions

Creating, listing, and revoking tokens needs the `tokens.manage` organization permission, which Owners and Admins have.

## Scopes

Use the narrowest set. The full list, and which MCP tool needs which scope, is in [Authentication](/docs/auth.md) and the [tool catalog](/mcp/tools.json). Tokens issued before 2026-05-18 with only the broad `deployments:*` scopes still satisfy the matching fine-grained checks.

## Related resources

- [Authentication](/docs/auth.md)
- [Security](/docs/security.md)