Authentication

The Nexevo API authenticates with a workspace-bound API key, sent as a Bearer token.

The header

Send your key in the Authorization header on every request:

http

Authorization: Bearer sk-ws-...

A missing, invalid, or wrong-workspace key returns 401.

Keys are workspace-scoped

Each key belongs to exactly one workspace. Resource endpoints live under /v1/workspaces/{workspace_id}/…, and the key's workspace must match the {workspace_id} in the path — a key cannot reach another workspace's data. To work with several workspaces, create one key per workspace.

Managing keys

Create, list, and revoke keys from the app (Settings → API keys) or over the API:

POST/v1/workspaces/{workspace_id}/api-keys —

create a key. The secret is returned once in the response; store it securely.

GET/v1/workspaces/{workspace_id}/api-keys —

list keys (metadata only — never the secret).

DELETE/v1/workspaces/{workspace_id}/api-keys/{key_id} —

revoke a key immediately.

bash

# Create a key
curl https://nexevo.ai/v1/workspaces/$NEXEVO_WORKSPACE/api-keys \
  -H "Authorization: Bearer $EXISTING_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name": "production-backend"}'

A key grants full access to its workspace — reading and writing memory, running agents (which spend the workspace balance), and more. Keep keys on your server, set one per environment, and revoke any key that may have leaked.

Sessions vs API keys

The web app authenticates users with login sessions (cookies); those are for the UI. For programmatic access — your backend, scripts, integrations — always use an API key, not a session.