Authentication
apitree supports two authentication methods. Use API Keys for server-to-server and AI Agent calls, JWT for browser sessions.
API Keys
API keys are the primary authentication method. They follow the format nxs_{env}_{random}.
Property
Detail
Formatnxs_live_{random} or nxs_test_{random}
StorageHMAC-SHA256 hash only — raw key never stored
ShownOnce at creation — save it immediately
RotationCreate new key, revoke old one
HeaderAuthorization: Bearer nxs_live_xxx
JWT Tokens
Used for browser dashboard sessions. Obtained via POST /api/auth/login.
Token
Lifetime
Access Token15 minutes
Refresh Token7 days (rotation on use)