Skip to main content
Every request to the NSP daemon must include a valid API key in the X-Substrate-Key header. The daemon checks each key against your account on platform.nelieo.com and caches the result in memory, so repeated requests stay fast after the first verification. Authentication is enabled by default — you do not need to configure anything to use it, you just need a key.

​
Get an API Key

All NSP API keys are issued through the Nelieo platform dashboard. To generate one:
1

Go to the platform

Open platform.nelieo.com in your browser.
2

Sign in to your account

Log in with your Nelieo credentials.
3

Generate an API key

Navigate to the API Keys section of your account and create a new key.
Your API key will look like this:
Copy the key and store it somewhere secure — the platform only shows it once.
Keep your API key out of source control. Use environment variables or a secrets manager to inject it into your agents at runtime.

​
Authenticate Your Requests

Pass the key in the X-Substrate-Key HTTP header on every API call. The daemon rejects any request that is missing or presents an unrecognized key.
Using the NSP_API_KEY environment variable is the recommended approach for agents deployed in automated environments — it keeps the key out of your source code entirely.

​
How Key Verification Works

When the daemon receives a request, it checks its in-memory cache first. A cached result returns in under a millisecond. If the key has not been seen before, the daemon reaches out to platform.nelieo.com to verify it, then caches the result for all subsequent requests:
The cache means your agents incur a one-time verification round-trip per key, not one per request. The daemon handles the caching automatically — there is nothing extra to configure.

​
Authentication Errors

If the daemon rejects a request, it returns 401 with a JSON body describing the reason: Check the platform dashboard if you receive invalid_key or disabled_key — your key may have been rotated or deactivated.

​
Disable Authentication for Development

You can turn off authentication in a local development environment to skip the key requirement entirely. Set require_key = false in your axon.toml:
Or pass the environment variable inline when launching the daemon:
When authentication is disabled, the daemon prints a continuous warning to remind you:
Never disable authentication on a production system or any machine that could be accessed by untrusted code. Without authentication, any process on the machine — or any script that can reach the daemon’s port — can read application state and execute actions without restriction.