Every request to the NSP daemon must carry a valid API key in the X-Substrate-Key HTTP header. Keys are issued and managed entirely from the Nelieo platform dashboard — the daemon itself never generates keys locally. This means your keys are tied to your Nelieo account, can be revoked instantly from the platform, and are verified against a central authority on first use. This page walks you through getting a key, using it in your code, and following best practices for safe key management.
All NSP API keys follow this format:
The nsp_live_sk_ prefix identifies the key as a live production key issued by platform.nelieo.com. Never construct or modify key strings manually — always use keys exactly as the platform issues them.
Getting a Key
Generate your API key directly from the Nelieo platform dashboard:
- Navigate to platform.nelieo.com
- Sign in to your Nelieo account
- Open the API Keys section and select Generate New Key
- Copy the key immediately — the platform only shows the full key value once
Store your key as soon as it appears on screen. The platform does not display the full key value again after you close the generation dialog.
Using a Key
Pass your key in the X-Substrate-Key header on every HTTP request, or provide it to the Python SDK at client construction time.
cURL
Python SDK
Prefer the NSP_API_KEY environment variable over passing the key as a string argument. Environment variables keep secrets out of source code and make rotation easier — update the variable without touching your code.
Authentication Error Codes
If your key is missing, invalid, or disabled, the daemon returns a 401 response with a machine-readable error code in the body.
Best Practices
Follow these practices to keep your keys secure across all environments:
- Store keys in environment variables. Never hardcode a key value in source files, configuration checked into version control, or any artifact that leaves your machine.
- Use separate keys per environment. Issue one key for local development, another for staging, and a third for production. This way, rotating or revoking a production key does not affect your development workflow.
- Rotate keys regularly. Generate a new key, update your deployment, then revoke the old key from the platform dashboard. The daemon picks up the new key on its first use.
- Revoke compromised keys immediately. If a key is ever exposed — in a log file, a commit, a screenshot — revoke it on the platform dashboard before doing anything else.
Disabling Auth for Development
You can disable API key authentication in a local development environment by setting auth.require_key = false in your axon.toml:
You can also set the equivalent environment variable without modifying any file:
Never disable authentication in production. When require_key = false, every request — from any process on the machine — is accepted without any credential check. The daemon emits a continuous warning log at startup to make this state visible:If you see this warning in production logs, re-enable auth immediately. 