API Keys & Tokens
Manage your authentication credentials, configure scopes, and securely integrate with the CloudNexus API. All tokens are encrypted at rest and support automated rotation.
Create & Manage Keys
Generate API keys from the Developer Console or via the management API. Each key can be scoped to specific services, environments, and permission levels.
API keys are revealed only once upon creation. Store them securely in environment variables or a secrets manager. Never commit them to version control.
Generate New Key
Scopes: compute:read storage:write network:admin
Active Tokens
| Key ID | Name | Last Used | Status | Actions |
|---|---|---|---|---|
| cnx_prod_8xK9... | Production Backend | 2 mins ago | Active | |
| cnx_stg_mQ4v... | Staging CI/CD | 3 hrs ago | Active | |
| cnx_dev_pL9z... | Local Development | Never | Expired |
Authentication Examples
Include your API key in the Authorization header or as a query parameter. Header-based authentication is strongly recommended for production.
curl -X GET "https://api.cloudnexus.io/v2/instances" \\ -H "Authorization: Bearer cnx_prod_8xK9mP2vL5qR7wN3tJ6yH1cZ4bA0eD" \\ -H "Content-Type: application/json"
import requests api_key = "cnx_prod_8xK9mP2vL5qR7wN3tJ6yH1cZ4bA0eD" headers = { "Authorization": f"Bearer {api_key}", "Content-Type": "application/json" } response = requests.get("https://api.cloudnexus.io/v2/instances", headers=headers) print(response.json())
const fetch = require('node-fetch'); const apiKey = 'cnx_prod_8xK9mP2vL5qR7wN3tJ6yH1cZ4bA0eD'; const response = await fetch('https://api.cloudnexus.io/v2/instances', { headers: { 'Authorization': `Bearer ${apiKey}`, 'Content-Type': 'application/json' } }); console.log(await response.json());
Token Types & Scopes
CloudNexus uses fine-grained OAuth-style scopes. Combine resources and actions using the format <resource>:<action>. Available scopes include compute, storage, network, billing, and admin.
compute:read- List and describe VPS/VM instancescompute:write- Create, update, and terminate instancesstorage:admin- Full access to object storage and databasesnetwork:read- View load balancers, firewalls, and DNS records
Rate Limits & Best Practices
| Plan | Requests / Min | Burst Limit | Response Code |
|---|---|---|---|
| Starter | 60 | 100 | 429 Too Many Requests |
| Professional | 1,000 | 2,000 | 429 Too Many Requests |
| Enterprise | Custom | Unlimited | 429 Too Many Requests |
When rate limited, the API returns a 429 status with a Retry-After header. Implement exponential backoff in your client logic.
Frequently Asked Questions
Use the POST /v2/keys/rotate endpoint. It generates a new key while keeping the old one active for 24 hours. Update your systems during this grace period, then revoke the old key manually or automatically.
Yes. Under key settings, enable IP allowlisting. You can add CIDR ranges (e.g., 203.0.113.0/24) to restrict where the token can be used. This is recommended for production deployments.
Expired tokens immediately return 401 Unauthorized on all requests. You will receive email and webhook notifications 7 and 1 day before expiration. Use the CLI or API to auto-renew if configured.