Authentication and security

Nexus uses different credential types for public publisher APIs, member APIs, and OpenRTB.

Product	Credential	Transport
Search API	Scoped publisher API key	token query parameter
XML API	Scoped publisher API key	token query parameter
MCP	Scoped publisher API key	Authorization: Bearer ...
Advertiser API	Member access JWT or same-origin session	Authorization header or secure cookie
OpenRTB	Partner-specific configuration	Agreed HTTPS bidder endpoint

Query-string compatibility

Search and XML keep query-string authentication for backward compatibility. Query strings can appear in browser history, reverse-proxy logs, and monitoring systems. Never paste a production URL containing a real token into chat, email, or screenshots.

Publisher API key scopes

Scope	Access
publisher:search:read	Search reports and Search link metadata
publisher:xml:read	XML statistics for owned TIDs

The API also enforces member role, tenant ownership, optional source-IP restrictions, expiration, revocation, and rate limits.

MCP header

Authorization: Bearer YOUR_NEXUS_API_KEY
Content-Type: application/json

The API key must never be placed in the MCP URL.

Advertiser member token

Authorization: Bearer MEMBER_ACCESS_TOKEN

Search/XML publisher keys are rejected by advertiser endpoints. The backend derives the tenant and advertiser UID from the authenticated member and does not allow the caller to select another member.

Credential handling

• Store secrets in a secret manager or protected environment variable.
• Grant only the required scopes.
• Configure source-IP restrictions where the client has stable egress IPs.
• Rotate and revoke credentials when a machine, user, or integration is retired.
• Redact Authorization, cookies, query tokens, passwords, and API keys from logs.
• Use HTTPS only.