Access Tokens
Access tokens authenticate Nexigon CLI, SDKs, and API integrations without storing an account password. User and organization API tokens authorize management clients. Devices use separate credentials to connect to a project.
Token Types
| Type | Purpose |
|---|---|
User token, u_sk_ | Act with a user’s access to Nexigon resources. |
Organization API token, org_sk_ | Act within one organization under a token policy. Supported by Nexigon CLI 0.6 and later. |
| Deployment token | Connect devices to a project together with their certificate and fingerprint. |
| Provisioning token | Pair one device and obtain device-bound credentials. |
| Device token | Let an external application verify a connected device’s identity. |
User Tokens
A user token grants access to everything its user can access. User tokens do not provide a separate resource scope.
Create a token under User Settings → API Tokens → New token. Give it a name and copy the value when it is shown; it cannot be viewed again. Delete the token from the same settings page to revoke its access.
Organization API Tokens
An organization API token belongs to one organization and grants only the permissions in its policy. Use one for automation that needs a defined set of resources and actions.
Under the organization’s Settings → API Tokens, choose New API Token. Enter a name, add policy statements for the required scopes and permissions, then choose Create. Token creation requires permission to manage organization API tokens and may require credential verification.
Copy the token immediately. The token list shows its ID and policy but does not reveal the secret again. Delete a token from that list to revoke it; applications using it lose access.
Configure a Client
Run nexigon-cli configure and enter your Nexigon Hub URL and token.
Nexigon CLI 0.5 accepts user tokens; Nexigon CLI 0.6 and later also accept
organization API tokens. See Nexigon CLI for installation.
HTTP clients send the token in an Authorization: Bearer <token> header.
See Actions API for the request format.