Authentication & secrets

Authenticating the CLI

nimbus login opens a browser to authorize the CLI and stores a token locally. For CI, use a long-lived API key instead:

nimbus login --token $NIMBUS_API_KEY

Protecting a function

Nimbus doesn’t put an auth layer in front of your functions automatically — check credentials inside the function itself, the same way you would on any other server.

API key

functions/private.ts

export default function handler(request: Request) {
  const key = request.headers.get('x-api-key');
  if (key !== process.env.API_KEY) {
    return new Response('Unauthorized', { status: 401 });
  }
  return new Response('Secret data');
}

OAuth (Beta)

Beta

functions/private.ts

import { verifySession } from '@nimbus/auth';

export default async function handler(request: Request) {
  const session = await verifySession(request);
  if (!session) {
    return new Response('Unauthorized', { status: 401 });
  }
  return new Response(`Hello, ${session.user.name}`);
}

Tip

Store the comparison value with nimbus env set ... --secret rather than hardcoding it.

Rotating an API key

nimbus keys rotate
# ✔ New key issued. Old key remains valid for 24h.

Old keys keep working for 24 hours after rotation so in-flight deploys and CI jobs don’t break.