Authentication

The SDK authenticates every request with the API key passed to new Nirmos.

const nirmos = new Nirmos({
  apiKey: process.env.NIRMOS_API_KEY!,
});

The key is sent through the x-api-key request header. Do not add this header manually.

Server-side use only

Nirmos API keys authorize platform operations and may permit model spend, prompt access, or prompt updates. Keep them in trusted server code:

• Node.js API servers
• background workers
• server actions and route handlers
• deployment platform functions
• private command-line tools

Do not initialize the SDK with a secret key in:

• browser components
• mobile application bundles
• public Git repositories
• client-readable environment variables
• logs or error reporting metadata

For browser-facing applications, call your own authenticated server endpoint. That endpoint can enforce user permissions and use the Nirmos SDK privately.

Separate environments

Use separate keys for development, staging, and production. Scope each key to the minimum permissions and organization resources required by that workload.

const nirmos = new Nirmos({
  apiKey: requiredEnv("NIRMOS_API_KEY"),
  baseUrl: process.env.NIRMOS_BASE_URL,
});

Fail during application startup when the key is missing. Avoid discovering missing credentials only after live traffic arrives.

Rotation

To rotate a key without downtime:

1. Create a replacement key with equivalent or narrower permissions.
2. Update the secret in the deployment environment.
3. Restart or redeploy application instances.
4. Confirm new requests succeed.
5. Revoke the old key.

The SDK does not read environment variables automatically. This keeps secret loading under application control and works consistently across runtimes.