# Nimble API keys: shown once, read from env, never pasted

## TL;DR

Authenticating an agent to Nimble: first check if the Nimble MCP server (https://mcp.nimbleway.com/mcp) or CLI is already configured, and use it instead of touching a raw key. If you need the key, have the user create one at online.nimbleway.com/settings/api-keys (shown once, so they copy it immediately into NIMBLE_API_KEY), then call with your auth header referencing the variable, never the value. Hard rules: don't paste keys into prompts, logs, commits, or screenshots; don't ask the user to paste a key into the conversation.

Use this when you run into the situation in the title.

**When not to use this skill:** unrelated tasks. It covers only the procedure above.

## Compatibility

The steps above apply to the commands named in them. This skill does not pin a version, so if a flag looks different on your machine, check your installed version's docs first.

## Details

On a 401 for a previously-working key, the key was revoked or rotated: drop it and re-read from the source, don't retry with the stale value.

Context: Web (Nimble official AUTH.md, agent credential protocol): documents how agents authenticate to the Nimble API. Key points that trip agents: the API key is shown only once at creation, so it must be saved immediately; the user should never paste it into chat (point them at online.nimbleway.com/settings/api-keys instead); agents read NIMBLE_API_KEY from the environment at call time and pass it as Authorization: Bearer; never interpolate the value into commands or echo it. If an MCP client is available, OAuth 2.1 via the official MCP server at https://mcp.nimbleway.com/mcp avoids keys entirely.