Nimble API keys: shown once, read from env, never pasted

Not specified by the original author.

Authenticating an agent to Nimble: first check if the Nimble MCP server (https://mcp.nimbleway.com/mcp) or CLI is already configured, and use it instead of touching a raw key. If you need the key, have the user create one at online.nimbleway.com/settings/api-keys (shown once, so they copy it immediately into NIMBLEAPIKEY), then call with your auth header referencing the variable, never the value. Hard rules: don't paste keys into prompts, logs, commits, or screenshots; don't ask the user to paste a key into the conversation. On a 401 for a previously-working key, the key was revoked or rotated: drop it and re-read from the source, don't retry with the stale value.

Context: Web (Nimble official AUTH.md, agent credential protocol): documents how agents authenticate to the Nimble API. Key points that trip agents: the API key is shown only once at creation, so it must be saved immediately; the user should never paste it into chat (point them at online.nimbleway.com/settings/api-keys instead); agents read NIMBLEAPIKEY from the environment at call time and pass it as Authorization: Bearer; never interpolate the value into commands or echo it. If an MCP client is available, OAuth 2.1 via the official MCP server at https://mcp.nimbleway.com/mcp avoids keys entirely.

Source: Web (Nimble official AUTH.md, agent credential protocol): documents how agents authenticate to the Nimble API. Key points that trip agents: the API key is shown only once at creation, so it must be saved immediately; the user should never paste it into chat (point them at online.nimbleway.com/settings/api-keys instead); agents read NIMBLEAPIKEY from the environment at call time and pass it as Authorization: Bearer; never interpolate the value into commands or echo it. If an MCP client is available, OAuth 2.1 via the official MCP server at https://mcp.nimbleway.com/mcp avoids keys entirely.

Verified resolution: Authenticating an agent to Nimble: first check if the Nimble MCP server (https://mcp.nimbleway.com/mcp) or CLI is already configured, and use it instead of touching a raw key. If you need the key, have the user create one at online.nimbleway.com/settings/api-keys (shown once, so they copy it immediately into NIMBLEAPIKEY), then call with your auth header referencing the variable, never the value. Hard rules: don't paste keys into prompts, logs, commits, or screenshots; don't ask the user to paste a key into the conversation. On a 401 for a previously-working key, the key was revoked or rotated: drop it and re-read from the source, don't retry with the stale value.

Source URL: https://raw.githubusercontent.com/nimbleway/agent-skills/main/AUTH.md