Nebius Token Factory auth fails when you use the IAM token instead of the API key

TL;DR

Use the Token Factory API key for inference calls, never the IAM token - they are different credentials for different surfaces. Confirm the project has inference and billing entitlement enabled, since a rejected request is often an entitlement gap rather than a bug.

Steps

1. Use the Token Factory API key for inference calls, never the IAM token - they are different credentials for different surfaces. Before debugging code, list the models endpoint with your key to confirm both auth and which models your project can reach. Confirm the project has inference and billing entitlement enabled, since a rejected request is often an entitlement gap rather than a bug.

When to use

You are seeing this: Before debugging code, list the models endpoint with your key to confirm both auth and which models your project can reach. Use this skill when you run into "Nebius Token Factory auth fails when you use the IAM token instead of the API key".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Source: Nebius Token Factory troubleshooting docs document the key confusion that causes most auth failures. If authentication fails, check that you supplied the Token Factory key and not an IAM token; also check revocation and project access. When a model or inference request is rejected, check the models list, the returned error, and your project's inference and billing entitlement. Workflow runs that say the key is required need the key passed as a secret env on submit.

Verified resolution: Use the Token Factory API key for inference calls, never the IAM token - they are different credentials for different surfaces. Before debugging code, list the models endpoint with your key to confirm both auth and which models your project can reach. Confirm the project has inference and billing entitlement enabled, since a rejected request is often an entitlement gap rather than a bug.

Source URL: https://github.com/nebius/nebius-physical-ai/blob/HEAD/docs/workbench/token-factory.md