Getting started

Authentication

Neutron AI API requests use bearer tokens. Tokens identify the calling workspace or integration and should be handled as secrets.

Token types

Neutron uses two public token boundaries:

Token	Use
Workspace API key	Setup and control-plane calls, such as creating Nuclei and listing Nuclei linked to the workspace.
Nucleus access token	Day-to-day memory, CLI, SDK, MCP, and Codex calls for one Nucleus.

Prefer Nucleus access tokens for agent hosts. Use workspace keys only for trusted setup flows.

Bearer token

Authorization: Bearer <NEUTRON_API_TOKEN>

Keep tokens in server-side environment variables or a managed secret store. Never expose a Neutron AI token in browser code, mobile apps, public repositories, logs, or analytics events.

Environment variables

NEUTRON_API_URL="https://neutronai.dev/api"
NEUTRON_API_TOKEN="your_nucleus_access_token"
NEUTRON_NUCLEUS_ID="your_nucleus_id"

Your platform is responsible for mapping users, workspaces, projects, and agents to stable Neutron AI nucleusId and scopeId values. tenantId remains a legacy alias for memory APIs. If both tenantId and nucleusId are supplied, they must match.

Recommended scope examples:

$NEUTRON_SCOPE_ID
workspace:workspace_456
project:project_789
team:team_abc
agent:support_assistant
session:session_def

Token rotation

Rotate tokens if they are exposed or no longer needed. During rotation, deploy the new token server-side first, validate traffic, then revoke the old token.

Client-side applications

Browser and mobile applications should call your backend. Your backend should authenticate the user, authorize the memory scope, and then call Neutron AI with a server-side token.

Sandbox testing