Client credentials flow

Use this flow when your own backend calls the API using your own account. There is no user to prompt, so there is no consent screen and no redirect. It requires a Service application.

How it works

Your server sends its client_id and client_secret to the token endpoint and receives an access token. The token acts as the account that owns the application.

With this flow, GET /api/v1/user returns the profile of the account that owns the application. Grant the profile:read scope to the application to use it.

Request a token

curl -X POST 'https://platform.nemu.cc/api/oauth/token' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'grant_type=client_credentials' \
  -d 'client_id=cl_123' \
  -d 'client_secret=cls_456'

const body = new URLSearchParams({
  grant_type: "client_credentials",
  client_id: "cl_123",
  client_secret: "cls_456",
});

const res = await fetch("https://platform.nemu.cc/api/oauth/token", {
  method: "POST",
  headers: { "content-type": "application/x-www-form-urlencoded" },
  body,
});

const { access_token } = await res.json();

You can also send the credentials with HTTP Basic auth instead of the body.

curl -X POST 'https://platform.nemu.cc/api/oauth/token' \
  -u 'cl_123:cls_456' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'grant_type=client_credentials'

A successful response returns an access token that lasts one hour. There is no refresh token. Request a new token when the current one is close to expiry.

{
  "access_token": "eyJhbGciOi...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "workspaces:read models:read"
}

Call the API

Send the token as a bearer token against the versioned REST API.

curl 'https://platform.nemu.cc/api/v1/workspaces' \
  -H 'Authorization: Bearer eyJhbGciOi...'

Use the SDK

The Nemu client handles the token for you. It fetches a token on the first call and caches it until it is close to expiry.

import { Nemu } from "@nemu-ai/sdk";

const nemu = new Nemu({
  client_id: process.env.nemu_client_id!,
  client_secret: process.env.nemu_client_secret!,
});

const account = await nemu.user.get();
const workspaces = await nemu.workspaces.list();

See the SDK guide for the full surface.

The client_secret grants full access to everything the application can do. Keep it on your server and rotate it from the console if it leaks.

​How it works

​Request a token

​Call the API

​Use the SDK

How it works

Request a token

Call the API

Use the SDK