NNyquest docs

Personal API Keys (PATs)

Practical guide to creating, managing, and using personal API keys (PATs) — the long-lived auth tokens for scripts and integrations.

What a PAT is

A 49-character token starting with nq-v1- that authenticates API calls as you. Created via the API or the Settings UI; deleted by you when no longer needed; never expires on its own.

nq-v1-Xk9mQ2pR7wT4vL8nB3sH6yJ1cF5dG0aZ7eW1uN4

The key has two halves:

  • Prefix (nq-v1-Xk9m, first 10 chars) — visible in the UI for identification
  • Secret (the rest) — never shown again after creation

The platform stores only a hash. There's no way to recover a lost key — you have to create a new one.

Creating a PAT — UI

  1. Sign in to app.nyquest.ai
  2. Open Settings → API Keys
  3. Click + Add Key
  4. Enter a descriptive name (e.g. "github-actions-prod", "my-laptop-script")
  5. Click Save
  6. Copy the key immediately — the modal shows it once with a one-click copy button
  7. Click Dismiss when you've stored it safely

If you forget to copy: the key is gone. Delete it and create a new one with the same name.

Creating a PAT — API

You need an existing JWT (from sign-in) or another PAT to bootstrap:

bash
TOKEN="eyJhbGc..."  # your JWT or existing PAT

curl -X POST https://api.nyquest.ai/user/api-keys \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"my-script"}'

Response:

json
{
  "id": "f9547c8a-...",
  "key": "nq-v1-Xk9m...",
  "key_prefix": "nq-v1-Xk9m",
  "name": "my-script",
  "created_at": "2026-04-30T16:42:11Z"
}

The key field is only present in the create response. Save it before doing anything else.

Listing your PATs

UI: Settings → API Keys shows the table.

API:

bash
curl https://api.nyquest.ai/user/api-keys \
  -H "Authorization: Bearer $TOKEN"

Returns:

json
[
  {"id":"f9547c8a-...","key_prefix":"nq-v1-Xk9m","name":"my-script","created_at":"..."},
  {"id":"abc-456-...",   "key_prefix":"nq-v1-Pq3t","name":"ci-prod",    "created_at":"..."}
]

No way to see the full key for an existing PAT. By design.

Deleting a PAT

UI: Settings → API Keys → trash icon next to the key → confirm.

API:

bash
curl -X DELETE https://api.nyquest.ai/user/api-keys/<id> \
  -H "Authorization: Bearer $TOKEN"

Returns 204 No Content on success. The key stops working on the next request — no grace period.

What a PAT can do

A PAT inherits all the privileges of the user who created it. It can:

  • Send chat completions (/v1/chat/completions)
  • Run agents (/v1/agents/run)
  • Generate images, audio, list models
  • Read/write conversations, projects, artifacts
  • View billing info (but not fund the wallet — that requires Stripe Checkout in browser)
  • Manage BYOK providers
  • Manage other PATs

There is no scoping — a PAT is fully privileged. Per-key scoping (e.g. "read-only", "/v1/chat/completions only") is on the roadmap but not built. Until then, treat each PAT as a full account credential.

Heads up — PAT requests are stateless. Chats run via PAT do not appear in your web-UI conversation history, and the request does not see prior-conversation memory. This is intentional and matches OpenAI/Anthropic API behavior. See API Overview → API key requests are stateless.

Limits

Currently:

  • Number of PATs per account: no hard limit (practical: keep <50 for findability)
  • Rate limit: same as your account tier — 20/min free, 120/min Pro
  • Throttling: rate limit is per-account, not per-key. Multiple PATs from the same account share the same bucket.

Naming conventions that work

A few patterns from heavy users:

PatternExampleGood for
<env>-<purpose>prod-customer-bot, staging-batchDistinguishing environments
<integration>-<host>github-actions-server1, aws-lambda-prodTracing where it's used
<date>-<purpose>2026-04-script-test, 2026-q3-ciEasy expiry tracking
<user>-<machine>mike-laptop, mike-desktopMulti-device personal use

Pick one and stick with it. Searching across 30 PATs named "test" later is painful.

Rotation pattern

Even though PATs don't expire automatically, periodic rotation is good hygiene:

  1. Create a new PAT with the same name + a date suffix (my-script-2026q3)
  2. Update the integration to use the new key
  3. Verify the integration works with the new key
  4. Delete the old PAT

Rotation cadence:

  • Production / customer-facing integrations: every 90 days
  • Personal scripts: every 6-12 months
  • Critical or high-privilege keys: every 30 days

Detecting compromise

Signs a PAT may have been leaked:

  • Wallet balance is decreasing faster than your usage
  • Conversations or artifacts you didn't create appear in your account
  • More → Usage shows recent spend; per-IP request detail is not exposed in the UI (not exposed in UI yet, but available via /help/live-support)
  • An automated tool emails you about a leaked PAT (GitHub does this for some patterns)

If you suspect compromise: delete the PAT immediately, then talk to a real human for account audit.

Where to next