Evidence Bridge Authentication

Connecting from the NexArt dashboard

User authenticates at nexart.io
        |
Dashboard > Integrations > Connect
        |
NexArt creates a short-lived Bridge handoff
        |
browser opens bridge.nexart.io
        |
Bridge verifies and consumes handoff
        |
Bridge creates its own secure local session

The handoff token is:

• ES256
• short lived, approximately 90 seconds
• issuer https://nexart.io
• audience bridge.nexart.io
• tenant-bound
• single-use via jti replay protection

The token is delivered in the browser URL fragment:

#handoff=<token>

Fragments are not sent to the destination server as part of the HTTP request. The Bridge client consumes the token and removes the fragment from browser history. The resulting Bridge session uses a secure local cookie with HttpOnly, Secure, SameSite=Lax and the __Host- cookie prefix.

Normal usage never requires manually copying a handoff token. The Connect flow performs the exchange for you.

Session endpoints

POST https://bridge.nexart.io/api/v1/auth/handoff
GET  https://bridge.nexart.io/api/v1/auth/session
POST https://bridge.nexart.io/api/v1/auth/logout

Server-to-server ingestion

Evidence Bridge does not introduce a second customer API-key system. Machine clients use their existing NexArt API key:

nx_live_...

The Bridge validates the credential against the NexArt control plane and resolves:

• tenant
• API-key identity
• scopes
• account status
• plan and limits
• Bridge entitlement

The customer API key remains request-scoped. It is not stored by Evidence Bridge, it is not returned to the browser, and it must not be logged. For Node attestation, the acting customer's NexArt credential is forwarded request-only so successful certification remains attributed to the correct NexArt account.

HTTP/1.1 401
{"error":"Authentication required"}

API key security

Never:

• embed nx_live keys in browser JavaScript
• commit them to source control
• include them in screenshots
• put them in public examples
• log them
• send them to third parties

Server-side examples should read NEXART_API_KEY from the application's secret or environment configuration.