# Evidence Bridge Authentication

URL: https://docs.nexart.io/docs/evidence-bridge/authentication

Two authentication paths: a short-lived single-use ES256 handoff from the NexArt dashboard for humans, and the existing NexArt API key as a request-scoped bearer credential for machines.

## Connecting from the NexArt dashboard

```
User authenticates at nexart.io
        |
Dashboard > Integrations > Connect
        |
NexArt creates a short-lived Bridge handoff
        |
browser opens bridge.nexart.io
        |
Bridge verifies and consumes handoff
        |
Bridge creates its own secure local session
```

The handoff token is:

- ES256
- short lived, approximately 90 seconds
- issuer `https://nexart.io`
- audience `bridge.nexart.io`
- tenant-bound
- single-use via `jti` replay protection

The token is delivered in the browser URL fragment:

```
#handoff=<token>
```

Fragments are not sent to the destination server as part of the HTTP request. The Bridge client consumes the token and removes the fragment from browser history. The resulting Bridge session uses a secure local cookie with `HttpOnly`, `Secure`, `SameSite=Lax` and the `__Host-` cookie prefix.

Normal usage never requires manually copying a handoff token. The Connect flow performs the exchange for you.

## Session endpoints

Verified against the deployed Bridge

```
POST https://bridge.nexart.io/api/v1/auth/handoff
GET  https://bridge.nexart.io/api/v1/auth/session
POST https://bridge.nexart.io/api/v1/auth/logout
```

## Server-to-server ingestion

Evidence Bridge does not introduce a second customer API-key system. Machine clients use their existing NexArt API key:

```
nx_live_...
```

The Bridge validates the credential against the NexArt control plane and resolves:

- tenant
- API-key identity
- scopes
- account status
- plan and limits
- Bridge entitlement

The customer API key remains request-scoped. It is not stored by Evidence Bridge, it is not returned to the browser, and it must not be logged. For Node attestation, the acting customer&#x27;s NexArt credential is forwarded request-only so successful certification remains attributed to the correct NexArt account.

Unauthenticated request

```
HTTP/1.1 401
{"error":"Authentication required"}
```

## API key security

Never:

- embed `nx_live` keys in browser JavaScript
- commit them to source control
- include them in screenshots
- put them in public examples
- log them
- send them to third parties

Server-side examples should read `NEXART_API_KEY` from the application&#x27;s secret or environment configuration.