API keys let headless tools connect to Nessie without the Mac app's signed-in session. Use them for Linux daemons, remote agent machines, MCP clients that need a static bearer credential, and plugin integrations such as OpenClaw.
Create and manage API keys from Settings → Security (API keys on older app versions). Each key has a name, a creation date, and last-used status. The raw key is shown once when you create it. You can revoke a key at any time; once revoked, any daemon, MCP client, or tool using that key stops working immediately.
When to use an API key:
- A Linux daemon needs to ingest agent sessions from a server, VM, or container
- A remote agent environment cannot use the macOS app UI or interactive OAuth
- An MCP client needs to call the hosted Nessie MCP server with a bearer token
- An OpenClaw plugin or similar tool needs local setup with a long-lived Nessie credential
Hosted MCP server
The hosted MCP server supports normal MCP OAuth, and also accepts Nessie API keys for clients that cannot complete that OAuth flow.
URL: https://mcp.nessielabs.com
Header: Authorization: Bearer sk_nes_v1_...Use OAuth when the MCP client supports it. Use an API key when the client only supports static headers or plugin-managed credentials.
Nessie daemon
For Linux servers, remote agent machines, and short-lived cloud agent workspaces, use the @nessielabs/daemon npm package. See Nessie daemon for setup commands and worker examples.