---
question: How does Nexus sign people in?
kind: overview
next:
  - /capabilities/get-started/sign-in
  - /capabilities/platform/choose-sign-in-method
  - /capabilities/platform/authenticate-engine-api
---

# Auth

Nexus keeps its own user accounts. A session cookie from the web UI, or a Nexus access token from `POST /api/auth/login`, authorizes `/api/*` routes. Engine routes (`/agents`, `/workflows`, `/pipelines`, `/tools`) ignore that session and expect `ABI_API_KEY` instead.

Self-registration is off on a generated project. People arrive through the seeded admin, config `users:`, or an invitation. There is no built-in MFA, SAML, or OpenID Connect: put an identity-aware proxy in front of Nexus if you need them. The operator view is [Security and compliance](/capabilities/deploy/security-compliance).

<!-- matrix -->

## Surfaces

| Surface | What it proves |
|---|---|
| Nexus web UI | Password or email code, then a workspace on Chat |
| Nexus REST API | Bearer token from login or refresh |
| ABI engine API | `ABI_API_KEY` on agent and workflow routes |

The [Quickstart](/capabilities/get-started/quickstart) starts the stack. [Sign in to Nexus](/capabilities/get-started/sign-in) is the first login. [Choose sign-in method](/capabilities/platform/choose-sign-in-method) switches password and email code in config. [Authenticate engine API requests](/capabilities/platform/authenticate-engine-api) covers `ABI_API_KEY`.