Skip to main content
NVM ID documentation is under development. This section provides an overview based on current implementation details.

​
What is NVM ID?

NVM ID is Nevermined’s identity and access management system that handles authentication, authorization, and user management across the platform. It provides the security layer that ensures only authorized users can access AI services.

​
Current Implementation

​
API Key Authentication

Builders authenticate using Nevermined API keys: 
const payments = Payments.getInstance({
  nvmApiKey: process.env.NVM_API_KEY,
  environment: 'production'
})

​
Bearer Token Access

Subscribers receive bearer tokens for API access: 
// Get access token after purchasing plan
const credentials = await payments.agents.getAgentAccessToken(
  planId,
  agentId
)

// Use token for authenticated requests
const response = await fetch(agentEndpoint, {
  headers: {
    'Authorization': `Bearer ${credentials.accessToken}`
  }
})

​
Key Components

API Keys

Master keys for builders and developers

Access Tokens

JWT tokens for API authentication

Plan Validation

Ensures users have active subscriptions

Request Signing

Cryptographic request validation

​
Authentication Flow

​
Current Features

​
For Builders

  • API key generation and management
  • Session management
  • Usage analytics access

​
For Subscribers

  • Wallet-based authentication
  • Access token generation
  • Multi-plan management

​
Planned Features

The following features are planned for future releases:

​
Enhanced Identity Management

  • User profiles with metadata
  • Multi-factor authentication
  • Social login integration
  • Enterprise SSO support

​
Advanced Access Control

  • Role-based permissions
  • Fine-grained access policies
  • API rate limiting per user
  • Geographic restrictions

​
Compliance Features

  • KYC/AML integration
  • Age verification
  • Data privacy controls
  • Audit logging

​
Integration Points

​
With NVM Pay

  • Links identity to payment plans
  • Validates subscription status
  • Tracks usage per user

​
With AI Agents

  • Authenticates API requests
  • Enforces access policies
  • Provides user context

​
Security Considerations

  • Store keys in environment variables
  • Rotate keys regularly
  • Never expose in client code
  • Use separate keys for dev/prod
  • Tokens expire automatically
  • Refresh tokens not yet implemented
  • Validate on every request
  • Handle expiration gracefully
  • Use HTTPS for all requests
  • Implement request timeouts
  • Log security events
  • Monitor for anomalies

​
Coming Soon

  • Detailed API documentation
  • User management dashboard
  • Advanced authentication methods
  • Compliance toolkit
  • Enterprise features