Authentication

Nansen account API calls accept a selected nansen:api browser session or conventional API key with the same permissions. NANSEN_API_KEY takes precedence; optional primaryEnv preserves configured-key injection. Run nansen auth status for offline selection. Cached access expiry alone permits automatic renewal during an authorized task. Stop on anonymous selection, invalid state, blocked/uncertain renewal or actual auth failure; never drop a credential or fall back to anonymous x402 payment. Browser login does not grant wallet signing, privileged service identity or a persistent MCP integration key. Preserve all confirmation, signing, sanctions and geographic checks below. Browser login is available in CLI 2.0.0 within the macOS arm64 preview scope.

Wallet

Auth Setup

Use a selected nansen:api browser session or conventional API key for Nansen account API calls. Agents should inject NANSEN_API_KEY through their environment or secret manager and use commands directly; no login is needed to persist it. Human terminal users can use explicit nansen login --human for legacy key setup. With an already injected environment key, that explicit mode saves it without prompting and requires the native auth lock binding.

# Free live check of the effective API credential
nansen account

Plain nansen login instead requests fresh browser approval. It does not save an environment key or grant wallet signing/RPC authority. Wallet custody and provider credentials below remain separate.

Wallet Providers