---
title: "Introduction"
description: "Understand what Nexus gives an AI application, who operates each plane, and the boundaries of the MVP."
---

> Documentation Index
> Fetch the complete documentation index at: https://nexus.microvoid.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Introduction

## Outcome

读完本页后，你可以判断 Nexus 是否适合你的应用，并能解释 Provider Secret、应用后端和最终用户之间的安全边界。

Nexus 面向已经拥有 OpenAI-compatible Provider 能力的 SaaS、Agent 和应用开发者。开发者把 Provider Secret 安全接入一个 Workspace，再为每名应用用户创建独立的 Access、Inference Key 和 Quota。最终用户继续使用原有 SDK，只替换 Base URL 和 Key。

## What Nexus gives your application

| Need                           | Nexus MVP behavior                                                                |
| ------------------------------ | --------------------------------------------------------------------------------- |
| Protect upstream credentials   | Provider Secret 加密保存在 Workspace 的 ProviderConnection 中，不交付给最终用户。 |
| Identify each application user | `User + WorkspaceAccess` 是数据面身份和授权关系。                                 |
| Control usage                  | WorkspacePlan 绑定 QuotaStrategy；QuotaPeriod 记录当前周期额度。                  |
| Keep existing clients          | OpenAI-compatible SDK 和 OpenCode 使用 Gateway Base URL 与 Inference Key。        |
| Explain each request           | Invocation、Reservation、UsageEvent 和 Audit 通过 Request ID 关联。               |

### Credential and request boundary

1. **Developer Provider Secret** → encrypted `ProviderConnection`; it never reaches the application user.
2. **Application Backend** → Management Key → Nexus Admin API → `User + WorkspaceAccess`.
3. **Nexus Admin API** → one-time Inference Key → User SDK or Agent.
4. **User SDK or Agent** → Inference Key + explicit `providerConnectionId` → Nexus Gateway.
5. **Nexus Gateway** → PostgreSQL Access/Quota decision → selected ProviderConnection → Model Provider.

The Admin Plane owns configuration and lifecycle. The Data Plane accepts an Inference Key and an explicit connection UUID. PostgreSQL Access and Quota facts decide whether the Provider is called.

## The two planes

- **Admin Plane**：Console、Admin API 和 Management SDK 管理 Workspace、ProviderConnection、Plan、User、Access、Key、Usage 与 Audit。应用后端使用 Management Key。
- **Data Plane**：Gateway 接受 Inference Key 和包含 `providerConnectionId` UUID 的请求。它在调用 Provider 前校验 Access 并预留 Quota。

Organization Member 是控制面关系；WorkspaceAccess 是数据面关系。任何一方都不能自动推出另一方。

## What the MVP deliberately leaves outside

Nexus MVP 不替客户端选择上游连接，不改写 Provider 定义的模型名，也不在连接失败时自动切换另一条连接。它不维护模型目录、模型级收费规则或货币账户。一个请求明确选择一个 Workspace 内的 ProviderConnection，Payload 对 Nexus 保持不透明。

## Choose the next page

- 想理解完整调用链路：[How Nexus works](/docs/how-nexus-works)。
- 想建立术语关系：[Core concepts](/docs/core-concepts)。
- 准备开始接入：[Choose a quickstart](/docs)。

Source: https://nexus.microvoid.io/docs/introduction/index.mdx