Set up access

Complete these steps before running the Python, CLI, or REST examples.

Create an API key and find the project ID

Open the Token Factory API keys page, create a key in the project that will run Sandboxes, and save the value when it is shown. The value cannot be opened again later.
Open Project settings in Token Factory and copy the project ID shown under the project name. Organizations and projects explains project scope; Groups and access management explains how project membership grants access to resources.

Keep the API key outside source files and sandbox inputs.

Verify access with the CLI

This diagnostic step is optional for Python and REST users. It gives a quick way to distinguish an accepted credential from a missing Sandboxes permission. Install uv if needed, then install CLI 0.9.4 and register a profile:

uv tool install "contree-cli==0.9.4"
export NEBIUS_API_KEY="YOUR_API_KEY"
export NEBIUS_AI_PROJECT="YOUR_PROJECT_ID"
contree auth -y
contree auth ls

The profile status distinguishes several setup failures:

Status	Meaning	Next action
`ok`	The profile probe succeeded and the required Sandboxes permission is present.	Continue to image discovery.
`inactive`	The token was accepted, but the required Sandboxes permission is missing. The project may need Sandboxes activation or the caller may need access.	Ask the project administrator to verify both project activation and the caller’s authorization. Contact contree@nebius.com when activation is required.
`timeout`	The two-second profile probe did not finish.	Check network access and the configured service URL, then retry.
`error`	The probe failed, including invalid credentials or another API error.	Recheck the key and project, then register the profile again.

For activation help, send the project ID and profile status to contree@nebius.com. An inactive profile can mean either missing project activation or missing caller permission; do not send the API key.

Use the correct project variable

Surface	API key	Project ID	When read
CLI profile registration	`NEBIUS_API_KEY`	`NEBIUS_AI_PROJECT`	`contree auth` reads the values and saves a profile.
Python SDK 0.3.6	`NEBIUS_API_KEY`	`NEBIUS_PROJECT_ID`	The SDK reads the variables when it creates the client.
REST examples	`NEBIUS_API_KEY`	`NEBIUS_PROJECT_ID`	The shell expands them into the `Authorization` and `Project` headers.

For SDK or REST work, export the runtime project variable explicitly:

export NEBIUS_API_KEY="YOUR_API_KEY"
export NEBIUS_PROJECT_ID="YOUR_PROJECT_ID"

Find an image UUID

List images available to the selected project:

contree images
contree images --prefix=alpine

The first column is the immutable image UUID. A tag:NAME reference is easier to discover, but a tag can later point to another image. Use the UUID in recorded experiments and REST examples. The Python quickstart uses alpine:3.19, and the CLI quickstart uses ubuntu:latest. If either tag is absent, select an available image from contree images and record its UUID. Replace "alpine:3.19" in the Python example with that UUID, or pass the UUID to contree use in the CLI example. Choose an image with /bin/sh and the commands used by the example.

Get Started

Inference

Observability

Post-training

Data Lab

Sandboxes

Teams & Access Management

Other Capabilities

Integrations

Platform Notices

Create an API key and find the project ID

Verify access with the CLI

Use the correct project variable

Find an image UUID

Continue

​Create an API key and find the project ID

​Verify access with the CLI

​Use the correct project variable

​Find an image UUID

​Continue

Create an API key and find the project ID

Verify access with the CLI

Use the correct project variable

Find an image UUID

Continue