> This page is for NVIDIA NIM for Batched Geometry Relaxation, version 1.0.0.
> For other versions, use one of these documentation indexes:
> - 1.1.0 (Latest) (default): https://docs.nvidia.com/nim/alchemi/alchemi-bgr/1.1.0/llms.txt
> - 1.0.0: https://docs.nvidia.com/nim/alchemi/alchemi-bgr/1.0.0/llms.txt

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.nvidia.com/nim/alchemi/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/nim/alchemi/_mcp/server.

# Security and Authentication

As a developer, you are responsible for securing access to any application using the NeMo ecosystem, including an authentication layer between users and your application and securing communication between services in your application.

## Rate Limiting

NIMs do not impose rate limits. If you want to restrict access to your application, it is your responsibility to implement a strategy. One strategy is to use the `NIM_TRITION_MAX_QUEUE_SIZE` option to set Triton's dynamic batching maximum queue size.

## Ports

The NIM uses multiple ports, but only the HTTP API Port needs to be accessible outside of the cluster. The service port is set at start up based on the `NIM_HTTP_API_PORT` environment variable (default: 8000).

## Additional Security Reminders

As a Developer, you must secure your own API endpoints. We suggest using a proxy as well as HTTPS/TLS 1.2.

## Incident Response

* [Incident Response Plan](https://www.nvidia.com/en-us/data-center/products/ai-enterprise-suite/support/)
* [Product Security](https://www.nvidia.com/en-us/security/psirt-policies/)

## Secrets

If you deploy a NIM for BGR component using Helm charts, you will need at least two secrets to set up in that namespace:

* An image pull secret for NGC
* An NGC API key secret

If your cluster requires additional image pull secrets for custom init containers, you'll need those also.

Create the secrets according to your organization's requirements and [Kubernetes secrets best practices](https://kubernetes.io/docs/concepts/security/secrets-good-practices/), but for POCs and to set up secrets quickly you can use the following, where NAMESPACE is the name of your namespace:

```bash
kubectl \
    --create secret -n NAMESPACE docker-registry ngc-secret  \
    --docker-server=nvcr.io --docker-username='$oauthtoken' \
    --docker-password=$NGC_API_KEY

kubectl \
    --create secret -n NAMESPACE generic ngc-api-secret  \
    --from-literal=NGC_API_KEY=$NGC_API_KEY
```

NeMo Retriever uses connection strings that may contain credentials. 
We recommend that you store these connection string in a secret management solution. 
For more information, refer to [Manage Secrets](https://docs.nvidia.com/nemo/microservices/latest/set-up/manage-secrets/index.html).

## Logging

To view the service logs for your running container, first identify the
container ID and then stream the logs.

1. Find the container ID:

   ```bash
   docker ps
   ```

2. View the logs:

   ```bash
   docker logs <container-id> -f
   ```

For information about securing your Docker container and log files, refer to
[Docker security](https://docs.docker.com/engine/security/).