> This page is for NVIDIA NIM for Batched Geometry Relaxation, version 1.1.0 (Latest) (default).
> For other versions, use one of these documentation indexes:
> - 1.1.0 (Latest) (default): https://docs.nvidia.com/nim/alchemi/alchemi-bgr/1.1.0/llms.txt
> - 1.0.0: https://docs.nvidia.com/nim/alchemi/alchemi-bgr/1.0.0/llms.txt

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.nvidia.com/nim/alchemi/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/nim/alchemi/_mcp/server.

# Security and Authentication

As a developer, you are responsible for securing access to any application using the NeMo ecosystem, including an authentication layer between users and your application and securing communication between services in your application.

## Rate Limiting

NIMs do not impose rate limits. If you want to restrict access to your application, implement rate limiting in a gateway or proxy. To limit the number of requests waiting for batch processing, set the batcher queue depth with `NIM_SERVER_MAX_QUEUE_SIZE`.

## Ports

Set the HTTP listen address with `NIM_SERVER_BIND_ADDR` in `host:port` format. The default is `0.0.0.0:8000`. Expose this address only to clients that require access to the HTTP API.

To enable the optional KServe V2 gRPC API, set `NIM_SERVER_GRPC_BIND_ADDR` in `host:port` format. The gRPC API is disabled when this variable is unset. Expose the gRPC address only to clients that require access to that API.

## Additional Security Reminders

<Warning>
As a Developer, you must secure your own API endpoints. We suggest using a proxy as well as HTTPS/TLS 1.2.
</Warning>

## Incident Response

* [Product Security](https://www.nvidia.com/en-us/security/psirt-policies/)
* [NVIDIA AI Enterprise Support Services](https://www.nvidia.com/en-us/data-center/products/ai-enterprise-suite/support/)

## Secrets

If you deploy a NIM for BGR component using Helm charts, you will need at least two secrets to set up in that namespace:

* An image pull secret for NGC
* An NGC API key secret

If your cluster requires additional image pull secrets for custom init containers, you'll need those also.

Create the secrets according to your organization's requirements and [Kubernetes secrets best practices](https://kubernetes.io/docs/concepts/security/secrets-good-practices/), but for POCs and to set up secrets quickly you can use the following, where NAMESPACE is the name of your namespace:

```bash
kubectl \
    create secret -n NAMESPACE docker-registry ngc-secret  \
    --docker-server=nvcr.io --docker-username='$oauthtoken' \
    --docker-password=$NGC_API_KEY

kubectl \
    create secret -n NAMESPACE generic ngc-api  \
    --from-literal=NGC_API_KEY=$NGC_API_KEY
```

We recommend that you store credentials in a secret management solution. 

## Logging

To view the service logs for your running container, first identify the
container ID and then stream the logs.

1. Find the container ID:

   ```bash
   docker ps
   ```

2. View the logs:

   ```bash
   docker logs <container-id> -f
   ```

For information about securing your Docker container and log files, refer to
[Docker security](https://docs.docker.com/engine/security/).