Authentication

API Key

When api_key is set in the config, all protected endpoints require a Bearer token:

[api]
api_key = "your-secret-key"

Using the API Key

curl -H "Authorization: Bearer your-secret-key" \
     http://127.0.0.1:9090/sessions

Without API Key (Public Endpoints)

These endpoints never require auth:

curl http://127.0.0.1:9090/health
curl http://127.0.0.1:9090/openapi.json

The WebSocket endpoint (/ws) is also public.

Error Response

Missing or incorrect API key returns 401 Unauthorized:

{
  "error": "Missing or invalid API key",
  "code": "UNAUTHORIZED"
}

Disabling Auth

Leave api_key unset to disable authentication entirely. Suitable for:

• Local development
• Behind a firewall
• Behind an auth proxy (OAuth proxy, VPN, etc.)