fix: keep local api serve unauthenticated

maintainer edit: Align OpenAI-compatible API auth with the WebSocket channel boundary: loopback serve remains usable without a key, while wildcard binds still fail before agent initialization unless api.api_key is configured.
2026-07-08 12:16:12 +08:00
parent 28141ce20b
commit 883776358e
7 changed files with 25 additions and 35 deletions
@@ -204,7 +204,7 @@ Default API endpoint:
 http://127.0.0.1:8900
 ```

-`nanobot serve` requires `api.apiKey`; send it as a Bearer token on API routes.
+Public binds (`0.0.0.0` or `::`) require `api.apiKey`; send it as a Bearer token on API routes.

 See [`openai-api.md`](./openai-api.md) for request examples.