Grayscale/nanobot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: keep local api serve unauthenticated

Browse Source 
maintainer edit: Align OpenAI-compatible API auth with the WebSocket channel boundary: loopback serve remains usable without a key, while wildcard binds still fail before agent initialization unless api.api_key is configured.
This commit is contained in:
chengyongru
2026-07-08 12:16:12 +08:00
committed by Xubin Ren
parent 28141ce20b
commit 883776358e
7 changed files with 25 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/openai-api.md
+10 -18
View File
@@ -5,32 +5,33 @@ nanobot can expose a minimal OpenAI-compatible endpoint for local integrations:
```bash
nanobot plugins enable api
nanobot agent -m "Hello!"
# Set api.apiKey first; see Authentication below.
nanobot serve
```
Run the CLI check first. If `nanobot agent -m "Hello!"` fails, fix provider or config setup before debugging the API server. By default, the API binds to `127.0.0.1:8900`. You can change this in `config.json`. `nanobot serve` requires `api.apiKey`; set it before starting the server.
Run the CLI check first. If `nanobot agent -m "Hello!"` fails, fix provider or config setup before debugging the API server. By default, the API binds to `127.0.0.1:8900`. You can change this in `config.json`.
For setup help, see [`quick-start.md`](./quick-start.md), [`providers.md`](./providers.md), and [`troubleshooting.md`](./troubleshooting.md).
## Authentication
`nanobot serve` requires `api.apiKey` for all API binds. Without it, startup
fails before the agent is initialized. Keep the key secret and send it as a
Bearer token on API routes.
Local-only `127.0.0.1` usage does not require an API key. If you bind the API
server to all interfaces with `api.host: "0.0.0.0"` or `"::"`, nanobot requires
`api.apiKey`; otherwise startup fails to avoid exposing an unauthenticated agent
endpoint on the network.
```json
{
"api": {
"host": "127.0.0.1",
"host": "0.0.0.0",
"port": 8900,
"apiKey": "${NANOBOT_API_KEY}"
}
}
```
The health endpoint remains unauthenticated so local probes and load balancers
can still check process health.
When `api.apiKey` is set, send it as a Bearer token on API routes. The health
endpoint remains unauthenticated so local probes and load balancers can still
check process health.
```bash
curl http://127.0.0.1:8900/v1/models \
@@ -69,7 +70,6 @@ If `channel` points to a channel that is not enabled in your config, nanobot wil
```bash
curl http://127.0.0.1:8900/v1/chat/completions \
-H "Content-Type: application/json" \
-H "Authorization: Bearer $NANOBOT_API_KEY" \
-d '{
"messages": [{"role": "user", "content": "hi"}],
"session_id": "my-session"
@@ -83,7 +83,6 @@ Send images inline using the OpenAI multimodal content format:
```bash
curl http://127.0.0.1:8900/v1/chat/completions \
-H "Content-Type: application/json" \
-H "Authorization: Bearer $NANOBOT_API_KEY" \
-d '{
"messages": [{"role": "user", "content": [
{"type": "text", "text": "Describe this image"},
@@ -99,13 +98,11 @@ Upload any supported file type (images, PDF, Word, Excel, PPT) via multipart:
```bash
# Single file
curl http://127.0.0.1:8900/v1/chat/completions \
-H "Authorization: Bearer $NANOBOT_API_KEY" \
-F "message=Summarize this report" \
-F "files=@report.docx"
# Multiple files with session isolation
curl http://127.0.0.1:8900/v1/chat/completions \
-H "Authorization: Bearer $NANOBOT_API_KEY" \
-F "message=Compare these files" \
-F "files=@chart.png" \
-F "files=@data.xlsx" \
@@ -120,13 +117,10 @@ Supported file types:
## Python (`requests`)
```python
import os
import requests
resp = requests.post(
"http://127.0.0.1:8900/v1/chat/completions",
headers={"Authorization": f"Bearer {os.environ['NANOBOT_API_KEY']}"},
json={
"messages": [{"role": "user", "content": "hi"}],
"session_id": "my-session", # optional: isolate conversation
@@ -140,13 +134,11 @@ print(resp.json()["choices"][0]["message"]["content"])
## Python (`openai`)
```python
import os
from openai import OpenAI
client = OpenAI(
base_url="http://127.0.0.1:8900/v1",
api_key=os.environ["NANOBOT_API_KEY"],
api_key="dummy",
)
resp = client.chat.completions.create(