fix: keep local api serve unauthenticated

maintainer edit: Align OpenAI-compatible API auth with the WebSocket channel boundary: loopback serve remains usable without a key, while wildcard binds still fail before agent initialization unless api.api_key is configured.

nanobot/api/server.py

@@ -404,7 +404,7 @@ def create_app(
         agent_loop: An initialized AgentLoop instance.
         model_name: Model name reported in responses.
         request_timeout: Per-request timeout in seconds.
-        api_key: API key for Bearer-token authentication on API routes.
+        api_key: Optional API key for Bearer-token authentication on API routes.
     """
     app = web.Application(client_max_size=20 * 1024 * 1024)  # 20MB for base64 images
     app["agent_loop"] = agent_loop
@@ -418,7 +418,7 @@ def create_app(
         if request.path == "/health":
             return await handler(request)
         if not api_key:
-            return _error_json(401, "API key is not configured")
+            return await handler(request)
         auth = request.headers.get("Authorization", "")
         if not auth.startswith("Bearer "):
             return _error_json(401, "Missing Authorization header. Use: Bearer <api_key>")

nanobot/cli/commands.py

@@ -1130,10 +1130,10 @@ def serve(
     port = port if port is not None else api_cfg.port
     timeout = timeout if timeout is not None else api_cfg.timeout
     api_key = api_cfg.api_key.strip() if api_cfg.api_key else ""
-    if not api_key:
+    if host in {"0.0.0.0", "::"} and not api_key:
         console.print(
-            "[red]Error: api_key is not set. "
-            "Set api.api_key in config to prevent unauthenticated API access.[/red]"
+            "[red]Error: host is 0.0.0.0 (all interfaces) but api_key is not set. "
+            "Set api.api_key in config to prevent unauthenticated access.[/red]"
         )
         raise typer.Exit(1)
     sync_workspace_templates(runtime_config.workspace_path)