Authentication

The REST API authenticates with an API key tied to your agent.

API keys

Each agent has an API key, shown on its published page. Send it as a Bearer token in the Authorization header:

POST /api/conversation/message
Authorization: Bearer YOUR_API_KEY
Content-Type: application/json

Treat the key like a password:

• Keep it server-side; don't embed it in public client code.
• Rotate it if it may have leaked.
• Scope each integration to the specific agent it needs.

Anonymous access

Some agents are configured to allow anonymous access — useful for a public website assistant where requiring a key per visitor doesn't make sense. When anonymous access is enabled, the core conversation endpoints can be called without a Bearer token; when it's disabled, requests must be authenticated.

You control this per agent. Decide based on where the agent is exposed:

Tip: Even with anonymous chat enabled, every conversation is still logged and counts toward usage and cost — and toward any budgets an admin has set.

Next steps

• Postman Collection — a ready-made collection with auth pre-wired.
• REST Endpoints — the full request/response reference.