Skip to main content
BoardPulse AI uses different authentication models for its two API surfaces. The main REST API is open by design for internal and development use, while the OpenAI-compatible endpoint uses a Bearer token to protect integrations exposed to chat clients like Open WebUI.

​
Main API (/api/v1/)

All endpoints under /api/v1/ — including health, chat, workspaces, and exports — require no authentication. This is intentional for the MVP stage, where the API is expected to run in a trusted internal network or behind a reverse proxy.
Do not expose /api/v1/ directly to the public internet without adding authentication at the infrastructure level (e.g., a reverse proxy with access controls).

​
OpenAI-compatible endpoint (/openai/v1/)

The endpoints under /openai/v1/ require an Authorization header with a Bearer token. This protects integrations where the API is accessible from a browser-based chat client.

​
Passing the token

Include the token in every request as an HTTP header:
Example request:

​
Configuring the key

Set the BOARDPULSE_OPENAI_COMPAT_KEY environment variable to control the expected token value:
The default key boardpulse-dev-key is publicly known. Always set a strong, unique value for BOARDPULSE_OPENAI_COMPAT_KEY before deploying to production.

​
Error responses

If the Authorization header is missing or the token does not match: Missing token (no Authorization header provided):
Wrong token (header present but value does not match):
Both errors return HTTP 401 Unauthorized.