---
slug: /api/authentication
sidebar_position: 2
---

# Authentication

Agent routes on the ABI process API require `ABI_API_KEY`. The check is `is_abi_api_token_valid` in `.abi/libs/naas-abi-core/naas_abi_core/apps/api/abi_api_key_auth.py`. The token must equal the `ABI_API_KEY` environment variable.

## Bearer header

```bash
curl -X POST 'http://localhost:9879/agents/Abi/completion' \
  -H 'Authorization: Bearer $ABI_API_KEY' \
  -H 'Content-Type: application/json' \
  -d '{"prompt": "Your question here", "thread_id": 1}'
```

## Query parameter

The same token is accepted as `?token=` (`OAuth2QueryBearer` in `naas_abi_core.apps.api.api`).

```bash
curl -X POST 'http://localhost:9879/agents/Abi/completion?token='$ABI_API_KEY \
  -H 'Content-Type: application/json' \
  -d '{"prompt": "Your question here", "thread_id": 1}'
```

## Local token helper

`POST /token` is registered with `include_in_schema=False`. It is a Swagger convenience: password `abi` returns `ABI_API_KEY`, or `abi` if that env var is unset. Do not treat it as a production login.

## Rate limits

The ABI API app does not implement a rate-limit middleware. If you need limits, put them in front of the process (gateway or reverse proxy).