create_unified_app(..., api_key=...) now installs the _api_auth middleware on every mounted route except /health. Existing callers that were passing api_key= but not sending Authorization: Bearer / X-API-Key from clients will start getting 401 — this closes a silent auth-bypass on the tool-driving routes.
praisonai serve unified mounts tool-driving routes (notably POST /v1/tools/invoke via mount_provider_routes), so binding it to a non-localhost interface without authentication is refused.
Binding to any host other than 127.0.0.1 / localhost / ::1requires an API key. The server exits immediately (SystemExit) if neither --api-key nor PRAISONAI_SERVE_API_KEY is set.
Use the unified endpoints CLI to interact with any provider:
# List all endpointspraisonai endpoints list --url http://localhost:8765# Filter by provider typepraisonai endpoints list --url http://localhost:8765 --type agents-api# Get discovery documentpraisonai endpoints discovery --url http://localhost:8765# Health checkpraisonai endpoints health --url http://localhost:8765
API key. Required when --host is not 127.0.0.1 / localhost / ::1. Can also be set via PRAISONAI_SERVE_API_KEY. Enforces Authorization: Bearer / X-API-Key on every route except /health.
API key required to bind praisonai serve unified on a non-localhost host. The server exits with SystemExit if this is unset and no --api-key is passed when --host is not localhost. Also drives the _api_auth middleware when the server is running.