# How to Set Up API Key Authentication for AutoGPT: Complete Configuration Guide

> Secure AutoGPT with API key authentication. Learn to configure environment variables, validate requests with Bearer tokens, and inject secrets using this comprehensive guide.

- Repository: [AutoGPT/AutoGPT](https://github.com/Significant-Gravitas/AutoGPT)
- Tags: how-to-guide
- Published: 2026-02-24

---

**AutoGPT loads API keys from environment variables defined in `autogpt_platform/backend/.env`, validates internal requests via Bearer tokens using the `CHAT_API_KEY`, and injects secrets into blocks through the `CredentialsStore` class and Block SDK.**

Setting up API key authentication for AutoGPT requires configuring the platform backend to securely store and validate secrets for both internal webhook routes and external service integrations. The Significant-Gravitas/AutoGPT repository centralizes credential management through a Pydantic-based store that reads environment variables into `SecretStr` objects, ensuring sensitive keys never leak into logs or error traces.

## Where AutoGPT Stores API Keys

### Environment Configuration in `.env`

All secret keys originate as environment variables. For local development using Docker or Poetry, place your keys in `autogpt_platform/backend/.env`. The backend loads these at startup and maps them to the credential store.

```dotenv

# autogpt_platform/backend/.env

OPENAI_API_KEY=sk-xxxxxxxxxxxxxxxxxxxxxxxx
ANTHROPIC_API_KEY=sk-ant-xxxxxxxx
CHAT_API_KEY=your-internal-platform-key
FIRECRAWL_API_KEY=fc-xxxxxxxx

```

### The CredentialsStore Integration

The `CredentialsStore` class in [`backend/integrations/credentials_store.py`](https://github.com/Significant-Gravitas/AutoGPT/blob/main/backend/integrations/credentials_store.py) ingests the raw environment variables and exposes them as Pydantic `SecretStr` instances. This design prevents accidental exposure of keys when serializing logs or debugging blocks.

## Internal Platform Authentication

### Configuring the CHAT_API_KEY

AutoGPT protects internal webhook endpoints—such as chat callbacks—using a dedicated platform key defined in [`backend/api/features/chat/config.py`](https://github.com/Significant-Gravitas/AutoGPT/blob/main/backend/api/features/chat/config.py). The configuration resolves the key in this priority order:

1. `CHAT_API_KEY` environment variable
2. `OPEN_ROUTER_API_KEY` (fallback)
3. `OPENAI_API_KEY` (final fallback)

```python

# backend/api/features/chat/config.py (simplified)

import os

CHAT_API_KEY = os.getenv("CHAT_API_KEY") \
    or os.getenv("OPEN_ROUTER_API_KEY") \
    or os.getenv("OPENAI_API_KEY")

```

### Validating Bearer Tokens

Requests to protected routes must include the `Authorization` header with a Bearer token matching the configured `CHAT_API_KEY`. If validation fails, the endpoint returns *“CHAT_INTERNAL_API_KEY not configured”* as seen in [`backend/api/features/chat/routes.py`](https://github.com/Significant-Gravitas/AutoGPT/blob/main/backend/api/features/chat/routes.py) at line 869.

```bash
curl -X POST https://localhost:8000/api/chat/webhook \
  -H "Authorization: Bearer your-chat-api-key" \
  -H "Content-Type: application/json" \
  -d '{"message":"Hello"}'

```

## External Service Authentication

### UserConfigurable for LLM Providers

The classic AutoGPT forge uses the `UserConfigurable` helper to declare required environment variables. For example, in [`forge/llm/providers/openai.py`](https://github.com/Significant-Gravitas/AutoGPT/blob/main/forge/llm/providers/openai.py), the `OPENAI_API_KEY` is registered as a configurable secret that the agent loads at runtime.

### Block SDK with_api_key() Method

The platform Block SDK offers a fluent builder pattern for adding API-key support to custom blocks. The `.with_api_key(env_var_name, title)` method registers a credential requirement, which the backend automatically wires to the `CredentialsStore`.

At runtime, the block retrieves the secret using `credentials.api_key.get_secret_value()` to avoid leaking the key in stack traces.

## Creating an API-Key-Protected Block

### Step 1: Register the Key in _config.py

Create a configuration file in your block directory to declare the required environment variable. Follow the pattern used by the Firecrawl and Linear blocks.

```python

# autogpt_platform/backend/backend/blocks/my_service/_config.py

from autogpt_platform.backend.backend.blocks import BlockConfig

BlockConfig().with_api_key(
    env_var_name="MY_SERVICE_API_KEY",
    title="My Service API Key"
)

```

### Step 2: Access Secrets in the Handler

Import the `CredentialsStore` to retrieve the secret value within your block’s execution logic.

```python

# autogpt_platform/backend/backend/blocks/my_service/handler.py

from backend.integrations.credentials_store import CredentialsStore

async def run(input_data: dict):
    store = CredentialsStore()
    secret = store.get_secret("MY_SERVICE_API_KEY")
    api_key = secret.get_secret_value()
    
    headers = {"Authorization": f"Bearer {api_key}"}
    # Perform external request...

```

### Step 3: Set Environment Variables

Add the key to your `.env` file and restart the backend service to load the new configuration.

```dotenv

# autogpt_platform/backend/.env

MY_SERVICE_API_KEY=sk-my-service-1234567890

```

## Testing Authenticated Requests

Verify your configuration by sending a request to a protected block endpoint using the internal `CHAT_API_KEY` as the Bearer token.

```bash
curl -X POST http://localhost:8000/v1/blocks/firecrawl/run \
  -H "Authorization: Bearer $CHAT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com"}'

```

The backend validates the internal chat key, then the Firecrawl block retrieves its own `FIRECRAWL_API_KEY` from the `CredentialsStore` to complete the external request.

## Summary

- **Environment variables** in `autogpt_platform/backend/.env` are the single source of truth for all API keys.
- **Internal authentication** relies on `CHAT_API_KEY` configured in [`backend/api/features/chat/config.py`](https://github.com/Significant-Gravitas/AutoGPT/blob/main/backend/api/features/chat/config.py) and validated via Bearer tokens.
- **External service blocks** declare key requirements using `BlockConfig().with_api_key()` and access secrets through `CredentialsStore().get_secret()`.
- **Security** is enforced by Pydantic `SecretStr` objects that prevent accidental key leakage in logs or traces.

## Frequently Asked Questions

### What is the difference between CHAT_API_KEY and service-specific keys like OPENAI_API_KEY?

**`CHAT_API_KEY`** is an internal platform secret defined in [`backend/api/features/chat/config.py`](https://github.com/Significant-Gravitas/AutoGPT/blob/main/backend/api/features/chat/config.py) that protects AutoGPT’s webhook and chat endpoints from unauthorized access. Service-specific keys like **`OPENAI_API_KEY`** or **`FIRECRAWL_API_KEY`** are credentials used by individual blocks to authenticate with external third-party APIs. The former validates incoming requests to the platform; the latter authorizes outgoing requests from the platform.

### How do I rotate an API key without breaking running agents?

Update the value in `autogpt_platform/backend/.env` and restart the backend service. The `CredentialsStore` reloads environment variables at startup, so active blocks will pick up the new secret on their next execution cycle. For zero-downtime rotation in production, use a secrets manager that the `CredentialsStore` can query dynamically, or deploy the new key alongside the old one temporarily while agents transition.

### Why does my block return "CHAT_INTERNAL_API_KEY not configured" when I call an endpoint?

This error originates in [`backend/api/features/chat/routes.py`](https://github.com/Significant-Gravitas/AutoGPT/blob/main/backend/api/features/chat/routes.py) at line 869 when the request lacks a valid `Authorization: Bearer <token>` header or when the `CHAT_API_KEY` environment variable is unset. Verify that your HTTP client includes the header with the exact value defined in your `.env` file, and ensure the backend container has access to the environment variables by checking your Docker Compose configuration or shell exports.

### Can I use the Block SDK to require multiple API keys for a single block?

Yes. The Block SDK’s `BlockConfig` supports chaining multiple `.with_api_key()` calls to register several environment variables. Each key is stored independently in the `CredentialsStore` and can be retrieved by name within your block’s handler. For example, a block that queries both OpenAI and Anthropic can declare both `OPENAI_API_KEY` and `ANTHROPIC_API_KEY`, then access each via `CredentialsStore().get_secret()` using the respective variable names.