How to Set Up API Key Authentication for AutoGPT: Complete Configuration Guide

AutoGPT loads API keys from environment variables defined in autogpt_platform/backend/.env, validates internal requests via Bearer tokens using the CHAT_API_KEY, and injects secrets into blocks through the CredentialsStore class and Block SDK.

Setting up API key authentication for AutoGPT requires configuring the platform backend to securely store and validate secrets for both internal webhook routes and external service integrations. The Significant-Gravitas/AutoGPT repository centralizes credential management through a Pydantic-based store that reads environment variables into SecretStr objects, ensuring sensitive keys never leak into logs or error traces.

Where AutoGPT Stores API Keys

Environment Configuration in .env

All secret keys originate as environment variables. For local development using Docker or Poetry, place your keys in autogpt_platform/backend/.env. The backend loads these at startup and maps them to the credential store.

# autogpt_platform/backend/.env

OPENAI_API_KEY=sk-xxxxxxxxxxxxxxxxxxxxxxxx
ANTHROPIC_API_KEY=sk-ant-xxxxxxxx
CHAT_API_KEY=your-internal-platform-key
FIRECRAWL_API_KEY=fc-xxxxxxxx

The CredentialsStore Integration

The CredentialsStore class in backend/integrations/credentials_store.py ingests the raw environment variables and exposes them as Pydantic SecretStr instances. This design prevents accidental exposure of keys when serializing logs or debugging blocks.

Internal Platform Authentication

Configuring the CHAT_API_KEY

AutoGPT protects internal webhook endpoints—such as chat callbacks—using a dedicated platform key defined in backend/api/features/chat/config.py. The configuration resolves the key in this priority order:

1. CHAT_API_KEY environment variable
2. OPEN_ROUTER_API_KEY (fallback)
3. OPENAI_API_KEY (final fallback)

# backend/api/features/chat/config.py (simplified)

import os

CHAT_API_KEY = os.getenv("CHAT_API_KEY") \
    or os.getenv("OPEN_ROUTER_API_KEY") \
    or os.getenv("OPENAI_API_KEY")

Validating Bearer Tokens

Requests to protected routes must include the Authorization header with a Bearer token matching the configured CHAT_API_KEY. If validation fails, the endpoint returns “CHAT_INTERNAL_API_KEY not configured” as seen in backend/api/features/chat/routes.py at line 869.

curl -X POST https://localhost:8000/api/chat/webhook \
  -H "Authorization: Bearer your-chat-api-key" \
  -H "Content-Type: application/json" \
  -d '{"message":"Hello"}'

External Service Authentication

UserConfigurable for LLM Providers

The classic AutoGPT forge uses the UserConfigurable helper to declare required environment variables. For example, in forge/llm/providers/openai.py, the OPENAI_API_KEY is registered as a configurable secret that the agent loads at runtime.

Block SDK with_api_key() Method

The platform Block SDK offers a fluent builder pattern for adding API-key support to custom blocks. The .with_api_key(env_var_name, title) method registers a credential requirement, which the backend automatically wires to the CredentialsStore.

At runtime, the block retrieves the secret using credentials.api_key.get_secret_value() to avoid leaking the key in stack traces.

Creating an API-Key-Protected Block

Step 1: Register the Key in _config.py

Create a configuration file in your block directory to declare the required environment variable. Follow the pattern used by the Firecrawl and Linear blocks.

# autogpt_platform/backend/backend/blocks/my_service/_config.py

from autogpt_platform.backend.backend.blocks import BlockConfig

BlockConfig().with_api_key(
    env_var_name="MY_SERVICE_API_KEY",
    title="My Service API Key"
)

Step 2: Access Secrets in the Handler

Import the CredentialsStore to retrieve the secret value within your block’s execution logic.

# autogpt_platform/backend/backend/blocks/my_service/handler.py

from backend.integrations.credentials_store import CredentialsStore

async def run(input_data: dict):
    store = CredentialsStore()
    secret = store.get_secret("MY_SERVICE_API_KEY")
    api_key = secret.get_secret_value()
    
    headers = {"Authorization": f"Bearer {api_key}"}
    # Perform external request...

Step 3: Set Environment Variables

Add the key to your .env file and restart the backend service to load the new configuration.

# autogpt_platform/backend/.env

MY_SERVICE_API_KEY=sk-my-service-1234567890

Testing Authenticated Requests

Verify your configuration by sending a request to a protected block endpoint using the internal CHAT_API_KEY as the Bearer token.

curl -X POST http://localhost:8000/v1/blocks/firecrawl/run \
  -H "Authorization: Bearer $CHAT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com"}'

The backend validates the internal chat key, then the Firecrawl block retrieves its own FIRECRAWL_API_KEY from the CredentialsStore to complete the external request.

Summary

• Environment variables in autogpt_platform/backend/.env are the single source of truth for all API keys.
• Internal authentication relies on CHAT_API_KEY configured in backend/api/features/chat/config.py and validated via Bearer tokens.
• External service blocks declare key requirements using BlockConfig().with_api_key() and access secrets through CredentialsStore().get_secret().
• Security is enforced by Pydantic SecretStr objects that prevent accidental key leakage in logs or traces.

Frequently Asked Questions

What is the difference between CHAT_API_KEY and service-specific keys like OPENAI_API_KEY?

CHAT_API_KEY is an internal platform secret defined in backend/api/features/chat/config.py that protects AutoGPT’s webhook and chat endpoints from unauthorized access. Service-specific keys like OPENAI_API_KEY or FIRECRAWL_API_KEY are credentials used by individual blocks to authenticate with external third-party APIs. The former validates incoming requests to the platform; the latter authorizes outgoing requests from the platform.

How do I rotate an API key without breaking running agents?

Update the value in autogpt_platform/backend/.env and restart the backend service. The CredentialsStore reloads environment variables at startup, so active blocks will pick up the new secret on their next execution cycle. For zero-downtime rotation in production, use a secrets manager that the CredentialsStore can query dynamically, or deploy the new key alongside the old one temporarily while agents transition.

Why does my block return "CHAT_INTERNAL_API_KEY not configured" when I call an endpoint?

This error originates in backend/api/features/chat/routes.py at line 869 when the request lacks a valid Authorization: Bearer <token> header or when the CHAT_API_KEY environment variable is unset. Verify that your HTTP client includes the header with the exact value defined in your .env file, and ensure the backend container has access to the environment variables by checking your Docker Compose configuration or shell exports.

Can I use the Block SDK to require multiple API keys for a single block?

Yes. The Block SDK’s BlockConfig supports chaining multiple .with_api_key() calls to register several environment variables. Each key is stored independently in the CredentialsStore and can be retrieved by name within your block’s handler. For example, a block that queries both OpenAI and Anthropic can declare both OPENAI_API_KEY and ANTHROPIC_API_KEY, then access each via CredentialsStore().get_secret() using the respective variable names.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}