Auth & teams

Auth is on by default but stays out of your way until you want it: the gateway is open until you create the first admin account, then it locks.

The three states

State	Dashboard / API	Proxy
Open (no users yet)	Reachable; shows a “create admin” prompt	Works with `/p/<project>`
Locked (≥1 user)	Requires login (session cookie)	Requires a project gateway key
Disabled (`--no-auth`)	Fully open	Fully open

Create the admin

Open the dashboard and use the “Create admin account” prompt, or from the CLI:

bash

npx ai-command-center user add --username aditya --password '…'   # first = admin
npx ai-command-center user list

Teams & who sees what

Admins see every project and manage users, teams, and project keys under Settings.
Members see only the projects assigned to their team. Unassigned projects stay admin-only.

Assign a project to a team in Settings → Projects, and put users on teams in Settings → Users.

Project gateway keys (the proxy under auth)

Once locked, each project gets its own key. The key both authenticates the request and assigns it to that project - so the URL carries the key instead of the project name:

bash

# base URL becomes /k/<gateway-key>/… instead of /p/<project>/…
export OPENAI_BASE_URL="http://localhost:4321/k/aicc_9f3.../openai/v1"
# or send it as a header:  x-aicc-key: aicc_9f3...

The SDKs read AICC_KEY automatically, or take a key option:

python

aicc.init(project="invoice-bot", key="aicc_9f3...")   # or set AICC_KEY

Rotate or revoke a key any time in Settings → Projects (apps using the old key stop working).

Auth today is username/password with signed HttpOnly session cookies (scrypt-hashed passwords, all dependency-free). There is no SSO/OAuth yet - see Security for the hardening path before external multi-tenant use.

← ConfigurationProviders & pricing →