Authentication

All Agentix public API endpoints require authentication via API keys. This page covers how to create, manage, and use API keys.

Creating API Keys

1. Navigate to Settings > API Keys in the Agentix dashboard
2. Click Create API Key
3. Provide a descriptive name (e.g., “Production Widget”, “Mobile App”)
4. Select the scopes you need
5. Click Create
6. Copy the key immediately — it will not be shown again

Key Format

API keys follow this format:

agx_live_<32-character-random-string>

Example: agx_live_sk7Gm2xPqR4tN8vW1yBz3dF6hJ9kL0mA

Keys prefixed with agx_live_ are production keys. Test keys (coming soon) will use agx_test_.

Using API Keys

Include your API key in every request using one of these methods:

Bearer Token (Recommended)

curl -H "Authorization: Bearer agx_live_YOUR_KEY" \
  https://app.agentix.cl/api/public/agents/{agentId}/chat

X-API-Key Header

curl -H "X-API-Key: agx_live_YOUR_KEY" \
  https://app.agentix.cl/api/public/agents/{agentId}/chat

Both methods are equivalent. Use whichever fits your HTTP client best.

Scopes

API keys can be restricted to specific scopes:

A key with no explicit scopes has access to all public endpoints. We recommend creating keys with the minimum scopes required.

Organization Binding

API keys are bound to an organization. A key can only access agents owned by the same organization. Attempting to use a key from Organization A to chat with an agent from Organization B returns a 403 ORG_MISMATCH error.

Key Rotation

When rotating API keys, follow this process to avoid downtime:

1. Create a new API key
2. Update your application to use the new key
3. Verify the new key works
4. Delete the old key

Rate Limiting

API keys are subject to rate limiting:

When rate limited, the API returns 429 Too Many Requests with a Retry-After header.

Security Best Practices

• Never expose API keys in client-side code. If embedding the widget, the key is visible in the page source. Use a key scoped only to chat for widgets.
• Use environment variables to store keys in your server-side applications.
• Rotate keys regularly, especially if you suspect a key has been compromised.
• Use domain restrictions on your agents to limit which domains can use the widget, even if a key is leaked.
• Create separate keys for each environment (development, staging, production).
• Monitor usage in the dashboard to detect unusual patterns.

Error Responses