AiHummer
English▾
Sign inAccount
v1.1.x▾
v1.2.xstablev1.1.xstablev1.0.xstable
{ }Swagger
Web UI/API keys, external access & IP allowlist

API keys, external access & IP allowlist

v1.1.x · updated 2026-07-08

This page covers three Web UI screens that govern access to the instance from outside: API keys, External access and IP allowlist.

API keys

The “API keys” screen issues control-plane and chat keys. “+ Issue”:

  • User — pick a local user or enter a reference manually;
  • the key name;
  • scopes — checkboxes: chat, admin:read, admin:write, mcp, a2a, * (all);
  • an RPM limit.

Besides the six coarse scopes above, granular per-domain scopes are available alongside them, in the form domain:read, domain:write, domain:* (e.g. agents:read, channels:write, memory:*) — grant a key only the domains it needs.

The key value is shown once — save it immediately. Per key row you can “Register as OAuth client” (issues client_id / client_secret once) and “Revoke”. Keys are prefixed ah- and sent as a Bearer token (see Scalar).

External access

The “External access” screen configures reverse-proxy operation and public addresses in four blocks:

  • Public address — AIHUMMER_PUBLIC_URL (required): the instance has a single public address for all external access.
  • HTTPS only — AIHUMMER_REQUIRE_SECURE.
  • Behind a proxy — trusted proxies, CORS origins, CSP.
  • Web UI listener — enabling, address and origin of the private Web UI port.

Each field is text or a toggle; on save you’re told whether the change applied live or needs a restart.

IP allowlist

The “IP allowlist” screen is a single textarea of CIDRs, one per line, that restricts admin-API access to specific networks. An empty list means no restriction.

[!TIP] The IP allowlist is a blunt but reliable barrier. Combine it with RBAC and “HTTPS only” to allow access only from the office/VPN.

Next