Skip to content
BOM AI logoBOM AI
XM
XM

BOM AI Manual

API Keys for Other Apps

Create, store, and revoke keys of the chat page on your own machine — with a working example for developers.

Connect apps to BOM AI with an API key

This manual is for BOM AI v0.3.1-r2.

Normal chatting needs no API key

If you just open the chat and use it as usual, you can ignore this page. This page is for people connecting other programs to BOM AI.

The key described here belongs to Open WebUI, the BOM AI chat page on your own machine — it is not a key from a pay-per-use AI service. Creating, storing, and revoking keys is done by you, the user.

1. Create a key in the chat page

Open the chat page on your machine (http://127.0.0.1:8080), then open the profile menu → Settings → Account, find the API keys section, and use the create button exactly as shown on your screen.

Copy the key into a safe place. Never paste it into screenshots or files you share. Creating a new key may replace the old one — update the programs that used it.

Do you not see the key menu? An administrator must enable the API keys capability and set the account permissions first. The menu location can differ between Open WebUI versions; follow the version shipped with your BOM AI package.

2. Use the real address and model id

Item Value
Chat page address (Open WebUI) http://127.0.0.1:8080
List models available to the account GET /api/models
Send a message POST /api/chat/completions
Authentication Authorization: Bearer YOUR_API_KEY

Use as model the id returned by the models endpoint — the display name (such as BOM AI Safe) can differ from the id your program must send. Never guess the id from the visible name.

3. Quick test with curl

curl -s http://127.0.0.1:8080/api/models \
  -H "Authorization: Bearer YOUR_API_KEY"

Then send one short message:

curl -s http://127.0.0.1:8080/api/chat/completions \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model":"MODEL_ID_FROM_LIST","stream":false,"messages":[{"role":"user","content":"Say hello in one sentence"}]}'

An HTTP 200 alone does not prove the answer is correct or complete — read the actual response content.

4. Store and revoke safely

  • Keep the key out of shared code, screenshots, and reports
  • Revoke keys you no longer use (delete or regenerate in the API keys section), then confirm the old key really stops working
  • The key carries the permissions of its owner account — revoke immediately if you suspect a leak, and use a least-privilege account for external programs

The Ollama port is not protected by this key

Standard Ollama listens on port 11434 (some installs use a nearby port). The Open WebUI key does not add authentication to those ports automatically. Keep the model service reachable only from your own machine, and use the authenticated chat page for programs that need access control. For phone access see Mobile & Remote Access, which needs no public model port.

Common response codes

Code or symptom Check
401 Key is valid, still active, and the Bearer header is complete
403 The account is allowed to use the API and that endpoint
404 Endpoint and model id match the installed service and models
Cannot connect BOM AI is running and you are using the chat page port 8080
200 but empty body Inspect the response and error logs — do not treat it as success

Reference: Open WebUI API keys, Open WebUI API

XM
XM