Gateway API

The gateway is the HTTP server that runs alongside the scheduler. It handles webhooks, serves the web dashboard, and exposes control and status APIs used by CLI commands and the dashboard. The gateway starts automatically when needed — either when webhooks are configured, when --web-ui is passed to al start, or when Docker container communication is required. The port is controlled by the [gateway].port setting in config.toml (default: 8080).

​

Authentication

The gateway API is protected by an API key. The same key is used for both browser sessions and CLI access. Key location: ~/.action-llama/credentials/gateway_api_key/default/key The key is generated automatically by al doctor or on first al start. To view or regenerate it, run al doctor.

​

CLI access

CLI commands (al stat, al pause, al resume, al kill) automatically read the API key from the credential store and send it as a Bearer token in the Authorization header.

​

Browser access

The web dashboard uses cookie-based authentication. After logging in with the API key, an al_session cookie is set (HttpOnly, SameSite=Strict) so all subsequent requests — including SSE streams — are authenticated automatically.

​

Protected routes

The following routes require authentication:

• /dashboard and /dashboard/* — all dashboard pages and SSE streams
• /control/* — scheduler and agent control endpoints
• /locks/status — active lock information

Health checks (/health), webhook endpoints (/webhooks/*), and container management routes are not protected.

​

Migrating from AL_DASHBOARD_SECRET

The old AL_DASHBOARD_SECRET environment variable (HTTP Basic Auth) is no longer used. If it’s still set, a deprecation warning is logged. Remove it from your environment and run al doctor to set up the new API key.

​

Control API

All control endpoints use POST and require authentication.

​

Scheduler control

​

Agent control

​

Status API

​

SSE streams

Live updates use Server-Sent Events (SSE):

​

Trigger history

​

Health check

​

Lock status