Introduction

Authentication

Every request to Agent is authorized with a JWT (RS256) issued by Aist Backend. The token goes in the Authorization header.

Authorization header

All client endpoints (except the internal webhook/tool callbacks) require these headers:

Authorization: Bearer <jwt>
Accept: application/json

The token is signed with RS256. Agent verifies the signature with Aist Backend's public key (the key is cached and refreshed periodically) and checks the expiry. No private keys or secrets ever leave the server.

Where to get a token

JWTs are issued by Aist Backend, the central backend of the ecosystem. A token is bound to a user and contains a Sanctum token that Agent uses to call Aist Backend on your behalf (creating chats and turns, saving results). Users issue tokens themselves in their Aist Ai account settings, in the “API-ключи” (API keys) section, or a platform administrator issues one. Step by step, plus where companies should reach out — Getting access.

Checking a token

The easiest way is to open the dashboard and paste the token: it shows the expiry date, limits, available assistants and tasks. From code, the same data comes from:

GET /api/me

{
  "user_id": 1,
  "token": { "expires_at": "2027-01-01T00:00:00+00:00", "abilities": ["agent-api"] },
  "limits": { "max_active_tasks": 5, "max_execution_time": 86400 },
  "tasks": { "active": 2, "total": 40, "by_status": { … }, "last_created_at": "…" },
  "storage_url": "https://…"
}

Available assistants

Which assistant_id and llm_model_id values the token can use is covered on the Assistants page (GET /api/assistants).

Token fields (payload)

Field	Purpose
`sub`	User ID. Stored on the task; the active task limit is counted against it.
`sanctum`	Bearer token for Agent → Aist Backend requests.
`exp`	Expiry. An expired token is rejected (401).
`abilities`	Token abilities, passed through to the request context.

Token revocation

If Aist Backend answers 403 to a request made on a user's behalf, Agent blacklists that JWT — every subsequent request with it gets 401. Expired blacklist entries are removed automatically.

Requirements for Agent → Aist Backend requests

Internally, every request Agent sends to Aist Backend carries the Referer and Accept: application/json headers — without them Aist Backend returns 404. This is transparent to you as a client, but it explains why an “assistant is not available” error sometimes masks a configuration problem.