Area
Developer Experience
Candidate
When AGORA_TOKEN is set, the browser UI cannot load any API-backed data because the server requires auth on every /api/* request but the frontend never sends a token.
A token-protected deployment still serves /, but the page then fetches inbox, threads, and timeline data from /api/* without Authorization or X-Agora-Token, so every request fails with 401 unauthorized.
That makes the documented browser UI unusable in exactly the deployments where token auth matters most.
Evidence
internal/server/server.go rejects every /api/* request unless the bearer token or X-Agora-Token matches AGORA_TOKENinternal/server/static/app.js issues plain fetch() calls to /api/events, /api/threads, and /api/agents/<actor>/inbox without any auth header support- Live check against a token-enabled server returned
200 for / and 401 for /api/events without a token
Suggested fix
Teach the browser UI to send the configured token, or make the UI explicitly support token-protected deployments so the docs do not promise an unusable setup.
Area
Developer Experience
Candidate
When
AGORA_TOKENis set, the browser UI cannot load any API-backed data because the server requires auth on every/api/*request but the frontend never sends a token.A token-protected deployment still serves
/, but the page then fetches inbox, threads, and timeline data from/api/*withoutAuthorizationorX-Agora-Token, so every request fails with401 unauthorized.That makes the documented browser UI unusable in exactly the deployments where token auth matters most.
Evidence
internal/server/server.gorejects every/api/*request unless the bearer token orX-Agora-TokenmatchesAGORA_TOKENinternal/server/static/app.jsissues plainfetch()calls to/api/events,/api/threads, and/api/agents/<actor>/inboxwithout any auth header support200for/and401for/api/eventswithout a tokenSuggested fix
Teach the browser UI to send the configured token, or make the UI explicitly support token-protected deployments so the docs do not promise an unusable setup.