Remote Access and API EN

中文 | English

Remote access is disabled by default and listens on no ports; it must be explicitly enabled by the user.

How to Enable

Go to the Remote page and flip the switch on. Once enabled:

• Listens on 127.0.0.1:8600 by default (port configurable)
• A client key is generated automatically — no manual entry; an access password can be enabled as well
• Configuration is persisted in config.json in the data directory (remote_enabled / host / port / client_key / password_enabled)

Authentication

Mode	Credentials
Key only (default)	Authorization: Bearer <client_key>
Key + password	Additionally send the X-Access-Password header

A correct key is accepted; invalid credentials return 401.

HTTP API

Endpoint	Method	Description
/api/health	GET	Health check
/api/tools	GET / POST	List / register tools
/api/tools/{id}	DELETE	Delete a tool
/api/tools/{id}/invoke	POST	Invoke a tool manually
/api/chat	POST	Chat (supports an images parameter, an array of data URLs)
/api/audit	GET	Audit log
/api/update/check	GET	Check for updates
/api/update/status	GET	Update download status
/api/update/download	POST	Trigger a download
/mcp	POST	MCP Streamable HTTP endpoint
/v1/models	GET	OpenAI-compatible model list
/v1/chat/completions	POST	OpenAI-compatible chat

Using BIT as an OpenAI-Compatible Endpoint

/v1/chat/completions means any client that speaks the OpenAI protocol can use BIT as a model endpoint, backed by BIT's full Agent capabilities (tool calls, memory, skills):

curl http://127.0.0.1:8600/v1/chat/completions \
  -H "Authorization: Bearer $BIT_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model":"bit","messages":[{"role":"user","content":"list the current directory"}]}'

Security Notes

• Binds to 127.0.0.1 only by default and is never exposed to the LAN
• Both host and port are configurable; if you expose BIT to the public internet, always enable the access password and set up your own reverse proxy
• Covered by E2E tests: disabled by default, listening once enabled, 401 on wrong credentials, instance-conflict handling