Skip to content

External Access

Backend.AI GO binds the OpenAI-compatible Continuum Router to 127.0.0.1 by default. Other devices cannot reach it until you explicitly enable external access.

This page covers the router (default port 39080), used by OpenAI-compatible clients. The Management API server (default port 8001), which serves the REST API, the MCP endpoint, and the desktop app itself, has its own separate Allow access from other devices switch under Settings > API Server > Management API; see MCP Endpoint for its security notes.

Configure external access

  1. Open Settings > API Server.
  2. Enable the TCP server if it is off.
  3. Confirm the router port. The current default is 39080.
  4. Enable Allow external access and accept the warning. The router then binds to 0.0.0.0 instead of loopback.
  5. Open Settings > API Server > Security and review the authentication policy.
  6. Open Settings > API Server > Access keys and create an access key for remote clients.
  7. Allow the selected port through the host firewall only for the intended private network.

The port change takes effect when the router is enabled or restarted. The external-access toggle changes the bind address used by the router.

Connect from another device

Use the host's LAN address and the configured router port:

curl http://192.168.1.10:39080/v1/models \
  -H "X-API-Key: YOUR_ACCESS_KEY"

OpenAI-compatible clients use this base URL:

http://192.168.1.10:39080/v1

Security checklist

  • Keep external access off when it is not needed.
  • Do not expose the router directly to the public internet.
  • Require an access key for remote clients.
  • Restrict the firewall rule to a trusted subnet or specific clients.
  • Use a VPN or authenticated reverse proxy when traffic must cross an untrusted network.
  • Rotate a key immediately if it is disclosed.

0.0.0.0 accepts traffic on every network interface. An API key does not replace network-level filtering.

Troubleshooting

If a remote request fails:

  1. Confirm the router is running in Settings > API Server.
  2. Confirm the client uses the configured port, not the Management API port.
  3. Check that Allow external access is enabled.
  4. Verify the firewall rule and LAN routing.
  5. Verify the key in Settings > API Server > Access keys.
  6. Test http://127.0.0.1:39080/v1/models on the host first.

If the app's own features fail instead (published agents, model discovery, or chat inside the app), the router is rejecting the key the app uses for its own calls. Settings > API Server then shows a banner that says why: the app could not read its key, the router was started with a different key, or the router refuses the key it was started with. When the router and the app disagree about the key, the app restarts the router once on its own. Otherwise, select Restart in the banner. The app log carries the same diagnosis on a line that names the caller and the fingerprints of both keys, never the keys themselves.

Published agents

Published agents use two listeners: Chat Completions and Responses use the router, while A2A uses the Management API. Expose only the interfaces your clients need, and use each listener's reachable address and access key. A2A requires the agent_invoke scope; publication administration uses agent_read and agent_write. A Management API tunnel does not also expose the router port. See Agent endpoints for connection details and examples.