Protect the private Workflow to AI API

Keep this connection private

Workflow servers use private AI requests for model chat, knowledge search, and workflow text.

These requests do not appear in the public OpenAPI file.

Set up both services

1. Give Workflow the private AI address.
2. Create a long random service token.
3. Give the same token to the AI servers.
4. Set a request time limit.
5. Use HTTPS on the private network.

Limit the network

Only Workflow servers and trusted administrator networks should reach the private AI address. Use mTLS at the internal load balancer or service mesh in production.

The token is not enough by itself

The token proves that the request came from Workflow. Pūnaha still checks access to the model or knowledge database.