# chatWA — AI Proxy & Chat Configuration

Short notes to securely configure the AI proxy for the chat endpoints.

1) Store secrets in `/home/www/chatWA/.env` (do NOT commit to VCS).

Example `.env`:

XAI_API_KEY=your_xai_api_key_here
OPENAI_API_KEY=your_openai_api_key_here

2) File permissions: restrict access to the webserver user and admin account.

chmod 640 /home/www/chatWA/.env
chown root:www-data /home/www/chatWA/.env

3) Diagnostic endpoint:

`GET /chatWA/chatgpt/test_ai.php` — performs a minimal probe to the configured proxy endpoint and returns masked key and provider response snippet.

4) Session tokens:

`GET /chatWA/chatgpt/get_session.php?conversation_id=chat_<ts>_<id>` — issues a short-lived server token (default TTL 300s). The client must use this token in `X-Security-Token` when calling `/chatWA/chatgpt/chatweb.php`.

If you want to restrict diagnostics, set `AI_DIAGNOSTIC_TOKEN` in `/home/www/chatWA/.env` to a strong secret; `test_ai.php` will require header `X-DIAG-TOKEN` with that value.

4) Frontend: Do NOT put real API keys in `index/js/secure-chat.json`. Use the `encryption_key` and `security` settings there; keep API keys only in the `.env` file or environment variables.

5) If you need me to verify a key you have, either place it in the `.env` file (preferred) or ask me to implement a secure upload workflow.