Live Dashboard

Open http://127.0.0.1:18790/dashboard. The dashboard is a single-page app (self-hosted fonts/CSS, works offline) with these panels:

Route	Panel
#/overview	Overview
#/company	Live Company (pixel-agents)
#/monitor	Live Monitor
#/sessions	Sessions
#/recordings	Recordings (session replay)
#/memory	Memory
#/config	Config (secrets masked to ***)
#/features	Features (live capability status)
#/logs	Logs
#/agents	Agents
#/sops	SOPs

The dashboard mounts on the WebChat app and is only available when WebChat is enabled and dashboard.enabled is true. It also surfaces a Features panel (live capability status) and Recordings (session replay).

Authentication (dashboard.auth_token)

Empty = no auth (fine for the default localhost bind; a non-loopback bind requires it). When set, a deny-by-default middleware gates every route on the shared app — all /api/* (including /api/status), /dashboard, the FastAPI docs, and unknown paths (401, no route disclosure). Public exceptions: /, /health, /dashboard/static/*, and the self-authenticating /webhook/*. Both WebSockets (/ws/chat, /ws/dashboard) check the Origin header and the token before accepting the upgrade (close 1008 otherwise). The token is accepted (in precedence order) via the aethon_dash cookie, an Authorization: Bearer <token> header, or a ?token=<token> query param.

The usual flow when a token is set:

# Open once with the token; the server sets the aethon_dash cookie for you.
http://127.0.0.1:18790/dashboard?token=YOUR_TOKEN

# API calls (Bearer header):
curl -H "Authorization: Bearer YOUR_TOKEN" http://127.0.0.1:18790/api/config

# WebSocket (cookie or ?token=):
ws://127.0.0.1:18790/ws/dashboard?token=YOUR_TOKEN

:::note Liveness/health GET /health always returns {"status": "ok"}, even when a dashboard token is set. :::

Session recording & replay

When session_recorder.enabled is on, AETHON records the timeline + state snapshots to a ZIP. Browse, inspect, and resume recordings from the dashboard's Recordings tab. See Capabilities for the config.