Agentic Fabriq
Botpress
AI · AI
Bots, conversations, messages, and tables in that workspace’s own account.
Connect Botpress with Fabriq Developer
Your user pastes their Botpress credential on a page Agentic Fabriq hosts, so it never reaches your backend and never becomes one shared key across all of your users. Same call as OAuth, one more argument.
Provider names are surfaces, not vendors, and the authoritative list is the capabilities endpoint rather than any page including this one — an unknown name returns 400 with the valid list. Fabriq Developer is free to start and needs no provider paperwork. Start free or read the quickstart.
Connecting Botpress in practice
A Botpress Personal Access Token "grants you the same access level as your user account", so an agent holding one reaches every bot in every workspace that person belongs to; the narrower Bot and Integration Access Keys exist but are restricted to the runtime, tables and files APIs. The rate limiter is a sliding window whose allowance is never stated — you read it off RateLimit-Limit.
Scopes that draw scrutiny
Personal Access Token (PAT)Botpress defines access by token type rather than by scope strings. A PAT is generated in Profile Settings and carries the same access level as the human’s account, across every workspace they belong to.Bot Access Key (BAK)Issued on bot deployment and restricted to the runtime, tables and files API actions — the narrow credential to prefer over a PAT.Integration Access Key (IAK)Issued on integration deployment and limited to the runtime and files APIs.
Rate limits
- "Our APIs are protected using a sliding window rate limiter." The per-window allowance is not published; RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset are returned on every response (the docs’ worked example shows RateLimit-Limit: 100).
- Over the limit the response is 429 with body {"type":"RateLimited","description":"The request has been rate-limited.","status":429}.
Worth knowing
- Because the published limit is only an example value, a limiter has to be driven from the response headers rather than from a configured constant.
- The Chat API lives on a different host (chat.botpress.cloud) from everything else (api.botpress.cloud), so one base URL is not enough.
- The official Botpress client handles the limiter for you, which means a hand-rolled HTTP integration is the one that has to implement backoff.
- RateLimit-Reset is a Unix timestamp, not a seconds-to-wait value, so treating it like Retry-After sleeps for decades.
Checked against Botpress API authentication (2026-09-29), Botpress API rate limiting (2026-09-29), Botpress API reference (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put Botpress behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.