API Keys and Security
Each gateway has one API key. Every request must include it, except the optional public model list described below.
How your key is protected
- Shown once. We only store a fingerprint of the key, so nobody, including us, can read it back.
- Removed before it reaches your machine. The edge checks your key and strips it from the request, so your model server never sees it.
- Tied to one gateway. A key from one gateway doesn't work on another.
Replace your key
If you lose the key, or think someone else has it:
- Open your gateway page and click Issue new API key.
- Confirm. The new key is shown once, so copy it.
- Update your apps. The old key stops working within about 15 seconds.
Public model list
Some tools, such as Cline's Ollama provider, load the model list without sending the key. For those, you can switch on Allow the model list without an API key on the gateway page. It only opens three read-only addresses: /api/tags, /v1/models and /api/version. Anyone with your gateway address can then see your model names. Chat and generation still need the key. Leave it off if you don't need it.
Good habits
- Keep the key on servers and in your own tools. Never ship it inside a mobile app or a public web page.
- Don't paste it into screenshots, tickets or chat messages. If it has been shared, replace it.
- Store it in an environment variable or a secrets manager, not in your source code.