API Key Requirement

[mredig]

mtplx doctor --json

Bug is a bit of an overstatement, but it's causing strife for my setup.

Right now, we can run a local server at 127.0.0.1 without an api key or, if we host on 0.0.0.0, it requires an api key. I am running a server just for my LAN and the api key is causing many headaches that are really unnecessary.

Can you either turn off the requirement for an api key when hosting beyond localhost, or have a checkbox with something like "I know what I am doing" to allow no api key?

Exact command

n/a

Model path or repo id

n/a

Chip, RAM, macOS version

n/a

[bluem4g]

I use a work-around for that. On the client machine where I run my harness, I open an SSH tunnel to the machine running mtplx:

ssh -N -L 8000:localhost:8000 user@my-mtplx-server

This mirrors the service to the client system, as if it was running it locally, and the server only ever sees localhost accesses, so no API key is needed.

As an extra bonus, In opencode's opencode.jsonc, I use "baseURL": "http://{file:~/.local.modelserver}:8000/v1" to address the model server, so the actual server address is retrieved from a file in the home directory. Normally this would just be localhost or 127.0.0.1. But in an isolated environment such as a devcontainer I can point it to host.docker.internal. This way I can share my opencode config among many instances, without changing them, without API key and with added security on the network.

Edit: minor clarifications

[youssofal]

Not changing in 2.12.0. The key is required when the server listens beyond localhost on purpose, because without it anyone who can reach the port can use the model. The SSH tunnel @bluem4g described keeps the server on localhost and needs no key. An opt-out for a trusted network is a fair request, and I'll look at it after this release.