llmgw
Docs/Security

Trust boundary

Private gateway. Privileged configuration.

Bind privately, authenticate administration, protect state and backups, and treat provider configuration as code execution over the network.

llm-gateway is an internal self-hosted service, not a public relay. Place it on loopback or a private network and terminate remote TLS at a trusted reverse proxy.

Private vulnerability reporting

Use GitHub private vulnerability reporting. Do not open a public issue for an undisclosed vulnerability and never include real credentials, hosts, accounts, identity data, or production logs.

Authentication and authorization

  • Static administrator key (LLMGW_API_KEY or LLMGW_API_KEYS) or verified admin-group SSO for administration.
  • Verified SSO human for the portal.
  • Scoped project key for data-plane APIs. Static administrator keys also work there but bypass key and project allowlists and quotas, so never hand them to clients.
  • Project keys cannot call admin APIs.
  • Project and key allowlists/quotas execute before provider routing.

Gateway-issued tokens authenticate against SHA-256 hashes. Recoverable copies use AES-GCM only when encryption was configured at issuance; reveal is owner/admin-only, no-store, and audited.

Provider credentials

Human API-key and OAuth connections are AES-256-GCM encrypted. List and audit APIs return metadata, not token values. System provider keys can also remain in owner-only plaintext secrets.json for compatibility, so universal encryption at rest is not claimed.

Generic API-key providers can fall back to a system connection. Exact project binding applies to the supported Copilot shared-service path. Personal Copilot and Codex OAuth remain human-private.

Reverse-proxy SSO

The proxy must authenticate the human, overwrite X-LLMGW-SSO-Secret, forward verified identity/group headers, and block direct listener access. The included Caddy file is not turnkey Authentik SSO.

Diagnostics and logs

Credential-shaped upstream diagnostics are sanitized. Request metadata logging is off by default. Full body capture is an unsafe second opt-in that can persist prompts, credentials, personal data, and source code.

Backup security

Archives can contain configuration, encrypted connections, plaintext compatibility secrets, key recovery ciphertext, OAuth caches, and usage state. Windows uses a protected current-user/SYSTEM DACL; Unix uses owner-only modes.

Integrity is not authenticityChecksums and SQLite checks detect corruption, not malicious replacement. Store archives and the separate encryption key in protected locations.

SSRF posture

Private-address blocking is intentionally absent because operator-configured local/LAN providers are a core feature. Provider administration is privileged. Do not expose it to untrusted users.

Provider-specific risks

  • Copilot gateway use is a personal-use grey area; respect terms.
  • Third-party Codex client registration is not currently documented by OpenAI.
  • No Claude personal OAuth, browser-cookie extraction, MITM interception, or stealth session reuse.
  • Edge TTS uses an unofficial service and can change.