{"id":2126,"date":"2026-08-07T06:11:31","date_gmt":"2026-08-07T06:11:31","guid":{"rendered":"https:\/\/convly.ai\/?p=2126"},"modified":"2026-08-07T06:11:31","modified_gmt":"2026-08-07T06:11:31","slug":"ollama-api-key-authentication","status":"publish","type":"post","link":"https:\/\/convly.ai\/it\/ollama-api-key-authentication\/","title":{"rendered":"Chiave API Ollama: perch\u00e9 non ne esiste una e cosa usare al suo posto"},"content":{"rendered":"<div class=\"convly-tldr\">\n<ul>\n<li><strong>Local Ollama has no API key.<\/strong> The server at <code>http:\/\/localhost:11434<\/code> accepts every request without authentication, by design.<\/li>\n<li>If an OpenAI-compatible client demands a key, enter any non-empty string \u2014 <code>ollama<\/code> is the convention. It is never checked.<\/li>\n<li>A real Ollama API key exists only for <strong>Ollama Cloud<\/strong>, created in your ollama.com account and sent as a <code>Bearer<\/code> token.<\/li>\n<li>To secure a local instance, put a reverse proxy with authentication in front of it. Never expose port 11434 directly to the internet.<\/li>\n<\/ul>\n<\/div>\n<p>A local Ollama installation has no API key and no built-in way to set one. The HTTP server it runs at <code>http:\/\/localhost:11434<\/code> answers any request that reaches it. People searching for an &#8220;Ollama API key&#8221; usually need one of three things: something to type into a client app&#8217;s mandatory key field, a way to secure an instance that other machines can reach, or a key for Ollama&#8217;s hosted cloud service \u2014 the one place a real key exists. This guide covers all three.<\/p>\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_85 counter-flat ez-toc-counter ez-toc-container-direction\">\n<label for=\"ez-toc-cssicon-toggle-item-6a75a5a8eb437\" class=\"ez-toc-cssicon-toggle-label\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #000000;color:#000000\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #000000;color:#000000\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/label><input type=\"checkbox\"  id=\"ez-toc-cssicon-toggle-item-6a75a5a8eb437\"  aria-label=\"Toggle\" \/><nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/convly.ai\/it\/ollama-api-key-authentication\/#Why_Local_Ollama_Ships_Without_Authentication\" >Why Local Ollama Ships Without Authentication<\/a><\/li><li class='ez-toc-page-1'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/convly.ai\/it\/ollama-api-key-authentication\/#What_to_Put_in_the_API_Key_Field_of_OpenAI-Compatible_Clients\" >What to Put in the API Key Field of OpenAI-Compatible Clients<\/a><\/li><li class='ez-toc-page-1'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/convly.ai\/it\/ollama-api-key-authentication\/#Adding_Real_Authentication_with_a_Reverse_Proxy\" >Adding Real Authentication with a Reverse Proxy<\/a><\/li><li class='ez-toc-page-1'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/convly.ai\/it\/ollama-api-key-authentication\/#Changing_Where_Ollama_Listens_Windows_macOS_Linux\" >Changing Where Ollama Listens: Windows, macOS, Linux<\/a><\/li><li class='ez-toc-page-1'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/convly.ai\/it\/ollama-api-key-authentication\/#Ollama_Cloud_Where_a_Real_API_Key_Applies\" >Ollama Cloud: Where a Real API Key Applies<\/a><\/li><li class='ez-toc-page-1'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/convly.ai\/it\/ollama-api-key-authentication\/#The_Actual_Danger_An_Unauthenticated_Instance_on_the_Internet\" >The Actual Danger: An Unauthenticated Instance on the Internet<\/a><\/li><li class='ez-toc-page-1'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/convly.ai\/it\/ollama-api-key-authentication\/#Frequently_Asked_Questions\" >Frequently Asked Questions<\/a><\/li><\/ul><\/nav><\/div>\n<h2><span class=\"ez-toc-section\" id=\"Why_Local_Ollama_Ships_Without_Authentication\"><\/span>Why Local Ollama Ships Without Authentication<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>By default, Ollama binds to the loopback address <code>127.0.0.1<\/code> on port <code>11434<\/code>. Only processes on the same machine can connect, so an API key would add friction without adding security: any local program that could read a key file could just as easily call the API directly. This is the same trust model used by most local development servers.<\/p>\n<p>The consequence: there is no <code>OLLAMA_API_KEY<\/code> variable, no key flag, and no password option anywhere in the configuration. As of this writing, the local Ollama server has no built-in authentication mechanism at all \u2014 securing a network-reachable instance is your job, covered below. If you are still getting set up, start with our <a href=\"https:\/\/convly.ai\/how-to-install-ollama-2026\/\">Ollama installation guide<\/a> or the broader <a href=\"https:\/\/convly.ai\/what-is-ollama-complete-guide-2026\/\">Ollama complete guide<\/a>.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"What_to_Put_in_the_API_Key_Field_of_OpenAI-Compatible_Clients\"><\/span>What to Put in the API Key Field of OpenAI-Compatible Clients<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Ollama exposes OpenAI-compatible endpoints under <code>\/v1<\/code>, which is why chat UIs, coding assistants, and the official OpenAI SDKs can talk to it. Those SDKs refuse to construct a client without a non-empty API key \u2014 the check happens client-side, before any request is sent. Ollama then ignores the resulting <code>Authorization<\/code> header entirely, so any string works. The convention is <code>ollama<\/code>.<\/p>\n<table>\n<thead>\n<tr>\n<th>Setting<\/th>\n<th>Value for local Ollama<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Base URL<\/td>\n<td><code>http:\/\/localhost:11434\/v1<\/code><\/td>\n<\/tr>\n<tr>\n<td>API key<\/td>\n<td>Any non-empty string, e.g. <code>ollama<\/code><\/td>\n<\/tr>\n<tr>\n<td>Model<\/td>\n<td>A tag you have pulled, e.g. <code>llama3.2<\/code><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>Python, using the official OpenAI SDK:<\/p>\n<pre><code>from openai import OpenAI\n\nclient = OpenAI(\n    base_url=\"http:\/\/localhost:11434\/v1\",\n    api_key=\"ollama\",  # required by the SDK, ignored by Ollama\n)\n\nresponse = client.chat.completions.create(\n    model=\"llama3.2\",\n    messages=[{\"role\": \"user\", \"content\": \"Hello\"}],\n)\nprint(response.choices[0].message.content)<\/code><\/pre>\n<p>JavaScript \/ TypeScript:<\/p>\n<pre><code>import OpenAI from \"openai\";\n\nconst client = new OpenAI({\n  baseURL: \"http:\/\/localhost:11434\/v1\",\n  apiKey: \"ollama\",\n});\n\nconst response = await client.chat.completions.create({\n  model: \"llama3.2\",\n  messages: [{ role: \"user\", content: \"Hello\" }],\n});\nconsole.log(response.choices[0].message.content);<\/code><\/pre>\n<p>The model must already be pulled (<code>ollama pull llama3.2<\/code>) or the request will fail with a model-not-found error. If you are unsure what to run, see our picks for the <a href=\"https:\/\/convly.ai\/best-local-llms-to-run-on-ollama-2026\/\">best local models for Ollama<\/a>.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Adding_Real_Authentication_with_a_Reverse_Proxy\"><\/span>Adding Real Authentication with a Reverse Proxy<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Since Ollama cannot check keys itself, the standard pattern is to keep Ollama on its default loopback bind and put a reverse proxy in front. The proxy terminates TLS, checks a token, and forwards valid requests to <code>127.0.0.1:11434<\/code>. A minimal nginx configuration that requires a bearer token:<\/p>\n<pre><code>server {\n    listen 443 ssl;\n    server_name ollama.example.com;\n    # ssl_certificate and ssl_certificate_key lines omitted\n\n    location \/ {\n        if ($http_authorization != \"Bearer YOUR-LONG-RANDOM-TOKEN\") {\n            return 401;\n        }\n        proxy_pass http:\/\/127.0.0.1:11434;\n        proxy_set_header Host $host;\n        proxy_read_timeout 600s;\n    }\n}<\/code><\/pre>\n<p>Two details matter. Generate the token with something like <code>openssl rand -hex 32<\/code> rather than inventing one. And the long <code>proxy_read_timeout<\/code> is deliberate: streamed generations can run for minutes, and default proxy timeouts will cut them off mid-response.<\/p>\n<p>The elegant part: OpenAI SDKs already send the key as <code>Authorization: Bearer &lt;key&gt;<\/code>. Point your client at <code>https:\/\/ollama.example.com\/v1<\/code>, set the API key to the real token, and the formerly ignored key field becomes genuine authentication with no client-side changes. Caddy and Traefik can enforce the same header check or HTTP basic auth with a few lines of their own configuration; if you already run one of them, use it instead of adding nginx.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Changing_Where_Ollama_Listens_Windows_macOS_Linux\"><\/span>Changing Where Ollama Listens: Windows, macOS, Linux<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>A proxy on the same machine needs no Ollama changes. But if other machines must reach Ollama directly \u2014 a proxy on another host, Docker containers, or LAN clients \u2014 set <code>OLLAMA_HOST=0.0.0.0<\/code> so it listens on all interfaces. How you set it differs by platform.<\/p>\n<h3>Windows<\/h3>\n<p>Quit Ollama from the system tray. Open Settings, search for &#8220;environment variables,&#8221; and choose &#8220;Edit environment variables for your account.&#8221; Add a variable named <code>OLLAMA_HOST<\/code> with the value <code>0.0.0.0<\/code>, save, and relaunch Ollama.<\/p>\n<h3>macOS<\/h3>\n<p>Recent desktop builds include a settings toggle in the Ollama app to expose it on the network \u2014 check the app&#8217;s settings first. On older installs, run <code>launchctl setenv OLLAMA_HOST \"0.0.0.0\"<\/code> and restart the Ollama app.<\/p>\n<h3>Linux<\/h3>\n<p>For the systemd service installed by the official script, run <code>sudo systemctl edit ollama.service<\/code> and add:<\/p>\n<pre><code>[Service]\nEnvironment=\"OLLAMA_HOST=0.0.0.0\"<\/code><\/pre>\n<p>Then run <code>sudo systemctl daemon-reload &amp;&amp; sudo systemctl restart ollama<\/code>.<\/p>\n<p>One warning before you flip that switch: <code>0.0.0.0<\/code> on a machine with a public IP address turns your GPU into a public utility. Firewall port 11434 so only the hosts that need it can connect.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Ollama_Cloud_Where_a_Real_API_Key_Applies\"><\/span>Ollama Cloud: Where a Real API Key Applies<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Ollama Cloud runs models too large for most local hardware on Ollama&#8217;s own datacenter GPUs, and it is the one part of the ecosystem with genuine API keys. There are two ways in.<\/p>\n<p><strong>Through the local CLI.<\/strong> Run <code>ollama signin<\/code> to connect your ollama.com account, then run cloud-hosted models by their cloud tags \u2014 at the time of writing, for example, <code>ollama run gpt-oss:120b-cloud<\/code>. Requests are tied to your account; no manual key handling required.<\/p>\n<p><strong>Directly over HTTPS.<\/strong> Create an API key in the API keys section of your ollama.com account settings and send it as a bearer token. The hosted API mirrors the local one, with <code>https:\/\/ollama.com<\/code> as the base URL instead of <code>localhost:11434<\/code>:<\/p>\n<pre><code>curl https:\/\/ollama.com\/api\/chat \n  -H \"Authorization: Bearer $OLLAMA_API_KEY\" \n  -d '{\n    \"model\": \"gpt-oss:120b\",\n    \"messages\": [{\"role\": \"user\", \"content\": \"Hello\"}],\n    \"stream\": false\n  }'<\/code><\/pre>\n<p>The cloud model lineup, endpoints, and plan limits change over time, so treat Ollama&#8217;s own cloud documentation as the authority on current model names and quotas. When deciding whether hosted inference or local hardware makes more sense for your workload, our <a href=\"https:\/\/convly.ai\/self-hosting-vs-api-calculator\/\">self-hosting vs API break-even calculator<\/a> puts numbers on it, and the <a href=\"https:\/\/convly.ai\/llm-vram-calculator\/\">VRAM calculator<\/a> tells you whether a given model fits your GPU at all.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"The_Actual_Danger_An_Unauthenticated_Instance_on_the_Internet\"><\/span>The Actual Danger: An Unauthenticated Instance on the Internet<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>The real security story around the Ollama API key is not the placeholder string in your Python script \u2014 it is the thousands of Ollama servers that internet-wide scans routinely find listening on port 11434 with no authentication. Anyone who finds yours can run inference on your GPU for free, enumerate your models via <code>\/api\/tags<\/code>, pull models until your disk fills, or delete them. And any future server vulnerability becomes exploitable without credentials: CVE-2024-37032, a remote code execution flaw patched in 2024, is the precedent.<\/p>\n<ul>\n<li>Leave the default <code>127.0.0.1<\/code> bind unless something genuinely needs remote access.<\/li>\n<li>For personal remote access, prefer an SSH tunnel (<code>ssh -N -L 11434:127.0.0.1:11434 user@server<\/code>) or a VPN such as WireGuard or Tailscale over opening the port.<\/li>\n<li>If it must be publicly reachable, front it with an authenticated, TLS-terminating reverse proxy as shown above.<\/li>\n<li>Keep Ollama updated so known vulnerabilities stay patched.<\/li>\n<\/ul>\n<h2><span class=\"ez-toc-section\" id=\"Frequently_Asked_Questions\"><\/span>Frequently Asked Questions<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<h3>Does Ollama require an API key?<\/h3>\n<p>No. A local Ollama server has no authentication and no option to enable any. The only real Ollama API keys are for Ollama Cloud, created in your ollama.com account.<\/p>\n<h3>What should I type into a client&#8217;s required API key field?<\/h3>\n<p>Any non-empty string \u2014 <code>ollama<\/code> by convention. The requirement is purely client-side; Ollama discards the header. If you have put an authenticating reverse proxy in front of Ollama, enter the proxy&#8217;s real token instead, since OpenAI-style clients send the key as a bearer token the proxy can verify.<\/p>\n<h3>Can I make Ollama itself require an API key?<\/h3>\n<p>Not as of this writing. There is no environment variable, flag, or configuration option that enables authentication on the local server, despite long-standing user requests for one. A reverse proxy in front of the server is the accepted solution.<\/p>\n<h3>How do I get an Ollama Cloud API key?<\/h3>\n<p>Create an account at ollama.com and generate a key in the API keys section of your account settings. Send it as <code>Authorization: Bearer &lt;key&gt;<\/code> with requests to <code>https:\/\/ollama.com<\/code>. For CLI use, <code>ollama signin<\/code> links your machine to your account without manual key handling.<\/p>\n<h3>Why does the OpenAI SDK throw an authentication error before sending anything?<\/h3>\n<p>The SDK validates that an API key is present when the client is constructed, so an empty or missing key fails locally even though Ollama would not care. Set <code>api_key=\"ollama\"<\/code> (or any string) and make sure the base URL ends in <code>\/v1<\/code>.<\/p>\n<h3>Is it safe to expose Ollama on my home network?<\/h3>\n<p>On a trusted home LAN behind NAT, exposing Ollama with <code>OLLAMA_HOST=0.0.0.0<\/code> is a common and reasonable setup. Confirm your router is not forwarding port 11434 to that machine, and remember that every device on the network \u2014 including guests&#8217; phones \u2014 can then use and manage your models.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Local Ollama has no API key. The server at http:\/\/localhost:11434 accepts every request without authentication, by design. If an OpenAI-compatible [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":2127,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[7],"tags":[],"class_list":["post-2126","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ai-news"],"_links":{"self":[{"href":"https:\/\/convly.ai\/it\/wp-json\/wp\/v2\/posts\/2126","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/convly.ai\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/convly.ai\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/convly.ai\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/convly.ai\/it\/wp-json\/wp\/v2\/comments?post=2126"}],"version-history":[{"count":1,"href":"https:\/\/convly.ai\/it\/wp-json\/wp\/v2\/posts\/2126\/revisions"}],"predecessor-version":[{"id":2128,"href":"https:\/\/convly.ai\/it\/wp-json\/wp\/v2\/posts\/2126\/revisions\/2128"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/convly.ai\/it\/wp-json\/wp\/v2\/media\/2127"}],"wp:attachment":[{"href":"https:\/\/convly.ai\/it\/wp-json\/wp\/v2\/media?parent=2126"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/convly.ai\/it\/wp-json\/wp\/v2\/categories?post=2126"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/convly.ai\/it\/wp-json\/wp\/v2\/tags?post=2126"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}