vLLM's --api-key leaves /invocations, /tokenize and /pause open. Lock it down with an allowlist proxy

Automated excerpt

If you run vllm serve --api-key ... and think the server is now private, read vLLM's own security guide. The guide calls a reverse proxy that allowlists endpoints "the most effective approach". Keep it set even behind the proxy, so a proxy mistake doesn't open /v1.

Selected automatically from source text; not independently written or fact-checked. Read the original for full context.