iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Do not publish a LiteLLM gateway with its defaults. Before opening an internet-facing listener, create a strong LITELLM_MASTER_KEY using the documented sk- convention, preserve a separate LITELLM_SALT_KEY, bootstrap named administrators, remove environment-credential login, restrict routes and CORS, hide documentation endpoints, and place the service behind TLS and an authenticated network edge. The master key is effectively a root password: anyone who obtains it can use management APIs and normally sign in to the Admin UI.
What to secure before LiteLLM is reachable from the internet
A LiteLLM proxy combines an inference API with key management, user administration, spend records, provider credentials and configuration. A publicly reachable proxy therefore has a larger attack surface than a simple model endpoint. The hardening goal is to make the public surface as small as possible while keeping administrative functions on a private, authenticated path.
- Public data plane: expose only the inference routes your applications actually call.
- Private control plane: keep user, key, spend, configuration and CRUD routes inaccessible from the public edge.
- Protected management secrets: store the master and salt keys outside source control and ordinary environment files.
- Authenticated transport: terminate TLS at a trusted reverse proxy, load balancer or ingress and restrict who can reach the gateway.
Keep the gateway on a private network whenever possible. If internet access is unavoidable, combine TLS with an authenticated reverse proxy, VPN-gated ingress, WAF or private load balancer rather than relying on an application setting alone.
Protect the two LiteLLM root secrets
Set and store LITELLM_MASTER_KEY
Generate a long, unpredictable value and use the current production convention beginning with sk-. Treat this value as root-level access, not as an ordinary API token. It authenticates management APIs and normally serves as the Admin UI password. Anyone holding it can administer the proxy, so never commit it to a repository, container image, Helm chart, ticket or shell history.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
- Generate the value with a cryptographically secure password or secret generator.
- Save it in a dedicated secret manager and inject it into the proxy at runtime.
- Give read access only to the deployment identity that starts LiteLLM.
- Keep an emergency recovery copy under your organization’s controlled break-glass procedure.
- Rotate it immediately if logs, CI output, a workstation or a backup may have exposed it; update every proxy and administrative client in a coordinated change.
Do not confuse the master key with a client key used for ordinary inference. It should not be distributed to applications, browser code or external customers.
Generate LITELLM_SALT_KEY once and preserve it
LiteLLM uses the salt key to encrypt provider credentials stored in its database. Generate a separate high-entropy value and place it in the same secret-management system, but do not reuse the master key. A salt-key change after credentials already exist makes those encrypted credentials unreadable until they are entered again. Record the ownership and recovery procedure for this secret before production launch; losing it is an operational outage, not a routine rotation event.
Check the secret injection path
At startup, verify that the running proxy receives both variables and that neither value is printed by health checks, debug logging, crash reports or deployment manifests. A secret manager reference is safer than a plaintext value in a compose file, but the rendered process environment and logs still need access controls.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Bootstrap administrators before disabling environment login
Environment credentials are useful for initial setup but are a weak long-term model because a shared username and password can spread through deployment systems. Create one or more named proxy_admin users, or configure your organization’s SSO accounts, and test an interactive login before removing the bootstrap path.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
- Start LiteLLM on a private address or maintenance network.
- Use the master key to complete the initial Admin UI setup.
- Create at least one named administrator with the minimum administrative scope required.
- Sign out and sign back in as that named account (or through SSO) to prove the account works independently of the bootstrap credentials.
- Only after that verification, set
general_settings.disable_env_credential_login: true. - Remove
UI_USERNAMEandUI_PASSWORDfrom deployment configuration and secret stores that no longer need them.
Enabling disable_env_credential_login before a named administrator or SSO path works can lock everyone out of the UI. Keep a documented recovery procedure that allows an operator to restore access on a private maintenance interface.
Decide whether the Admin UI should exist at all
If operators do not need the browser interface, set DISABLE_ADMIN_UI=True and block the UI paths at the edge as an additional control. If the UI is required, do not expose it to the general internet: require VPN, identity-aware proxy or an equivalent authenticated network boundary, and restrict it to administrator source networks.
Understand the built-in login throttles
LiteLLM’s Admin UI guidance documents source-address throttling. More than 10 wrong passwords from one source address within 60 seconds blocks that address for 5 minutes. The documented defaults are max_failed_login_attempts_per_source: 10, failed_login_window_seconds: 60 and failed_login_block_seconds: 300. The per-username allowance is more than five attempts from that address. These controls slow guessing; they do not replace an identity provider, VPN or edge rate limiter.
Free tools Windows power users keep installed
One-click scans. No signup required.
Remove documentation and schema exposure
Unauthenticated API descriptions can reveal endpoint names, request formats and administrative capabilities. The root Swagger UI, /redoc and /openapi.json are separate surfaces.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
- Set
NO_DOCSaccording to your release’s configuration instructions to remove the default Swagger UI. - Check
/redocand/openapi.jsonseparately; setting onlyNO_DOCScan leave them available. - If documentation is needed internally, serve it only through an authenticated, private route or allowlist.
- At the reverse proxy, deny documentation paths for public listeners and confirm the denial after every upgrade.
Do not assume that hiding a page protects an endpoint. Administrative APIs still require authentication and network restrictions even when no schema is published.
Limit routes to the inference API
Use LiteLLM’s allowed_routes setting together with edge controls to publish only the model-inference operations that clients need. A typical public application may need a chat-completions route, while key creation, user management, spend, configuration and CRUD routes belong on a private listener.
general_settings:
disable_env_credential_login: true
allowed_routes:
- /v1/chat/completions
- /v1/embeddingsThe paths above are illustrative; use the exact routes enabled by your deployment and clients. Start with an allowlist, exercise every required client operation, then add a route deliberately when a legitimate request fails. Also enforce the same policy at the reverse proxy or WAF so a configuration mistake in one layer does not publish the control plane.
Recommended Free Tools
Correct CORS instead of accepting the wildcard
When unset, LiteLLM’s configuration reference describes the allowed CORS origin as *. That permits browser requests from any origin. Replace the wildcard with an explicit list of HTTPS origins that you operate, such as your production application and a separately controlled administration origin.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
- List exact origins, including scheme and port where applicable; do not use a broad suffix or arbitrary subdomain wildcard.
- Enable credentialed CORS only for those explicit origins.
- Keep credentialed CORS disabled for a wildcard origin; LiteLLM disables it automatically when the origin is
*. - Test preflight responses from an approved origin and an unapproved origin after each proxy or frontend change.
CORS is a browser containment mechanism, not authentication. Non-browser clients can ignore it, so API keys, route restrictions and network controls remain mandatory.
Use TLS and a deliberate network boundary
Preferred topology
Place LiteLLM on a private subnet behind a reverse proxy or private load balancer. Terminate HTTPS with a certificate managed by the edge, forward only the required inference paths, and keep the Admin UI and management APIs on a VPN or identity-aware access layer. Restrict database and Redis security groups so they accept connections only from the proxy and migration jobs.
If a public listener is unavoidable
- Require HTTPS; redirect or reject plaintext HTTP.
- Use an authenticated reverse proxy, VPN-gated ingress, WAF or private load balancer in front of LiteLLM.
- Apply independent request, body-size and source-address limits at the edge.
- Allow administrative routes only from operator networks.
- Log denied paths and authentication failures without recording keys or provider credentials.
Set trusted proxy ranges for accurate source-IP controls
Configure general_settings.trusted_proxy_ranges with the actual CIDR ranges used by your load balancer or ingress. When LiteLLM sits directly on the internet with no trusted proxy, use an empty list: []. This setting allows source-address login throttling to identify the real client rather than treating every request as coming from the proxy.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesNever mark arbitrary internet ranges as trusted. A forged forwarding header from an untrusted source could otherwise defeat source-IP accounting and weaken throttling. Document the CIDRs and update them whenever the ingress architecture changes.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Choose durable database and cache services
PostgreSQL for persistent control-plane data
Use PostgreSQL for authentication data, keys, users, spend logs and configuration in production. Back it up, encrypt connections where supported by your topology, restrict network access and test restoration. SQLite-like local storage is unsuitable for a multi-instance internet-facing control plane because replicas need a shared authoritative store.
Redis for multi-instance coordination
Add Redis when running more than one LiteLLM instance and use it for shared rate limits and router state. Protect Redis with private networking and authentication appropriate to your managed service. A load balancer in front of multiple proxies does not, by itself, make per-source throttling or routing state consistent; shared coordination is required.
Harden the container and release process
- Pin the official LiteLLM container image to a specific release tag rather than an unbounded floating tag.
- Verify image signatures where your registry and release process support verification.
- Separate database migration jobs from steady-state proxy replicas so a rolling restart cannot race schema changes.
- Review release notes for authentication, route, documentation and configuration changes before upgrading.
- Run replicas without unnecessary shell, package-manager or host privileges.
- Keep deployment manifests free of literal master and salt keys.
A practical pre-exposure rollout
- Inventory: list every client route, administrative route, UI path, database, cache and ingress hop.
- Secrets: generate the
sk--prefixed master key and independent salt key; load both from a secret manager. - Private bootstrap: start the gateway on a maintenance network and create named
proxy_adminor SSO administrators. - Lock down login: verify the named account, then enable
disable_env_credential_loginand remove UI bootstrap credentials. - UI decision: disable the UI when unnecessary; otherwise place it behind authenticated private access.
- Documentation: disable Swagger and separately block
/redocand/openapi.jsonon public listeners. - Routes: create an allowlist containing only required inference paths and deny control-plane paths at the edge.
- Browser policy: replace wildcard CORS with exact HTTPS origins and test credentialed requests.
- Proxy identity: set
trusted_proxy_rangesto real ingress CIDRs, or[]for direct clients. - Persistence: connect PostgreSQL, add Redis for multi-instance coordination, and test backup restoration.
- Transport: enable TLS and deploy the reverse-proxy, VPN, WAF or private-load-balancer controls.
- Validation: scan every public path, test failed-login throttling, inspect response headers and confirm that secrets never appear in logs.
Failure modes and recovery checks
Administrators are locked out after bootstrap hardening
This usually means environment login was disabled before a named account or SSO account was verified. Restrict access to a maintenance network, restore a known-good administrator path, test it interactively and then reapply the setting. Do not solve the problem by publishing the Admin UI temporarily to the open internet.
Provider credentials fail after a key change
If credentials became unreadable after changing LITELLM_SALT_KEY, restore the original salt from the controlled backup if available. Otherwise, re-enter each provider credential under the new salt and verify a real inference request before removing the old deployment.
Legitimate users are blocked by login throttling
Check whether multiple users share one egress IP, whether the ingress is reporting its address instead of the client’s, and whether trusted_proxy_ranges matches the actual load balancer CIDRs. Correct the proxy trust configuration and coordinate any threshold changes with the edge rate limiter.
Documentation remains visible
Check all three paths independently: the root Swagger UI, /redoc and /openapi.json. Apply both the LiteLLM documentation setting and an edge deny rule, then retest from an unauthenticated external network.
Browser calls fail while server-to-server calls work
Inspect the preflight response, exact origin, scheme and port. A wildcard origin cannot be used for credentialed CORS. Add only the required HTTPS origin and keep API authentication enabled.
Quick Recap
Settings reference
| Control | Secure production posture | Why it matters |
|---|---|---|
LITELLM_MASTER_KEY |
Long random value using the documented sk- convention; secret-manager injection |
Root-level management and normally Admin UI authentication |
LITELLM_SALT_KEY |
Independent generated value; preserve for the life of encrypted credentials | Decrypts provider credentials in the database |
general_settings.disable_env_credential_login |
true after named admin or SSO verification |
Removes shared environment bootstrap access |
DISABLE_ADMIN_UI |
True when no browser UI is required |
Removes an unnecessary management surface |
NO_DOCS |
Enable according to the deployed release | Hides the default Swagger UI; check other schema paths separately |
allowed_routes |
Allowlist only required inference endpoints | Prevents public access to CRUD and management routes |
| CORS origins | Exact HTTPS origins; credentials only for those origins | Avoids the default wildcard browser policy |
general_settings.trusted_proxy_ranges |
Actual ingress CIDRs, or [] for direct clients |
Preserves accurate source-IP throttling |
| Login throttling | Defaults: 10 attempts, 60-second window, 300-second block | Slows password guessing; supplement at the edge |
| Database/cache | PostgreSQL; Redis for multiple instances | Shares auth, keys, logs, configuration, rate limits and router state |
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
