Self-host GoModel

GoModel README

How to install GoModel

OPENAI_API_KEY

docker run --rm -p 8080:8080 \
  -e OPENAI_API_KEY="your-openai-key" \
  enterpilot/gomodel

OPENAI_API_KEY

cp .env.template .env
# Add your API keys to .env
docker compose --profile app up -d
# or: make image

OPENAI_API_KEY

irm https://gomodel.enterpilot.io/install.ps1 | iex
# $env:OPENAI_API_KEY = "your-openai-key" # (optional)
gomodel

PORT, GOMODEL_MASTER_KEY, OPENAI_API_KEY

curl -fsSL https://gomodel.enterpilot.io/install.sh | sh
# OPENAI_API_KEY="your-openai-key" # (optional)
gomodel

How to configure GoModel

• ADMIN_ENDPOINTS_ENABLEDEnable/disable admin REST API endpoints (default: true) When enabled, provides /admin/* REST endpoints

  Enable/disable admin REST API endpoints (default: true) When enabled, provides /admin/* REST endpoints

• ADMIN_UI_ENABLEDEnable/disable admin dashboard UI (default: true) When enabled, provides /admin/dashboard UI Requires ADMIN_ENDPOINTS_ENABLED=true — if endpoints are disabled and UI is enabled, a warning is logged and UI is forced to disabled

  Enable/disable admin dashboard UI (default: true) When enabled, provides /admin/dashboard UI Requires ADMIN_ENDPOINTS_ENABLED=true — if endpoints are disabled and UI is enabled, a warning is logged and UI is forced to disabled

• ALLOW_PASSTHROUGH_V1_ALIASAllow optional /p/{provider}/v1/... passthrough aliases while keeping /p/{provider}/... canonical (default: true)

  Allow optional /p/{provider}/v1/... passthrough aliases while keeping /p/{provider}/... canonical (default: true)

• ANTHROPIC_API_KEYAnthropic Accepts a Console API key (sk-ant-api...) or a Claude subscription OAuth token from `claude setup-token` (sk-ant-oat...; Claude Code traffic only).

  Anthropic Accepts a Console API key (sk-ant-api...) or a Claude subscription OAuth token from `claude setup-token` (sk-ant-oat...; Claude Code traffic only).

• ANTHROPIC_BASE_URL
• ANTHROPIC_DEFAULT_MAX_TOKENSAnthropic /v1/messages requires max_tokens. When the caller omits it, GoModel injects this value. Default: 4096. Raise it for newer models that produce longer outputs (e.g. Sonnet 4.6 / Opus 4.7).

  Anthropic /v1/messages requires max_tokens. When the caller omits it, GoModel injects this value. Default: 4096. Raise it for newer models that produce longer outputs (e.g. Sonnet 4.6 / Opus 4.7).

• AUDIOCPP_API_KEYAUDIOCPP_API_KEY is optional; audio.cpp has no authentication of its own, so set it only when a reverse proxy in front of the server expects a token.

  AUDIOCPP_API_KEY is optional; audio.cpp has no authentication of its own, so set it only when a reverse proxy in front of the server expects a token.

• AUDIOCPP_BASE_URLaudio.cpp (audiocpp_server: local text-to-speech and speech-to-text) Base URL is required and enables the provider; audiocpp_server's default port (8080) collides with the gateway's own. A trailing /v1 is accepted.

  audio.cpp (audiocpp_server: local text-to-speech and speech-to-text) Base URL is required and enables the provider; audiocpp_server's default port (8080) collides with the gateway's own. A trailing /v1 is accepted.

• AUTH_VERIFY_ENABLEDExpose GET /v1/auth/verify (default: false). It answers 200 {"valid":true,...} when the API key the request carries authenticates against this gateway, and 401 when it does not, so a service in front of GoModel can validate keys without holding a copy of them. A gateway with no authentication configured accepts every request and has no key to confirm: there the answer is 200 {"valid":false,"method

  Expose GET /v1/auth/verify (default: false). It answers 200 {"valid":true,...} when the API key the request carries authenticates against this gateway, and 401 when it does not, so a service in front of GoModel can validate keys without holding a copy of them. A gateway with no authentication configured accepts every request and has no key to confirm: there the answer is 200 {"valid":false,"method

• AWS_BEARER_TOKEN_BEDROCKAmazon Bedrock Bedrock has no per-provider API key. Auth comes from the standard AWS credential chain — env vars (AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY/ AWS_SESSION_TOKEN), AWS_PROFILE, IAM Identity Center, or instance/container roles. Set BEDROCK_BASE_URL to either an AWS region (e.g. "us-east-1") or a full https endpoint to enable the provider; otherwise the provider falls back to AWS_REGION /

  Amazon Bedrock Bedrock has no per-provider API key. Auth comes from the standard AWS credential chain — env vars (AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY/ AWS_SESSION_TOKEN), AWS_PROFILE, IAM Identity Center, or instance/container roles. Set BEDROCK_BASE_URL to either an AWS region (e.g. "us-east-1") or a full https endpoint to enable the provider; otherwise the provider falls back to AWS_REGION /

• AZURE_API_KEYAzure OpenAI

  Azure OpenAI

• AZURE_API_VERSION
• AZURE_BASE_URL
• BAILIAN_API_KEYAlibaba Cloud Bailian (百炼)

  Alibaba Cloud Bailian (百炼)

• BAILIAN_BASE_URL
• BAILIAN_MODELS
• BASE_PATHMount the whole gateway under a path prefix, e.g. https://example.com/g/

  Mount the whole gateway under a path prefix, e.g. https://example.com/g/

• BEDROCK_BASE_URL
• BEDROCK_MANTLE_API_KEYAmazon Bedrock Mantle (OpenAI-compatible) Use this separate provider for Responses-only models such as GPT-5.6. Authentication accepts a Bedrock API key or the AWS credential chain.

  Amazon Bedrock Mantle (OpenAI-compatible) Use this separate provider for Responses-only models such as GPT-5.6. Authentication accepts a Bedrock API key or the AWS credential chain.

• BEDROCK_MANTLE_API_MODEAWS_BEARER_TOKEN_BEDROCK from the Bedrock section above also works as a fallback bearer token. Set BASE_URL with it to enable provider discovery. Optional: auto (default), openai, or standard upstream API path selection.

  AWS_BEARER_TOKEN_BEDROCK from the Bedrock section above also works as a fallback bearer token. Set BASE_URL with it to enable provider discovery. Optional: auto (default), openai, or standard upstream API path selection.

• BEDROCK_MANTLE_BASE_URL
• BEDROCK_MANTLE_MODELS
• BEDROCK_MODELSOptional configured model allowlist (model IDs or inference profiles)

  Optional configured model allowlist (model IDs or inference profiles)

• BODY_SIZE_LIMITMaximum request body size (prevents DoS attacks) Accepts values like "10M", "1G", "500K" (default: 10M)

  Maximum request body size (prevents DoS attacks) Accepts values like "10M", "1G", "500K" (default: 10M)

• BUDGETS_ENABLED=trueEnable budget management and workflow budget checks when usage tracking is enabled

  Enable budget management and workflow budget checks when usage tracking is enabled

• CACHE_REFRESH_INTERVALHow often to refresh the model registry cache in seconds (default: 3600). Also sets how often provider health ("Last checked" in the dashboard) is re-checked; lower it to detect provider outages/recoveries faster.

  How often to refresh the model registry cache in seconds (default: 3600). Also sets how often provider health ("Last checked" in the dashboard) is re-checked; lower it to detect provider outages/recoveries faster.

• CHATGPT_API_KEYChatGPT subscription (Codex backend, /v1/responses only) Billed against your ChatGPT plan instead of OpenAI Platform credit. The key is the access token from `codex login`; it expires roughly every 10 days.

  ChatGPT subscription (Codex backend, /v1/responses only) Billed against your ChatGPT plan instead of OpenAI Platform credit. The key is the access token from `codex login`; it expires roughly every 10 days.

• CHATGPT_BASE_URL
• CHATGPT_MODELSOptional model override; defaults to the models a ChatGPT plan can call.

  Optional model override; defaults to the models a ChatGPT plan can call.

• CHUTES_API_KEY
• CIRCUIT_BREAKER_ENABLEDEnable the per-provider circuit breaker (default: true) Set to false to never fail fast, e.g. when an upstream load balancer already does it.

  Enable the per-provider circuit breaker (default: true) Set to false to never fail fast, e.g. when an upstream load balancer already does it.

• CIRCUIT_BREAKER_FAILURE_THRESHOLDConsecutive failures before opening the circuit breaker (default: 5)

  Consecutive failures before opening the circuit breaker (default: 5)

• CIRCUIT_BREAKER_SLOW_CALL_THRESHOLDCount a call answered slower than this as a breaker failure, so sustained latency opens the circuit and triggers failover (default: 0 = disabled; e.g. 60s)

  Count a call answered slower than this as a breaker failure, so sustained latency opens the circuit and triggers failover (default: 0 = disabled; e.g. 60s)

• CIRCUIT_BREAKER_SUCCESS_THRESHOLDConsecutive successes required to close the circuit breaker (default: 2)

  Consecutive successes required to close the circuit breaker (default: 2)

• CIRCUIT_BREAKER_TIMEOUTCircuit breaker open-state timeout duration (default: 30s)

  Circuit breaker open-state timeout duration (default: 30s)

• COHERE_API_KEYCohere

  Cohere

• COHERE_BASE_URL
• CONFIG_STRICTReject unknown keys in config.yaml and in the JSON env vars that declare the same structures (VIRTUAL_MODELS, SET_RATE_LIMIT_*, SET_BUDGET_*). Default: true, so a typo or a misindented section fails startup instead of silently dropping providers, rate limits, budgets, or guardrails. Set false to downgrade unknown keys to warnings — intended for rolling a binary back under a newer config file. Malf

  Reject unknown keys in config.yaml and in the JSON env vars that declare the same structures (VIRTUAL_MODELS, SET_RATE_LIMIT_*, SET_BUDGET_*). Default: true, so a typo or a misindented section fails startup instead of silently dropping providers, rate limits, budgets, or guardrails. Set false to downgrade unknown keys to warnings — intended for rolling a binary back under a newer config file. Malf

• CONFIGURED_PROVIDER_MODELS_MODEHow providers.<name>.models and <PROVIDER>[_SUFFIX]_MODELS affect provider inventory. fallback (default): use configured models only when upstream /models fails, is nil, or is empty. allowlist: expose only the configured models for providers that define a list, and skip their upstream /models calls. merge: keep the upstream inventory and add configured models it does not list, so models a provider

  How providers.<name>.models and <PROVIDER>[_SUFFIX]_MODELS affect provider inventory. fallback (default): use configured models only when upstream /models fails, is nil, or is empty. allowlist: expose only the configured models for providers that define a list, and skip their upstream /models calls. merge: keep the upstream inventory and add configured models it does not list, so models a provider

• DASHBOARD_LIVE_LOGS_BUFFER_SIZEIn-memory live log replay buffer in events (default: 10000) The effective buffer is capped at DASHBOARD_LIVE_LOGS_REPLAY_LIMIT + 1, since events older than the replay window can never be served; lower this below the replay limit only to shrink memory further at the cost of more replay resets. Buffered events hold compact previews only — request/response bodies are never retained (connected dashboa

  In-memory live log replay buffer in events (default: 10000) The effective buffer is capped at DASHBOARD_LIVE_LOGS_REPLAY_LIMIT + 1, since events older than the replay window can never be served; lower this below the replay limit only to shrink memory further at the cost of more replay resets. Buffered events hold compact previews only — request/response bodies are never retained (connected dashboa

• DASHBOARD_LIVE_LOGS_ENABLEDEnable/disable realtime dashboard log previews (default: true) When enabled, the dashboard opens /admin/live/logs and streams compact audit/usage lifecycle updates before the async DB flush completes. Requires ADMIN_ENDPOINTS_ENABLED=true and ADMIN_UI_ENABLED=true for the UI.

  Enable/disable realtime dashboard log previews (default: true) When enabled, the dashboard opens /admin/live/logs and streams compact audit/usage lifecycle updates before the async DB flush completes. Requires ADMIN_ENDPOINTS_ENABLED=true and ADMIN_UI_ENABLED=true for the UI.

• DASHBOARD_LIVE_LOGS_HEARTBEAT_SECONDSHeartbeat interval in seconds for idle live log streams (default: 15) Keeps proxies and poor connections from closing an otherwise quiet stream.

  Heartbeat interval in seconds for idle live log streams (default: 15) Keeps proxies and poor connections from closing an otherwise quiet stream.

• DASHBOARD_LIVE_LOGS_REPLAY_LIMITMaximum live log events replayed to one reconnecting dashboard client (default: 1000) Also bounds the replay buffer above. If a cursor is older than the replay window, the dashboard resets from REST APIs.

  Maximum live log events replayed to one reconnecting dashboard client (default: 1000) Also bounds the replay buffer above. If a cursor is older than the replay window, the dashboard resets from REST APIs.

• DEEPSEEK_API_KEY
• DEEPSEEK_JSON_SCHEMA_MODEDeepSeek models (deepseek and opencode_go providers) support response_format json_object but not json_schema. "downgrade" sends json_object plus the schema as a system message (output is JSON but not schema-enforced); "error" rejects the request instead (default: downgrade).

  DeepSeek models (deepseek and opencode_go providers) support response_format json_object but not json_schema. "downgrade" sends json_object plus the schema as a system message (output is JSON but not schema-enforced); "error" rejects the request instead (default: downgrade).

• EDENAI_API_KEYEden AI (default base URL: https://api.edenai.run/v3) Multi-provider gateway. Model IDs use provider/model and pass through unchanged. EDENAI_BASE_URL is optional: the default above is used when it is unset.

  Eden AI (default base URL: https://api.edenai.run/v3) Multi-provider gateway. Model IDs use provider/model and pass through unchanged. EDENAI_BASE_URL is optional: the default above is used when it is unset.

• EDENAI_BASE_URL
• EDENAI_MODELSOptional configured model list; see CONFIGURED_PROVIDER_MODELS_MODE below

  Optional configured model list; see CONFIGURED_PROVIDER_MODELS_MODE below

• ELEVENLABS_API_KEYElevenLabs (voice: text-to-speech + speech-to-text; default base URL: https://api.elevenlabs.io) The OpenAI "voice" field must be an ElevenLabs voice_id.

  ElevenLabs (voice: text-to-speech + speech-to-text; default base URL: https://api.elevenlabs.io) The OpenAI "voice" field must be an ElevenLabs voice_id.

• ELEVENLABS_BASE_URL
• ENABLED_PASSTHROUGH_PROVIDERSComma-separated list of provider types enabled for /p/{provider}/... passthrough (default: openai,anthropic,openrouter,kilo,zai,sglang,vllm,llamacpp,llmd,deepseek,edenai,jev) Cohere and audio.cpp native passthrough are opt-in; add cohere or audiocpp when those routes are needed. audio.cpp's native surface includes model management and server-local file paths, so enable it only for trusted callers.

  Comma-separated list of provider types enabled for /p/{provider}/... passthrough (default: openai,anthropic,openrouter,kilo,zai,sglang,vllm,llamacpp,llmd,deepseek,edenai,jev) Cohere and audio.cpp native passthrough are opt-in; add cohere or audiocpp when those routes are needed. audio.cpp's native surface includes model management and server-local file paths, so enable it only for trusted callers.

• ENABLE_GUARDRAILS_FOR_BATCH_PROCESSINGGuardrails for inline batch processing (default: false) When true, guardrails are applied to inline /v1/batches request items (e.g. /v1/chat/completions and /v1/responses items).

  Guardrails for inline batch processing (default: false) When true, guardrails are applied to inline /v1/batches request items (e.g. /v1/chat/completions and /v1/responses items).

• ENABLE_PASSTHROUGH_ROUTESEnable/disable provider-native passthrough routes under /p/{provider}/{endpoint} (default: true)

  Enable/disable provider-native passthrough routes under /p/{provider}/{endpoint} (default: true)

• ENFORCE_RETURNING_USAGE_DATAEnforce returning usage data in streaming responses (default: true) When true, stream_options: {"include_usage": true} is automatically added to streaming requests for OpenAI-compatible providers. Non-streaming requests are unaffected: their JSON response always carries usage.

  Enforce returning usage data in streaming responses (default: true) When true, stream_options: {"include_usage": true} is automatically added to streaming requests for OpenAI-compatible providers. Non-streaming requests are unaffected: their JSON response always carries usage.

• FAILOVER_ENABLEDFailover & Workflow Configuration Failover is a virtual-model behaviour: when the chosen target fails, the redirect's remaining targets are tried in order (use strategy "failover" for a strict priority list). Enabled by default; false switches the sweep off globally.

  Failover & Workflow Configuration Failover is a virtual-model behaviour: when the chosen target fails, the redirect's remaining targets are tried in order (use strategy "failover" for a strict priority list). Enabled by default; false switches the sweep off globally.

• FAILOVER_MAX_ATTEMPTSCap on failover targets tried per request; 0 (default) sweeps every remaining target.

  Cap on failover targets tried per request; 0 (default) sweeps every remaining target.

• FAILOVER_RETRY_ON_STATUSESUpstream statuses that trigger failover (exact codes or a class like 5xx). A non-empty value replaces the default 429,5xx.

  Upstream statuses that trigger failover (exact codes or a class like 5xx). A non-empty value replaces the default 429,5xx.

• FAILOVER_RULES_JSONError phrases that trigger failover regardless of status; every word of a phrase must appear in the error (a numeric word like 404 matches the status instead). A non-empty value replaces the default "model not found"-style, "upstream failed", and retired-model 404 phrases. See docs/features/failover.mdx for the full default. FAILOVER_RETRY_ON_ERRORS=model not found,upstream failed,404 deprecated D

  Error phrases that trigger failover regardless of status; every word of a phrase must appear in the error (a numeric word like 404 matches the status instead). A non-empty value replaces the default "model not found"-style, "upstream failed", and retired-model 404 phrases. See docs/features/failover.mdx for the full default. FAILOVER_RETRY_ON_ERRORS=model not found,upstream failed,404 deprecated D

• FIREWORKS_API_KEYFireworks AI (default base URL: https://api.fireworks.ai/inference/v1) Model IDs are account-scoped paths, e.g. accounts/fireworks/models/gpt-oss-120b

  Fireworks AI (default base URL: https://api.fireworks.ai/inference/v1) Model IDs are account-scoped paths, e.g. accounts/fireworks/models/gpt-oss-120b

• FIREWORKS_BASE_URL
• FIREWORKS_MODELSOptional configured model list; see CONFIGURED_PROVIDER_MODELS_MODE below

  Optional configured model list; see CONFIGURED_PROVIDER_MODELS_MODE below

• GEMINI_API_KEYGoogle Gemini

  Google Gemini

• GEMINI_BASE_URLGemini base URL. The official defaults are: - native chat/models: https://generativelanguage.googleapis.com/v1beta - OpenAI-compatible API: https://generativelanguage.googleapis.com/v1beta/openai If this ends in /openai, GoModel derives the native base by stripping /openai.

  Gemini base URL. The official defaults are: - native chat/models: https://generativelanguage.googleapis.com/v1beta - OpenAI-compatible API: https://generativelanguage.googleapis.com/v1beta/openai If this ends in /openai, GoModel derives the native base by stripping /openai.

• GOMODEL_CACHE_DIROptional: Custom cache directory for local file cache Default: ./.cache when it already exists, otherwise the OS per-user cache directory (~/.cache/gomodel, ~/Library/Caches/gomodel, %LocalAppData%\gomodel\cache)

  Optional: Custom cache directory for local file cache Default: ./.cache when it already exists, otherwise the OS per-user cache directory (~/.cache/gomodel, ~/Library/Caches/gomodel, %LocalAppData%\gomodel\cache)

• GOMODEL_DEMO_MODE=falseEnable public demo warnings in logs and the dashboard

  Enable public demo warnings in logs and the dashboard

• GOMODEL_ENCRYPTION_KEYEncrypt dashboard-managed secrets (provider credentials, MCP headers, guardrail secrets) at rest. Generate with: openssl rand -base64 32 Losing this key makes those secrets unrecoverable. Default: unset (plaintext).

  Encrypt dashboard-managed secrets (provider credentials, MCP headers, guardrail secrets) at rest. Generate with: openssl rand -base64 32 Losing this key makes those secrets unrecoverable. Default: unset (plaintext).

• GOMODEL_ENCRYPTION_KEY_PREVIOUSDuring a key rotation, the old key; remove once every instance uses the new one.

  During a key rotation, the old key; remove once every instance uses the new one.

• GOMODEL_MASTER_KEYSecurity Configuration CRITICAL: Set this to secure your gateway from unauthorized access If not set, the server will run in UNSAFE MODE with a warning

  Security Configuration CRITICAL: Set this to secure your gateway from unauthorized access If not set, the server will run in UNSAFE MODE with a warning

• GOMODEL_OFFLINEAir-gapped installs: one switch that disables every outbound call the gateway makes on its own -- the update check (GOMODEL_VERSION_CHECK_*) and the remote model catalog download (MODEL_LIST_URL over HTTP). Configured providers and endpoints you declare yourself (OTLP, MCP upstreams, vector stores) are not affected, and a catalog given as a local file path keeps working.

  Air-gapped installs: one switch that disables every outbound call the gateway makes on its own -- the update check (GOMODEL_VERSION_CHECK_*) and the remote model catalog download (MODEL_LIST_URL over HTTP). Configured providers and endpoints you declare yourself (OTLP, MCP upstreams, vector stores) are not affected, and a catalog given as a local file path keeps working.

• GOMODEL_VERSION_CHECK_ENABLEDVersion awareness: check https://gomodel.enterpilot.io/version once a day, and again the first time each browser opens the dashboard on a new day, so operators learn that a newer release exists. The dashboard shows the result in Settings; GET /version returns it as JSON. The check sends the running version, the distribution name (GoModel or GoModel Pro), and a random per-deployment install id. It

  Version awareness: check https://gomodel.enterpilot.io/version once a day, and again the first time each browser opens the dashboard on a new day, so operators learn that a newer release exists. The dashboard shows the result in Settings; GET /version returns it as JSON. The check sends the running version, the distribution name (GoModel or GoModel Pro), and a random per-deployment install id. It

• GOMODEL_VERSION_CHECK_URLPoint at an internal mirror serving core.txt / pro.txt for air-gapped networks.

  Point at an internal mirror serving core.txt / pro.txt for air-gapped networks.

• GROQ_API_KEYGroq

  Groq

• GROQ_BASE_URL
• GUARDRAILS_ENABLEDEnable/disable guardrails globally (default: false) When enabled, configured guardrails can run for workflows that reference them

  Enable/disable guardrails globally (default: false) When enabled, configured guardrails can run for workflows that reference them

• HTTP_RESPONSE_HEADER_TIMEOUTTime to wait for response headers (default: 600)

  Time to wait for response headers (default: 600)

• HTTP_STREAM_IDLE_TIMEOUTLongest silence a streaming response may keep once its first bytes arrived (default: 300). A stalled stream is then closed with a 504 provider error instead of hanging until HTTP_TIMEOUT. The wait for the first token is not counted. Raise it only for providers that pause for minutes mid-stream; 0 disables it.

  Longest silence a streaming response may keep once its first bytes arrived (default: 300). A stalled stream is then closed with a 504 provider error instead of hanging until HTTP_TIMEOUT. The wait for the first token is not counted. Raise it only for providers that pause for minutes mid-stream; 0 disables it.

• HTTP_TIMEOUTHTTP Client Configuration (for upstream API requests) The standard HTTP_PROXY / HTTPS_PROXY / NO_PROXY variables route every upstream request; use <PROVIDER>_PROXY_URL (see the providers section) for one provider. Values in seconds (or Go duration format like "10m", "1h30m") Overall request timeout (default: 600 = 10 minutes, matches OpenAI/Anthropic SDKs)

  HTTP Client Configuration (for upstream API requests) The standard HTTP_PROXY / HTTPS_PROXY / NO_PROXY variables route every upstream request; use <PROVIDER>_PROXY_URL (see the providers section) for one provider. Values in seconds (or Go duration format like "10m", "1h30m") Overall request timeout (default: 600 = 10 minutes, matches OpenAI/Anthropic SDKs)

• JEV_API_KEYJev (TypeSafe System One decision API; default base URL: https://api.typesafe.ai) Jev models answer OpenAI Decisions requests at POST /v1/decisions (translated to System One) and System One requests natively at POST /v1/systemone (point the TypeSafe SDK at http://localhost:8080).

  Jev (TypeSafe System One decision API; default base URL: https://api.typesafe.ai) Jev models answer OpenAI Decisions requests at POST /v1/decisions (translated to System One) and System One requests natively at POST /v1/systemone (point the TypeSafe SDK at http://localhost:8080).

• JEV_BASE_URLA self-hosted Kev server (github.com/jaredpalmer/kev) speaks the same API and has no authentication of its own: set the base URL and leave the key unset.

  A self-hosted Kev server (github.com/jaredpalmer/kev) speaks the same API and has no authentication of its own: set the base URL and leave the key unset.

• KEEP_ONLY_ALIASES_AT_MODELS_ENDPOINTHide provider models from GET /v1/models and expose only enabled aliases (default: false).

  Hide provider models from GET /v1/models and expose only enabled aliases (default: false).

• KILO_API_KEYKilo AI Gateway (default base URL: https://api.kilo.ai/api/gateway) Model IDs use provider/model and pass through unchanged.

  Kilo AI Gateway (default base URL: https://api.kilo.ai/api/gateway) Model IDs use provider/model and pass through unchanged.

• KILO_BASE_URL
• KILO_MODELSOptional configured model list; see CONFIGURED_PROVIDER_MODELS_MODE below

  Optional configured model list; see CONFIGURED_PROVIDER_MODELS_MODE below

• KIMICODE_API_KEYKimi Code (OpenAI-compatible) Set the API key to enable. The base URL defaults to the Kimi Code endpoint.

  Kimi Code (OpenAI-compatible) Set the API key to enable. The base URL defaults to the Kimi Code endpoint.

• KIMICODE_BASE_URL
• KIMICODE_MODELSOptional configured model allowlist

  Optional configured model allowlist

• LITELLM_TAGS_ENABLEDLiteLLM tags (x-litellm-tags header, body "tags", list metadata.tags) become labels and are stripped before the provider; at most 32 per request, tags over 128 characters are dropped. Clients choose them, so they can charge any label budget they name: set false when label budgets must hold per team. When false, requests pass through with their tags untouched.

  LiteLLM tags (x-litellm-tags header, body "tags", list metadata.tags) become labels and are stripped before the provider; at most 32 per request, tags over 128 characters are dropped. Clients choose them, so they can charge any label budget they name: set false when label budgets must hold per team. When false, requests pass through with their tags untouched.

• LLAMACPP_API_KEYLLAMACPP_API_KEY is optional; set it only if llama-server was started with --api-key.

  LLAMACPP_API_KEY is optional; set it only if llama-server was started with --api-key.

• LLAMACPP_BASE_URLllama.cpp llama-server (also fits LM Studio and other OpenAI-compatible local servers) Base URL is required and enables the provider; include /v1.

  llama.cpp llama-server (also fits LM Studio and other OpenAI-compatible local servers) Base URL is required and enables the provider; include /v1.

• LLMD_API_KEYOptional bearer token if the Gateway in front of llm-d requires one.

  Optional bearer token if the Gateway in front of llm-d requires one.

• LLMD_BASE_URLllm-d Router / Endpoint Picker (EPP) The route is required and usually points to the EPP service. Include /v1.

  llm-d Router / Endpoint Picker (EPP) The route is required and usually points to the EPP service. Include /v1.

• LLMD_FAIRNESS_FROM_USER_PATHDerive the fairness ID from the effective user path (default: true).

  Derive the fairness ID from the effective user path (default: true).

• LLMD_INFERENCE_OBJECTIVEOptional trusted InferenceObjective name injected by GoModel.

  Optional trusted InferenceObjective name injected by GoModel.

• LLMD_MODELSOptional configured model list when GET /v1/models is not routed.

  Optional configured model list when GET /v1/models is not routed.

• LOG_FORMATLog output format: leave unset to auto-detect, or set to "json" / "text"

  Log output format: leave unset to auto-detect, or set to "json" / "text"

• LOGGING_BUFFER_SIZEIn-memory audit log queue capacity in entries/rows, not bytes (default: 1000) If the queue is full, new audit log entries are dropped with a warning

  In-memory audit log queue capacity in entries/rows, not bytes (default: 1000) If the queue is full, new audit log entries are dropped with a warning

• LOGGING_ENABLEDEnable/disable audit logging (default: true) When enabled, all requests and responses are logged to the configured storage

  Enable/disable audit logging (default: true) When enabled, all requests and responses are logged to the configured storage

• LOGGING_FLUSH_INTERVALHow often to flush buffered logs in seconds (default: 5) Logs are written at least every 5 seconds by default, and earlier when batches fill up

  How often to flush buffered logs in seconds (default: 5) Logs are written at least every 5 seconds by default, and earlier when batches fill up

• LOGGING_LOG_AUDIO_BODIESLog audio endpoint inputs/outputs: /v1/audio/speech text input + binary audio output (stored as base64 so the dashboard can play it back) and /v1/audio/transcriptions upload metadata. Requires LOGGING_LOG_BODIES=true (the master body-logging switch); when bodies are logged but this is off, audio responses are recorded as a lightweight placeholder instead of the full bytes. WARNING: stores full aud

  Log audio endpoint inputs/outputs: /v1/audio/speech text input + binary audio output (stored as base64 so the dashboard can play it back) and /v1/audio/transcriptions upload metadata. Requires LOGGING_LOG_BODIES=true (the master body-logging switch); when bodies are logged but this is off, audio responses are recorded as a lightweight placeholder instead of the full bytes. WARNING: stores full aud

• LOGGING_LOG_BODIESLog full request/response bodies (default: true) WARNING: May contain PII, API keys in prompts, or sensitive data

  Log full request/response bodies (default: true) WARNING: May contain PII, API keys in prompts, or sensitive data

• LOGGING_LOG_GUARDRAIL_STEPSRecord every prompt guardrail that edited a request as its own audit revision, carrying the request as that step left it (encoded off the request path). Set to false to record a chain's edits as one revision with the request as forwarded. (default: true)

  Record every prompt guardrail that edited a request as its own audit revision, carrying the request as that step left it (encoded off the request path). Set to false to record a chain's edits as one revision with the request as forwarded. (default: true)

• LOGGING_LOG_HEADERSLog request/response headers (default: true) Sensitive headers (Authorization, Cookie, etc.) are automatically redacted

  Log request/response headers (default: true) Sensitive headers (Authorization, Cookie, etc.) are automatically redacted

• LOGGING_LOG_IMAGE_BODIESLog image endpoint inputs/outputs: /v1/images/generations results and /v1/images/edits uploads (source images, masks) and results, stored as base64 so the dashboard can display them. Requires LOGGING_LOG_BODIES=true; when bodies are logged but this is off, image entries keep the prompt, parameters, usage, sizes and hosted URLs but not the pixels. WARNING: stores full images in the audit log and gr

  Log image endpoint inputs/outputs: /v1/images/generations results and /v1/images/edits uploads (source images, masks) and results, stored as base64 so the dashboard can display them. Requires LOGGING_LOG_BODIES=true; when bodies are logged but this is off, image entries keep the prompt, parameters, usage, sizes and hosted URLs but not the pixels. WARNING: stores full images in the audit log and gr

• LOGGING_LOG_IMAGE_BODIES_SCOPEWhich image bytes to store when LOGGING_LOG_IMAGE_BODIES=true: all (uploads and results), input (edit uploads only), output (results only) (default: all)

  Which image bytes to store when LOGGING_LOG_IMAGE_BODIES=true: all (uploads and results), input (edit uploads only), output (results only) (default: all)

• LOGGING_LOG_REVISION_BODIES=trueLog rewritten bodies from request rewriters and prompt guardrails

  Log rewritten bodies from request rewriters and prompt guardrails

• LOGGING_ONLY_MODEL_INTERACTIONSLog only model interactions, skip /health, /metrics, /admin endpoints (default: true)

  Log only model interactions, skip /health, /metrics, /admin endpoints (default: true)

• LOGGING_RETENTION_DAYSAuto-delete logs older than N days, 0 = keep forever (default: 30)

  Auto-delete logs older than N days, 0 = keep forever (default: 30)

• LOG_LEVELLog verbosity: "debug", "info" (default), "warn", or "error"

  Log verbosity: "debug", "info" (default), "warn", or "error"

• MASTER_KEY_DISABLEDTurn off master key authentication and leave managed gateway API keys, plus any configured authentication extension, as the only credentials (default: false). The master key is forgotten at startup, and the gateway requires a credential on every request: it never falls back to unauthenticated access, and the admin API stays gated instead of opening for bootstrap. Issue a credential with dashboard

  Turn off master key authentication and leave managed gateway API keys, plus any configured authentication extension, as the only credentials (default: false). The master key is forgotten at startup, and the gateway requires a credential on every request: it never falls back to unauthenticated access, and the admin API stays gated instead of opening for bootstrap. Issue a credential with dashboard

• MCP_ALLOWED_ORIGINSMCP_ALLOWED_ORIGINS is a comma-separated list of browser origins ("scheme://host[:port]") allowed to call /mcp. Default: none. MCP clients are not web pages, so refusing browsers outright is what blocks DNS rebinding — a rebound page's Origin and Host agree with each other, so comparing them proves nothing. Add an origin only if you serve an MCP web client from it. "*" trusts every origin and disa

  MCP_ALLOWED_ORIGINS is a comma-separated list of browser origins ("scheme://host[:port]") allowed to call /mcp. Default: none. MCP clients are not web pages, so refusing browsers outright is what blocks DNS rebinding — a rebound page's Origin and Host agree with each other, so comparing them proves nothing. Add an origin only if you serve an MCP web client from it. "*" trusts every origin and disa

• MCP_ENABLEDMCP gateway: aggregate upstream MCP (Model Context Protocol) servers behind the authenticated /mcp endpoint (default: true; a no-op until servers are declared here, in config.yaml under `mcp.servers`, or in the dashboard). Tools are namespaced as {server}_{tool}; /mcp/{server} exposes one upstream with original tool names.

  MCP gateway: aggregate upstream MCP (Model Context Protocol) servers behind the authenticated /mcp endpoint (default: true; a no-op until servers are declared here, in config.yaml under `mcp.servers`, or in the dashboard). Tools are namespaced as {server}_{tool}; /mcp/{server} exposes one upstream with original tool names.

• MCP_SERVERSMCP_SERVERS is a JSON object mapping server names to definitions; entries replace config.yaml `mcp.servers` entries with the same name and are read-only in the dashboard. Transports: "http" (streamable HTTP, default), "sse" (legacy), "stdio" (spawns a local subprocess — declarable only here or in config.yaml, never via the admin API, because runtime-registered subprocesses would be a code executio

  MCP_SERVERS is a JSON object mapping server names to definitions; entries replace config.yaml `mcp.servers` entries with the same name and are read-only in the dashboard. Transports: "http" (streamable HTTP, default), "sse" (legacy), "stdio" (spawns a local subprocess — declarable only here or in config.yaml, never via the admin API, because runtime-registered subprocesses would be a code executio

• MCP_TOOL_DISCOVERYMCP_TOOL_DISCOVERY: "off" (default) lists every tool; "search" lists only search_tools and call_tool, so large catalogs stop costing model context on every turn. Use it for clients without their own tool search. Clients override it with X-MCP-Tool-Discovery.

  MCP_TOOL_DISCOVERY: "off" (default) lists every tool; "search" lists only search_tools and call_tool, so large catalogs stop costing model context on every turn. Use it for clients without their own tool search. Clients override it with X-MCP-Tool-Discovery.

• MCP_VIRTUAL_SERVERSMCP_VIRTUAL_SERVERS is a JSON object mapping virtual server names to a subset of the servers above, each served at /mcp/{name} with namespaced tool names. Names must not match a server slug. Members keep their own user-path and tool rules; tool_discovery ("off" or "search") overrides MCP_TOOL_DISCOVERY for that endpoint.

  MCP_VIRTUAL_SERVERS is a JSON object mapping virtual server names to a subset of the servers above, each served at /mcp/{name} with namespaced tool names. Names must not match a server slug. Members keep their own user-path and tool rules; tool_discovery ("off" or "search") overrides MCP_TOOL_DISCOVERY for that endpoint.

• MEDIA_STORAGE_PATHDirectory for the filesystem backend. Default: ./data/media when a ./data directory exists, otherwise the OS per-user data directory. In containers mount a volume there; with several replicas use a shared mount (EFS, S3 FUSE). Files are retained as long as the audit entries that reference them (LOGGING_RETENTION_DAYS).

  Directory for the filesystem backend. Default: ./data/media when a ./data directory exists, otherwise the OS per-user data directory. In containers mount a volume there; with several replicas use a shared mount (EFS, S3 FUSE). Files are retained as long as the audit entries that reference them (LOGGING_RETENTION_DAYS).

• MEDIA_STORAGE_TYPEWhere media files go: audio and images captured for the audit log (LOGGING_LOG_AUDIO_BODIES / LOGGING_LOG_IMAGE_BODIES). Media metadata stays in the storage backend above; only the bytes are written here, so files stay out of the database and are not capped in size. "filesystem" (default) writes under MEDIA_STORAGE_PATH; "memory" keeps them in the process and loses them on restart.

  Where media files go: audio and images captured for the audit log (LOGGING_LOG_AUDIO_BODIES / LOGGING_LOG_IMAGE_BODIES). Media metadata stays in the storage backend above; only the bytes are written here, so files stay out of the database and are not capped in size. "filesystem" (default) writes under MEDIA_STORAGE_PATH; "memory" keeps them in the process and loses them on restart.

• META_API_KEYMeta Model API (Muse Spark, default base URL: https://api.meta.ai/v1)

  Meta Model API (Muse Spark, default base URL: https://api.meta.ai/v1)

• META_BASE_URL
• META_MODELSOptional configured model list; see CONFIGURED_PROVIDER_MODELS_MODE below

  Optional configured model list; see CONFIGURED_PROVIDER_MODELS_MODE below

• METRICS_ENABLEDMetrics Configuration (Prometheus) Enable/disable Prometheus metrics collection and /metrics endpoint

  Metrics Configuration (Prometheus) Enable/disable Prometheus metrics collection and /metrics endpoint

• METRICS_ENDPOINTCustom metrics endpoint path (default: /metrics)

  Custom metrics endpoint path (default: /metrics)

• MINIMAX_API_KEYMiniMax (global: https://api.minimax.io/v1; China: https://api.minimaxi.com/v1)

  MiniMax (global: https://api.minimax.io/v1; China: https://api.minimaxi.com/v1)

• MINIMAX_BASE_URL
• MODEL_LIST_URLExternal model metadata registry (provides pricing, capabilities, context window, etc.) Default: ENTERPILOT/ai-model-list on GitHub. Point this at an internal mirror, at a local file (/etc/gomodel/models.json or file:///etc/gomodel/models.json, re-read on each cache refresh), or set MODEL_LIST_URL=off to disable the catalog entirely -- models then keep provider-reported, configured, heuristic-deri

  External model metadata registry (provides pricing, capabilities, context window, etc.) Default: ENTERPILOT/ai-model-list on GitHub. Point this at an internal mirror, at a local file (/etc/gomodel/models.json or file:///etc/gomodel/models.json, re-read on each cache refresh), or set MODEL_LIST_URL=off to disable the catalog entirely -- models then keep provider-reported, configured, heuristic-deri

• MODELS_ENABLED_BY_DEFAULTModel Access Configuration Process-wide default for provider models when no persisted override exists (default: true) Set to false to keep models unavailable until a model override allows one or more user paths.

  Model Access Configuration Process-wide default for provider models when no persisted override exists (default: true) Set to false to keep models unavailable until a model override allows one or more user paths.

• MONGODB_DATABASEMONGODB_DATABASE overrides the database named in MONGODB_URL (default: gomodel)

  MONGODB_DATABASE overrides the database named in MONGODB_URL (default: gomodel)

• MONGODB_URLMongoDB Configuration (recommended for high-volume logging)

  MongoDB Configuration (recommended for high-volume logging)

• OLLAMA_API_KEYOllama (local LLM server) Note: Ollama doesn't require an API key, but one can be sent for secured deployments

  Ollama (local LLM server) Note: Ollama doesn't require an API key, but one can be sent for secured deployments

• OLLAMA_BASE_URLSet base URL to enable (default: http://localhost:11434/v1)

  Set base URL to enable (default: http://localhost:11434/v1)

• OPENAI_API_KEYOpenAI

  OpenAI

• OPENAI_API_KEY_2
• OPENAI_BASE_URL
• OPENAI_LMSTUDIO_API_KEY
• OPENAI_LMSTUDIO_BASE_URLLM Studio (local, OpenAI-compatible server) LM Studio speaks the OpenAI API (/v1/chat/completions, /v1/embeddings) and has NO native Ollama API. Attach it to the openai type via a suffix so it gets a descriptive name — here "openai-lmstudio". Do NOT use OLLAMA_BASE_URL for it: that routes embeddings to Ollama's native /api/embed, which LM Studio doesn't implement. The API key can be any non-empty

  LM Studio (local, OpenAI-compatible server) LM Studio speaks the OpenAI API (/v1/chat/completions, /v1/embeddings) and has NO native Ollama API. Attach it to the openai type via a suffix so it gets a descriptive name — here "openai-lmstudio". Do NOT use OLLAMA_BASE_URL for it: that routes embeddings to Ollama's native /api/embed, which LM Studio doesn't implement. The API key can be any non-empty

• OPENAI_LMSTUDIO_MODELSOptional: pin the served models (LM Studio only exposes loaded ones).

  Optional: pin the served models (LM Studio only exposes loaded ones).

• OPENAI_PROXY_URL
• OPENAI_SESSION_STICKY_KEYS
• OPENCODE_GO_API_KEYOpenCode Go (OpenCode Zen, default base URL: https://opencode.ai/zen/go/v1)

  OpenCode Go (OpenCode Zen, default base URL: https://opencode.ai/zen/go/v1)

• OPENCODE_GO_BASE_URL
• OPENCODE_GO_DEFAULT_REASONING_EFFORTReasoning effort injected when a client sends no reasoning parameter (default: low). Some models always think and reject requests that omit it. Accepts low, high, max; set to "none" (or "off") to inject nothing.

  Reasoning effort injected when a client sends no reasoning parameter (default: low). Some models always think and reject requests that omit it. Accepts low, high, max; set to "none" (or "off") to inject nothing.

• OPENCODE_GO_MESSAGES_MODELSModels that must be routed to the Anthropic-native /messages endpoint instead of /chat/completions (default: qwen3.7-max). Temporary manual split until upstream exposes per-model endpoint metadata.

  Models that must be routed to the Anthropic-native /messages endpoint instead of /chat/completions (default: qwen3.7-max). Temporary manual split until upstream exposes per-model endpoint metadata.

• OPENCODE_GO_MODELSOptional configured model list

  Optional configured model list

• OPENCODE_GO_SESSION_HEADERForward x-opencode-session (the client's own header, else the detected session id) so OpenCode Zen can keep one conversation's prompt cache warm. Upstream requires it; leave enabled unless asked otherwise (default: true).

  Forward x-opencode-session (the client's own header, else the detected session id) so OpenCode Zen can keep one conversation's prompt cache warm. Upstream requires it; leave enabled unless asked otherwise (default: true).

• OPENROUTER_API_KEYOpenRouter (default base URL: https://openrouter.ai/api/v1)

  OpenRouter (default base URL: https://openrouter.ai/api/v1)

• OPENROUTER_APP_NAME
• OPENROUTER_BASE_URL
• OPENROUTER_MODEL_FILTER_EXCLUDE
• OPENROUTER_MODEL_FILTER_INCLUDENarrow a provider's model inventory to what you actually want routable. Applied to the final inventory, so it also narrows models added by <PROVIDER>_MODELS. Patterns are comma-separated globs matched case-insensitively against the raw model ID: `*` matches any run of characters (including `/`, so `*:free` matches `deepseek/deepseek-r1:free`) and `?` matches exactly one. INCLUDE keeps only matchin

  Narrow a provider's model inventory to what you actually want routable. Applied to the final inventory, so it also narrows models added by <PROVIDER>_MODELS. Patterns are comma-separated globs matched case-insensitively against the raw model ID: `*` matches any run of characters (including `/`, so `*:free` matches `deepseek/deepseek-r1:free`) and `?` matches exactly one. INCLUDE keeps only matchin

• OPENROUTER_MODEL_FILTER_MAX_PRICE_PER_MTOK
• OPENROUTER_MODELSOptional configured model list; see CONFIGURED_PROVIDER_MODELS_MODE below

  Optional configured model list; see CONFIGURED_PROVIDER_MODELS_MODE below

• OPENROUTER_SITE_URL
• ORACLE_API_KEYOracle

  Oracle

• ORACLE_BASE_URL
• ORACLE_MODELSOptional configured model list; comma-separated, whitespace around entries is ignored

  Optional configured model list; comma-separated, whitespace around entries is ignored

• OTEL_ENABLEDOpenTelemetry Configuration Export traces and metrics over OTLP. Exporter endpoint, protocol, headers, resource attributes, sampling, and propagation use the standard OTEL_* variables.

  OpenTelemetry Configuration Export traces and metrics over OTLP. Exporter endpoint, protocol, headers, resource attributes, sampling, and propagation use the standard OTEL_* variables.

• OTEL_EXPORTER_OTLP_ENDPOINT
• OTEL_EXPORTER_OTLP_PROTOCOL
• OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENTRecord prompts and completions on provider call spans (default: false). Content then leaves the gateway with every exported trace.

  Record prompts and completions on provider call spans (default: false). Content then leaves the gateway with every exported trace.

• OTEL_METRICS_EXPORTER
• OTEL_PROPAGATORS
• OTEL_SERVICE_NAME
• OTEL_TRACES_EXPORTER
• PID_FILEWhere the running gateway records its process id so `gomodel --reload` can find it (default: data/gomodel.pid next to a ./data directory, otherwise the per-user data directory). Set it per instance when several gateways share a host. Leaving this empty means "unset" and keeps the default, as everywhere else here; to write no pid file at all (which also disables --reload), set `server.pid_file: ""`

  Where the running gateway records its process id so `gomodel --reload` can find it (default: data/gomodel.pid next to a ./data directory, otherwise the per-user data directory). Set it per instance when several gateways share a host. Leaving this empty means "unset" and keeps the default, as everywhere else here; to write no pid file at all (which also disables --reload), set `server.pid_file: ""`

• PLUGINS_ENABLEDEnable the plugin system (default: false): built-in and loaded plugin types, guardrails built from them, routing-strategy plugins for virtual models, and the /admin/plugins and /admin/guardrails endpoints. GUARDRAILS_ENABLED=true enables it implicitly.

  Enable the plugin system (default: false): built-in and loaded plugin types, guardrails built from them, routing-strategy plugins for virtual models, and the /admin/plugins and /admin/guardrails endpoints. GUARDRAILS_ENABLED=true enables it implicitly.

• PLUGINS_LOADPlugin shared objects to load at startup (comma-separated; each file is relative to a PLUGINS_SEARCH_PATHS directory, or absolute). A relative file must resolve inside one of the PLUGINS_SEARCH_PATHS directories; the first match wins. Absolute file paths are used as-is. Each entry is optionally "file=sha256hex" to pin the digest. Only the final "=" followed by exactly 64 hex characters starts a di

  Plugin shared objects to load at startup (comma-separated; each file is relative to a PLUGINS_SEARCH_PATHS directory, or absolute). A relative file must resolve inside one of the PLUGINS_SEARCH_PATHS directories; the first match wins. Absolute file paths are used as-is. Each entry is optionally "file=sha256hex" to pin the digest. Only the final "=" followed by exactly 64 hex characters starts a di

• PLUGINS_SEARCH_PATHSDirectories searched for relative plugin .so files (comma-separated). Default: empty (no .so loading). Guardrail instances are built from plugins (built-in or loaded); see config.example.yaml.

  Directories searched for relative plugin .so files (comma-separated). Default: empty (no .so loading). Guardrail instances are built from plugins (built-in or loaded); see config.example.yaml.

• PORTServer Configuration

  Server Configuration

• POSTGRES_MAX_CONNS
• POSTGRES_URLPostgreSQL Configuration (for multi-instance deployments)

  PostgreSQL Configuration (for multi-instance deployments)

• PPROF_ENABLEDEnable/disable pprof profiling routes at /debug/pprof/* (default: false)

  Enable/disable pprof profiling routes at /debug/pprof/* (default: false)

• PROVIDER_PROMPT_CACHE_PLANNER_ENABLEDAdd provider-native prompt-cache keys, breakpoints, and cached-content plans after routing (default: true). Set false as an operational kill switch; empty or invalid values keep the default. Client cache directives still pass through.

  Add provider-native prompt-cache keys, breakpoints, and cached-content plans after routing (default: true). Set false as an operational kill switch; empty or invalid values keep the default. Client cache directives still pass through.

• PROVIDER_RECHECK_INTERVALHow often to re-probe only the providers whose last refresh failed, in seconds (default: 60, 0 disables). Detects provider recovery without waiting for the next full refresh.

  How often to re-probe only the providers whose last refresh failed, in seconds (default: 60, 0 disables). Detects provider recovery without waiting for the next full refresh.

• RATE_LIMITS_ENABLEDRate Limits Cap requests, tokens, and in-flight concurrency per user_path subtree. Breaches return 429 with Retry-After and x-ratelimit-* headers. Request and token windows are snapshotted to the configured store (default every 1s) so they survive restart and --reload. Concurrency gauges stay in-memory. Token limits (tpm/tph/tpd) additionally require USAGE_ENABLED=true. Enabled by default; with no

  Rate Limits Cap requests, tokens, and in-flight concurrency per user_path subtree. Breaches return 429 with Retry-After and x-ratelimit-* headers. Request and token windows are snapshotted to the configured store (default every 1s) so they survive restart and --reload. Concurrency gauges stay in-memory. Token limits (tpm/tph/tpd) additionally require USAGE_ENABLED=true. Enabled by default; with no

• RATE_LIMITS_FLUSH_INTERVAL
• REALTIME_ENABLEDEnable the realtime (speech-to-speech) endpoints (default: true): the /v1/realtime websocket (and /p/{provider}/v1/realtime passthrough upgrade), the WebRTC SDP exchange at POST /v1/realtime/calls, and ephemeral browser credentials at POST /v1/realtime/client_secrets. Speech translation models (OpenAI gpt-realtime-translate) use the same three endpoints under /v1/realtime/translations, equivalent

  Enable the realtime (speech-to-speech) endpoints (default: true): the /v1/realtime websocket (and /p/{provider}/v1/realtime passthrough upgrade), the WebRTC SDP exchange at POST /v1/realtime/calls, and ephemeral browser credentials at POST /v1/realtime/client_secrets. Speech translation models (OpenAI gpt-realtime-translate) use the same three endpoints under /v1/realtime/translations, equivalent

• REDIS_KEY_MODELS
• REDIS_KEY_RESPONSES
• REDIS_TTL_MODELS
• REDIS_TTL_RESPONSES
• REDIS_URLRedis Configuration

  Redis Configuration

• RESPONSE_CACHE_SIMPLE_ENABLEDOpt-in when config.yaml has no cache.response.simple block (e.g. env-only deploys). Omit otherwise.

  Opt-in when config.yaml has no cache.response.simple block (e.g. env-only deploys). Omit otherwise.

• RETRY_BACKOFF_FACTORExponential backoff factor (default: 2.0)

  Exponential backoff factor (default: 2.0)

• RETRY_INITIAL_BACKOFFInitial retry backoff duration (default: 1s)

  Initial retry backoff duration (default: 1s)

• RETRY_JITTER_FACTORRandom jitter factor applied to retry delays (default: 0.1)

  Random jitter factor applied to retry delays (default: 0.1)

• RETRY_MAX_BACKOFFMaximum retry backoff duration (default: 30s)

  Maximum retry backoff duration (default: 30s)

• RETRY_MAX_RETRIESLLM Client Resilience Configuration Retry attempts for upstream provider calls (default: 3)

  LLM Client Resilience Configuration Retry attempts for upstream provider calls (default: 3)

• SEMANTIC_CACHE_EMBEDDER_MODELOptional embedding model override

  Optional embedding model override

• SEMANTIC_CACHE_EMBEDDER_PROVIDEREmbedding provider name used for semantic cache

  Embedding provider name used for semantic cache

• SEMANTIC_CACHE_ENABLEDOpt-in when config.yaml has no cache.response.semantic block (e.g. env-only deploys). Omit otherwise.

  Opt-in when config.yaml has no cache.response.semantic block (e.g. env-only deploys). Omit otherwise.

• SEMANTIC_CACHE_EXCLUDE_SYSTEM_PROMPTExclude the system prompt from semantic cache keys (default: false)

  Exclude the system prompt from semantic cache keys (default: false)

• SEMANTIC_CACHE_MAX_CONV_MESSAGESNumber of recent conversation messages to embed (default: 3)

  Number of recent conversation messages to embed (default: 3)

• SEMANTIC_CACHE_PGVECTOR_DIMENSION
• SEMANTIC_CACHE_PGVECTOR_TABLE
• SEMANTIC_CACHE_PGVECTOR_URLpgvector

  pgvector

• SEMANTIC_CACHE_PINECONE_API_KEY
• SEMANTIC_CACHE_PINECONE_DIMENSION
• SEMANTIC_CACHE_PINECONE_HOSTPinecone

  Pinecone

• SEMANTIC_CACHE_PINECONE_NAMESPACE
• SEMANTIC_CACHE_QDRANT_API_KEY
• SEMANTIC_CACHE_QDRANT_COLLECTION
• SEMANTIC_CACHE_QDRANT_URLQdrant

  Qdrant

• SEMANTIC_CACHE_THRESHOLDSimilarity threshold between 0 and 1 (default: 0.92)

  Similarity threshold between 0 and 1 (default: 0.92)

• SEMANTIC_CACHE_TTLSemantic cache entry TTL in seconds (default: 3600)

  Semantic cache entry TTL in seconds (default: 3600)

• SEMANTIC_CACHE_VECTOR_STORE_TYPEVector store backend: qdrant, pgvector, pinecone, or weaviate

  Vector store backend: qdrant, pgvector, pinecone, or weaviate

• SEMANTIC_CACHE_WEAVIATE_API_KEY
• SEMANTIC_CACHE_WEAVIATE_CLASS
• SEMANTIC_CACHE_WEAVIATE_URLWeaviate

  Weaviate

• SERVER_CLIENT_IP_HEADERHeader a trusted proxy passes the client address in (default: X-Forwarded-For). X-Forwarded-For carries a chain and is resolved hop by hop; any other header (X-Real-IP, CF-Connecting-IP, True-Client-IP) carries one address and is taken verbatim, which is what you want behind Cloudflare or a cloud load balancer that writes the client itself. Requires SERVER_TRUSTED_PROXIES. RFC 7239 Forwarded is no

  Header a trusted proxy passes the client address in (default: X-Forwarded-For). X-Forwarded-For carries a chain and is resolved hop by hop; any other header (X-Real-IP, CF-Connecting-IP, True-Client-IP) carries one address and is taken verbatim, which is what you want behind Cloudflare or a cloud load balancer that writes the client itself. Requires SERVER_TRUSTED_PROXIES. RFC 7239 Forwarded is no

• SERVER_TRUSTED_HOPSHow many proxies sit between the client and the gateway (default: 0). With 0, the X-Forwarded-For chain is scanned for the nearest hop outside SERVER_TRUSTED_PROXIES. Set it when your edge is at a fixed depth but rotates through addresses you cannot enumerate: the entry at that depth is taken, the socket peer must still be trusted, and a shorter chain falls back to the socket peer.

  How many proxies sit between the client and the gateway (default: 0). With 0, the X-Forwarded-For chain is scanned for the nearest hop outside SERVER_TRUSTED_PROXIES. Set it when your edge is at a fixed depth but rotates through addresses you cannot enumerate: the entry at that depth is taken, the socket peer must still be trusted, and a shorter chain falls back to the socket peer.

• SERVER_TRUSTED_PROXIESNetworks your own proxies sit on, comma-separated (default: empty, headers ignored). Until this is set, every client address GoModel reports (audit entries, rate limit keys, logs) is the socket peer, and forwarding headers are ignored. Entries are CIDR networks, bare addresses (a single host), or the presets "loopback" and "private" (RFC 1918 + ULA). Nothing is trusted implicitly: list the hops be

  Networks your own proxies sit on, comma-separated (default: empty, headers ignored). Until this is set, every client address GoModel reports (audit entries, rate limit keys, logs) is the socket peer, and forwarding headers are ignored. Entries are CIDR networks, bare addresses (a single host), or the presets "loopback" and "private" (RFC 1918 + ULA). Nothing is trusted implicitly: list the hops be

• SESSION_AUTO_DETECT
• SESSION_BUILTIN_RULES
• SESSION_HEADER_1
• SESSION_HEADER_1_TRANSFORM
• SESSION_KEEPING_ENABLEDSession keeping: identify which requests belong to one client session, for sticky virtual-model load balancing and audit-log session grouping. On by default with a built-in registry of session headers/body fields known coding tools send (Claude Code, Codex CLI, OpenCode, Kilo Code, Goose, …) plus content-based auto-detection for untagged chat requests. Extra headers are numbered from 1 and merged

  Session keeping: identify which requests belong to one client session, for sticky virtual-model load balancing and audit-log session grouping. On by default with a built-in registry of session headers/body fields known coding tools send (Claude Code, Codex CLI, OpenCode, Kilo Code, Goose, …) plus content-based auto-detection for untagged chat requests. Extra headers are numbered from 1 and merged

• SET_BUDGET_=(empty)Seed budget limits for a user path, such as daily=10

  Seed budget limits for a user path, such as daily=10

• SET_BUDGET_USER__PATH__EXAMPLEEnv equivalent:

  Env equivalent:

• SET_PROVIDER_BUDGET_=(empty)Seed budget limits for a provider instance, such as daily=100

  Seed budget limits for a provider instance, such as daily=100

• SET_PROVIDER_BUDGET_OPENAI_PRODCap one provider's spend across all consumers with SET_PROVIDER_BUDGET_<NAME> (hourly/daily/weekly/monthly amounts, like SET_BUDGET_*; underscores in the suffix become hyphens). Failover skips a provider whose budget is spent. Requires BUDGETS_ENABLED and USAGE_ENABLED.

  Cap one provider's spend across all consumers with SET_PROVIDER_BUDGET_<NAME> (hourly/daily/weekly/monthly amounts, like SET_BUDGET_*; underscores in the suffix become hyphens). Failover skips a provider whose budget is spent. Requires BUDGETS_ENABLED and USAGE_ENABLED.

• SET_PROVIDER_RATE_LIMIT_OPENAICap one provider across all consumers and models with SET_PROVIDER_RATE_LIMIT_<NAME> (same rpm/tpm/... syntax; underscores in the suffix become hyphens like provider-instance env vars). Load balancing and failover skip a saturated provider while another target has capacity. Per-model rules have no env form; declare them under rate_limits.models in config.yaml or via the admin API/dashboard.

  Cap one provider across all consumers and models with SET_PROVIDER_RATE_LIMIT_<NAME> (same rpm/tpm/... syntax; underscores in the suffix become hyphens like provider-instance env vars). Load balancing and failover skip a saturated provider while another target has capacity. Per-model rules have no env form; declare them under rate_limits.models in config.yaml or via the admin API/dashboard.

• SET_RATE_LIMIT_
• SET_RATE_LIMIT_TEAM__ALPHADeclare rules per user path with SET_RATE_LIMIT_<PATH> (double underscores separate path segments, like SET_BUDGET_*). Names: rpm/tpm (per minute), rph/tph (per hour), rpd/tpd (per day), concurrent (max in-flight requests). A JSON array of {period|period_seconds, max_requests, max_tokens} objects is also accepted for custom windows.

  Declare rules per user path with SET_RATE_LIMIT_<PATH> (double underscores separate path segments, like SET_BUDGET_*). Names: rpm/tpm (per minute), rph/tph (per hour), rpd/tpd (per day), concurrent (max in-flight requests). A JSON array of {period|period_seconds, max_requests, max_tokens} objects is also accepted for custom windows.

• SET_RATE_LIMIT_USER__PATH__EXAMPLEEnv equivalent:

  Env equivalent:

• SGLANG_API_KEYSGLang (OpenAI-compatible server) SGLANG_API_KEY is optional; set it only if launch_server uses --api-key.

  SGLang (OpenAI-compatible server) SGLANG_API_KEY is optional; set it only if launch_server uses --api-key.

• SGLANG_BASE_URLSet base URL to enable (default: http://localhost:30000/v1)

  Set base URL to enable (default: http://localhost:30000/v1)

• SQLITE_PATHSQLite Configuration (default, good for single instance) Default: ./data/gomodel.db when a ./data directory exists, otherwise the OS per-user data directory (~/.local/share/gomodel, ~/Library/Application Support/gomodel, %LocalAppData%\gomodel)

  SQLite Configuration (default, good for single instance) Default: ./data/gomodel.db when a ./data directory exists, otherwise the OS per-user data directory (~/.local/share/gomodel, ~/Library/Application Support/gomodel, %LocalAppData%\gomodel)

• STORAGE_TYPEStorage type: "sqlite" (default), "postgresql", or "mongodb" This determines where both audit logs and usage data are stored

  Storage type: "sqlite" (default), "postgresql", or "mongodb" This determines where both audit logs and usage data are stored

• STREAM_STALL_TIMEOUTHow long one response write on a model route may wait for the client to read it, in seconds (default: 60). Fires only when a client stops reading a response, never while the provider is slow, and frees the goroutine and upstream connection that client would otherwise hold. 0 disables it. Raise it for clients that legitimately pause reading a stream for over a minute.

  How long one response write on a model route may wait for the client to read it, in seconds (default: 60). Fires only when a client stops reading a response, never while the provider is slow, and frees the goroutine and upstream connection that client would otherwise hold. 0 disables it. Raise it for clients that legitimately pause reading a stream for over a minute.

• SWAGGER_ENABLEDEnable/disable Swagger UI at /swagger/index.html (default: false) Requires a binary built with -tags=swagger; see docs/advanced/swagger-ui.mdx

  Enable/disable Swagger UI at /swagger/index.html (default: false) Requires a binary built with -tags=swagger; see docs/advanced/swagger-ui.mdx

• TAGGING_HEADER_1Tagging based on headers: label every request from the listed headers (numbered from 1). Labels are recorded in usage tracking and audit logs. A header value can carry several labels split by the delimiter (default: ","). The optional prefix is trimmed from each extracted label only — the header itself is forwarded unchanged unless DONOTPASS=true. An env entry replaces the whole config.yaml `taggi

  Tagging based on headers: label every request from the listed headers (numbered from 1). Labels are recorded in usage tracking and audit logs. A header value can carry several labels split by the delimiter (default: ","). The optional prefix is trimmed from each extracted label only — the header itself is forwarded unchanged unless DONOTPASS=true. An env entry replaces the whole config.yaml `taggi

• TAGGING_HEADER_1_DELIMITER
• TAGGING_HEADER_1_DONOTPASS
• TAGGING_HEADER_1_PREFIX
• TAGGING_HEADER_2
• TAGGING_HEADER_2_DONOTPASS
• UNQUALIFIED_MODEL_IDS_AT_MODELS_ENDPOINTReturn bare model IDs from GET /v1/models (gpt-5) instead of provider-qualified ones (openai/gpt-5) (default: false). Useful for clients that validate the requested model against the list and only know plain names. Caveat: when two providers expose the same model ID, only the provider an unqualified request routes to (the first registered one) is listed. Pin a name to a specific provider with a vi

  Return bare model IDs from GET /v1/models (gpt-5) instead of provider-qualified ones (openai/gpt-5) (default: false). Useful for clients that validate the requested model against the list and only know plain names. Caveat: when two providers expose the same model ID, only the provider an unqualified request routes to (the first registered one) is listed. Pin a name to a specific provider with a vi

• USAGE_BUFFER_SIZEIn-memory buffer size before flushing to storage (default: 1000)

  In-memory buffer size before flushing to storage (default: 1000)

• USAGE_ENABLEDEnable/disable token usage tracking (default: true) When enabled, token usage is tracked separately from audit logs

  Enable/disable token usage tracking (default: true) When enabled, token usage is tracked separately from audit logs

• USAGE_FLUSH_INTERVALHow often to flush buffered usage entries in seconds (default: 5)

  How often to flush buffered usage entries in seconds (default: 5)

• USAGE_PRICING_RECALCULATION_ENABLEDEnable/disable the admin usage pricing recalculation action (default: true) Requires USAGE_ENABLED=true and supported storage; false always hides/blocks it

  Enable/disable the admin usage pricing recalculation action (default: true) Requires USAGE_ENABLED=true and supported storage; false always hides/blocks it

• USAGE_RETENTION_DAYSAuto-delete usage data older than N days, 0 = keep forever (default: 90)

  Auto-delete usage data older than N days, 0 = keep forever (default: 90)

• USE_GOOGLE_GEMINI_NATIVE_APIUse Gemini's native APIs (default: true): generateContent for chat/responses and image models, batchEmbedContents for embeddings, predict for Imagen (Vertex backend; Google retired Imagen from the AI Studio API in Aug 2026). Set to false to use Gemini's OpenAI-compatible API instead (image edits are then unavailable; the OpenAI-compatible surface has no edits endpoint). Native mode supports inline

  Use Gemini's native APIs (default: true): generateContent for chat/responses and image models, batchEmbedContents for embeddings, predict for Imagen (Vertex backend; Google retired Imagen from the AI Studio API in Aug 2026). Set to false to use Gemini's OpenAI-compatible API instead (image edits are then unavailable; the OpenAI-compatible surface has no edits endpoint). Native mode supports inline

• USER_PATH_HEADERHeader used to read/write request user_path values (default: X-GoModel-User-Path)

  Header used to read/write request user_path values (default: X-GoModel-User-Path)

• USERSUsers: per user-path model allowlists as a JSON array (same entries as `users:` in config.yaml). Each entry: path, allowed_models (provider/*, provider/model, or bare model id), description. A node with no list allows every model; lists intersect down the tree so a child can only narrow its group. Declared entries are read-only in the dashboard.

  Users: per user-path model allowlists as a JSON array (same entries as `users:` in config.yaml). Each entry: path, allowed_models (provider/*, provider/model, or bare model id), description. A node with no list allows every model; lists intersect down the tree so a child can only narrow its group. Declared entries are read-only in the dashboard.

• VIRTUAL_MODELSVirtual models as infrastructure-as-code (JSON array). Declares redirects, load balancers, and access policies; overrides admin-store rows with the same source and is read-only in the dashboard. The same entries can be declared under `virtual_models:` in config.yaml. Each entry: source, target (single) or targets[] (load balanced), strategy (round_robin | cost | failover), user_paths, slowdown (0

  Virtual models as infrastructure-as-code (JSON array). Declares redirects, load balancers, and access policies; overrides admin-store rows with the same source and is read-only in the dashboard. The same entries can be declared under `virtual_models:` in config.yaml. Each entry: source, target (single) or targets[] (load balanced), strategy (round_robin | cost | failover), user_paths, slowdown (0

• VLLM_API_KEYvLLM (OpenAI-compatible server) VLLM_API_KEY is optional; set it only if vllm serve was started with --api-key.

  vLLM (OpenAI-compatible server) VLLM_API_KEY is optional; set it only if vllm serve was started with --api-key.

• VLLM_BASE_URLSet base URL to enable (default: http://localhost:8000/v1)

  Set base URL to enable (default: http://localhost:8000/v1)

• WORKFLOW_REFRESH_INTERVALHow often to refresh persisted workflows from storage (default: 1m)

  How often to refresh persisted workflows from storage (default: 1m)

• XAI_API_KEYxAI (Grok)

  xAI (Grok)

• XAI_BASE_URL
• XIAOMI_API_KEYXiaomi MiMo (default base URL: https://api.xiaomimimo.com/v1)

  Xiaomi MiMo (default base URL: https://api.xiaomimimo.com/v1)

• XIAOMI_BASE_URL
• XIAOMI_MODELSOptional configured model list; [1m] variants enable 1M context

  Optional configured model list; [1m] variants enable 1M context

• ZAI_API_KEYZ.ai (default base URL: https://api.z.ai/api/paas/v4) For GLM Coding Plan, use: https://api.z.ai/api/coding/paas/v4

  Z.ai (default base URL: https://api.z.ai/api/paas/v4) For GLM Coding Plan, use: https://api.z.ai/api/coding/paas/v4

• ZAI_BASE_URL