Requesting support for basic auth or API key authentication

[sebiweise]

It would be great to have some sort of authentication in front of the ollama api. Currently I´m using Nginx Proxy Manager to add a Access List to prevent unauthorized access but a standard way implemented into Ollama itself would be great for all developers that are integrating Ollama into there software.

[priamai]

Please that will be fantastic!

[johnnyq]

Yes I'm also looking for API Key Support, were currently working on the integration with Ollama with our opensource project ITFlow and it would be a life saver. Thanks

[d3cline]

I read #849 but this should be baked into the main app imo, as others have stated its better for standardization.

[tweedge]

+1, IMHO Ollama should offer some sort of simple, native authentication. While I understand that the team is designing around local access, publicly accessible Ollama instances are already showing up on the internet.

• https://www.shodan.io/search?query=%22Ollama+is+running%22
• https://search.censys.io/search?resource=hosts&sort=RELEVANCE&per_page=25&virtual_hosts=EXCLUDE&q=%22Ollama+is+running%22

Edit: and software using Ollama is encouraging people to make their instances internet-accessible

• https://github.com/sugarforever/chat-ollama/blob/main/pages/index.vue#L12-14

[AnthonMS]

@sebiweise Can you provide the nginx config for proxying the traffic to ollama? I am new to the world of nginx and proxy servers, but really want this set up with some basic authentication and I have nginx serving other services already. Sorry if I'm inconveniencing.

For example, I have ollama running on the host 192.168.1.100 and nginx running on host 192.168.1.200

I have tried with some basic configs like these

server {
    listen 11434;

    location / {
        auth_basic "Restricted Content";
        auth_basic_user_file /etc/nginx/.htpasswd;

        proxy_pass http://192.168.1.100:11434;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

But I am not getting a connection. I have set the OLLAMA_HOST variable on the host running that, to be 0.0.0.0 and I can connect to it on the local network by going to it's IP and port.

[p-try]

@sebiweise This doesn't look too bad. But:

• You use the same port for nginx and ollama which doesn't work. Change the "listen" directive to another port, e.g. 11435. You may also reset OLLAMA_HOST to the original value (as it will only receive connections from localhost once the proxy is set up).
• Basic Auth will probably not work with most API clients. Instead, use JWT authentication.

[Kavan72]

@sebiweise This doesn't look too bad. But:

• You use the same port for nginx and ollama which doesn't work. Change the "listen" directive to another port, e.g. 11435. You may also reset OLLAMA_HOST to the original value (as it will only receive connections from localhost once the proxy is set up).
• Basic Auth will probably not work with most API clients. Instead, use JWT authentication.

or just a basic API key, similar to how OpenAI uses authentication on their client.

[AnthonMS]

@sebiweise This doesn't look too bad. But:

• You use the same port for nginx and ollama which doesn't work. Change the "listen" directive to another port, e.g. 11435. You may also reset OLLAMA_HOST to the original value (as it will only receive connections from localhost once the proxy is set up).
• Basic Auth will probably not work with most API clients. Instead, use JWT authentication.

I use the same port on 2 different host machines, correct. So the ollama service is not running on the same host as the nginx is. So this is fine.

[bartolli]

I spent a few days trying to get the Ollama Go server to work with native api_key authentication but had no luck. So, I ended up making a Docker image with a Caddy server to securely handle authentication and proxy requests to a local Ollama instance. There are two methods, environment-based API key validation or multiple API keys stored in .conf file for better security. Check out these repos.

Uses OLLAMA_API_KEY as a local environment variable:
https://github.com/bartolli/ollama-bearer-auth

If you want to support multiple API keys stored in a config file, check out this repo:
https://github.com/bartolli/ollama-bearer-auth-caddy.

[PyroGenesis]

Sharing my nginx configuration to expose Ollama over the web with an API Key and HTTPS:

    upstream ollama {
        server               localhost:11434;
    }

    server {
        listen              8000 ssl;
        server_name         ollama.mydomain.com;

        # for ssl
        ssl_certificate     "path/to/cert.crt";
        ssl_certificate_key "path/to/private.key";
        ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers         HIGH:!aNULL:!MD5;

        location / {
            # Check if the Authorization header is present and has the correct Bearer token / API Key
            set $token "Bearer MY_PRIVATE_API_KEY";
            if ($http_authorization != $token) {
                return 401 "Unauthorized";
            }
            
            # The localhost headers are to simulate the forwarded request as coming from localhost
            # because I didn't want to set the Ollama origins as *
            proxy_set_header  Host "localhost";
            proxy_set_header  X-Real-IP "127.0.0.1";
            proxy_set_header  X-Forwarded-For "127.0.0.1";
            proxy_set_header  X-Forwarded-Proto $scheme;
            proxy_pass        http://ollama;  # Forward request to the actual web service
        }
    }

[neuhaus]

@AnthonMS don't use this line in your nginx host configuration file:

    proxy_set_header Host $host;

instead use this line:

    proxy_set_header Host localhost:11434;

Works for me.