Your LiteLLM master key is also your admin UI password: a hardening checklist for self-hosted LiteLLM

Description and use

The checklist mitigates privilege escalation, protects stored credentials, and limits exposure of administrative interfaces, enhancing the security posture of a self-hosted LiteLLM deployment.

Problem

A self-hosted LiteLLM proxy can expose sensitive credentials and administrative access through default configurations, leading to potential privilege escalation and data leakage.

Outcome

The checklist mitigates privilege escalation, protects stored credentials, and limits exposure of administrative interfaces, enhancing the security posture of a self-hosted LiteLLM deployment.

Workflow

• 1. Update LiteLLM to the latest release (1.105.0).
• 2. Create a dedicated proxy_admin user with a unique password in the UI and verify login.
• 3. Set environment variables: LITELLM_MASTER_KEY, LITELLM_SALT_KEY, disable_env_credential_login=true, EXPERIMENTAL_UI_LOGIN=false, LITELLM_ENABLE_MCP_STDIO=false.
• 4. Generate and store the master and salt keys before adding any models: `printf 'LITELLM_MASTER_KEY=sk-%s LITELLM_SALT_KEY=sk-%s ' "$(openssl rand -hex 32)" "$(openssl rand -hex 32)" > .env && chmod 600 .env`
• 5. Bind the CLI to localhost: litellm --host 127.0.0.1 --port 4000 or Docker -p 127.0.0.1:4000:4000.
• 6. Configure a reverse proxy (e.g., Nginx) to expose only the model API routes and keep /ui and management routes internal.
• 7. Test the configuration: ensure /v1/models returns 401 without a key, /ui returns 404 from outside, and health endpoints are inaccessible from external networks.

Evidence

If UI_PASSWORD is unset, "the master key itself is accepted as the password", and anyone who signs in that way is a proxy admin.

Source

The proxy used one key both to encrypt stored secrets and to mint session tokens, so a "secret" you asked it to encrypt came back as a valid admin token.

Source

If you skip the first step, you lock yourself out of the UI.

Source

The litellm CLI's --host defaults to 0.0.0.0. Bind it to 127.0.0.1

Source