Your local Ollama has no API key. Here’s how to require one (Caddy or nginx) and still use Open WebUI, n8n and OpenAI clients

Description and use

The recipe secures a local Ollama instance by requiring a bearer token via a reverse proxy (Caddy or nginx), while keeping compatibility with OpenAI‑style clients.

Problem

Ollama’s local API on port 11434 is unauthenticated, exposing GPU resources to any host that can reach the port when OLLAMA_HOST is set to 0.0.0.0.

Outcome

The recipe enables secure access to a local Ollama instance by requiring a bearer token via a reverse proxy, preventing unauthorized use while maintaining compatibility with existing OpenAI‑style clients.

Workflow

• Generate a 32‑byte hex key with openssl rand -hex 32
• Configure Caddy or nginx to listen on a public domain and proxy to 127.0.0.1:11434
• Set the proxy to match the Authorization header exactly and reject others with 401
• Strip the Authorization header before forwarding to Ollama
• Test the proxy with curl to confirm 401 on missing key and success on correct key
• Verify that external access to 127.0.0.1:11434 fails when the proxy is active
• Configure n8n, Open WebUI, OpenAI SDK, and ollama‑python to use the proxy URL and the generated key

Evidence

The local API at http://localhost:11434 does not require authentication.

Source

From then on, anyone who can reach port 11434 can run prompts on your GPU and pull, create or delete models.

Source

The Caddyfile now holds a secret, so make it readable only by root and Caddy.

Source