How do I secure OpenAI-compatible API?

Require an API key / master key on the proxy, or put it behind an authenticating reverse proxy with TLS.

← what I check

EXPOSURE OpenAI-compatible API
SEVERITY HIGH
PROBE GET :443/v1/models

HIGH

Is your OpenAI-compatible API exposed?

Q: How many OpenAI-compatible API instances are exposed?

The population estimate for OpenAI-compatible API is still collecting on the census.

Anonymous /v1/models: model listing and usually inference without naming the product (incl. OpenRouter-shaped proxies).

Scan a host you own → Fix card Census

Why it matters

An anonymous /v1/models (and usually /v1/chat/completions) surface lets strangers inventory models and burn inference — whether the backend is vLLM-shaped, a LiteLLM/OpenRouter-style proxy, or another OpenAI-compatible server we have not named yet.

How common is it?

A published population estimate for OpenAI-compatible API is still collecting. See the census methodology.

Counts are population-level, from third-party indexes and my own honeypots. I never scan the internet and this page makes no claim about any specific host.

Fix it

The full walkthrough lives on the fix card, kept current in one place:

Full fix card: openai-compat-exposed →