Security
How OpenLLM stores credentials and why a database dump reveals nothing.
Connecting your accounts to any middle layer is a real trust decision. Here is exactly what OpenLLM does with them, so you can judge it honestly.
Credentials are encrypted at rest
Every provider API key you connect is stored only as ciphertext. It is never written to disk in a readable form.
The unlock key that decrypts a credential is derived from your own OpenLLM API key on each request. It is used in memory just long enough to call the provider, then wiped. OpenLLM does not keep a copy of the plaintext key sitting around.
The practical consequence: a database dump on its own reveals nothing usable. The stored ciphertext cannot be decrypted without the per-request unlock that only your key produces.
Subscription credentials never touch the cloud
Subscription accounts (Claude Code, ChatGPT, Kimi over OAuth) are handled differently from API keys. They run through the local daemon on your own machine. When a request needs one, it runs there against the official vendor CLI's own credentials and returns the result. The subscription credential stays on your machine and never routes through the OpenLLM cloud. See Providers.
Your key is the crown jewel
Because your sk-llm-… key is what derives the unlock on each request, protect it
like a password:
- Do not commit it to a repo or paste it into a shared chat.
- Create a separate key per machine or tool where you can, so you can revoke one without disturbing the others.
- Revoke a key immediately under Keys if you think it leaked. Revoking it cuts off access to every credential it could unlock.
Verified downloads
The openllmc CLI and openllmd daemon are downloaded and checked against a
published SHA-256 checksum before they run, and they self-update through the same
checksum-gated swap. This is a checksum, not a signed binary, but it does defend
against a corrupted or tampered download.
What OpenLLM does not do
- It does not resell your tokens or add a markup. See Compliance.
- It does not store a readable copy of any provider credential.
- It does not route your subscription credentials through its cloud.