llama.cpp stops handing the API key file to child servers in router mode

Router mode in llama.cpp puts one server in front of several model instances, and authentication belongs to the front. That was not what the code did. Until build b11077, published on September 21, 2026, a router started with both --api-key and --api-key-file passed the file through to the instances it spawned, and those instances then accepted only the keys in that file.

What went wrong

The bug was reported on September 12, 2026 by an operator running a router on a Mac with both key sources configured. Requests to list models were accepted with every key, router key and file keys alike. Chat completion requests, which the router proxies to a child instance, accepted the file keys and answered the command-line key with 401 and an invalid-key message. A client that could see the model list could not use a single model.

The cause was one missing entry. The routine that strips reserved arguments before a child is started unset the environment variable holding the key, but not the variable holding the path to the key file, so only that second source survived into the child's arguments. The reporter also noticed the file flag sitting in the child's process arguments, where anyone able to list processes on that machine can read it. Router-internal calls that carry no authentication header were rejected with 401 as well, silently.

• Reported on September 12, 2026; merged and released on September 21, 2026.
• Symptom: the model list answers every key, chat completions answer only the file keys.
• Side effect: the key file path appeared in the child process arguments.
• The fix is one added line in one file.

What the fix changes

The change adds the key-file variable to the list of arguments that are unset before a child is spawned. No API key of either kind now reaches a child instance, every key the router accepts works through the whole request, and the router's own internal stream calls stop returning 401. The reasoning in the pull request is a single sentence of policy: in router mode, authentication belongs to the router.

The maintainers state the security half plainly as well, that the change keeps keys out of child argv. Process arguments are not a secret store. On a shared machine they are readable by other accounts, and they end up in process listings, crash reports and monitoring agents that were never meant to hold credentials.

What to do about it

If you run llama.cpp in router mode with a key file, update to b11077 or later. The failure mode is worth recognising even after the upgrade, because it is the kind that wastes an afternoon: the server starts, the health endpoints answer, the model list answers, and only the requests that do work come back rejected.

One possible explanation for how long it survived is that the two key sources look interchangeable from the outside. Both simply add keys to the accepted list, so nobody would expect one of them to also decide what the child process validates against. The bug had been in place since the preset refactor the reporter names, which is the other reason to read this kind of fix: it tells you which configurations nobody was testing.