Auth & mTLS

Generate tokens or a full certificate trust chain with the CLI, then flip it on in config.

Generate

routsi token -n 2      # prints rtk_… bearer tokens + setup notes
routsi certs           # → ~/.config/routsi/certs/ (CA + server + client, keys 0600)

Config

auth:
  tokens_env: ROUTSI_TOKENS    # export ROUTSI_TOKENS="tok1,tok2"
tls:
  cert: server.crt             # cert + key ⇒ HTTPS
  key: server.key
  client_ca: clients-ca.crt    # + client_ca ⇒ mutual TLS (client certs required)

With tokens on, /v1/*, /stats and /metrics require Authorization: Bearer <tok> (OpenAI SDKs send it as the api_key); the dashboard opens at /?token=…. /health stays open. Token values live in env vars — never in the config file.

Full end-to-end walk-through (curl 401→200, Python SDK, dashboard): Scenarios → Token-based auth. mTLS walk-through: Scenarios → mTLS.

Secrets via .env

On startup routsi layers environment variables from several sources so provider keys and ROUTSI_TOKENS can live wherever suits you. Precedence, highest first:

1. Process environment — whatever your shell / service already exports (always wins).
2. An explicit env file — -env <path> flag or ROUTSI_ENV_FILE.
3. ./.env — in the working directory.
4. ~/.config/routsi/.env — the per-user default.

A file never overrides a variable already set by a higher source, and values are never logged.

OPENAI_API_KEY=sk-...
DEEPSEEK_API_KEY=...
ROUTSI_TOKENS=rtk_...,rtk_...

Next: Dashboard & metrics →