---
title: "Outbound Requests and Offline Mode"
url: "/docs/proxy/outbound_requests"
canonical_url: "https://docs.litellm.ai/docs/proxy/outbound_requests"
type: "docs"
last_updated: "2026-10-23"
summary: "LiteLLM sends requests to the providers, callbacks, guardrails, secret managers and SSO servers you configure. It also makes a few requests on its own, to fetch catalogs that change more often than LiteLLM is released. This page lists..."
related:
  - "/docs/proxy/security_best_practices"
  - "/docs/proxy/security_owasp_llm_top10"
---
# Outbound Requests and Offline Mode

> Index of all LiteLLM docs: https://docs.litellm.ai/llms.txt


LiteLLM sends requests to the providers, callbacks, guardrails, secret managers and SSO servers you configure. It also makes a few requests on its own, to fetch catalogs that change more often than LiteLLM is released. This page lists those requests and shows how to turn them off for air-gapped or egress-restricted deployments.

## Turn on offline mode

Set `LITELLM_OFFLINE_MODE=true` on the proxy to stop every request in the table below:

```shell
export LITELLM_OFFLINE_MODE=true
litellm --config config.yaml
```

Set it as an environment variable on every proxy instance. It can't be set in `config.yaml`, because the model cost map loads before the config is read.

Only `true` turns it on, in any letter case. Any other value, such as `1` or `yes`, leaves it off.

## Requests offline mode stops

| What | Host | When | With offline mode on | Per-feature switch |
|---|---|---|---|---|
| Model cost map | `raw.githubusercontent.com`, or `LITELLM_MODEL_COST_MAP_URL` | Startup, `/reload/model_cost_map` and the scheduled cost map reload | Uses the copy bundled with the package | `LITELLM_LOCAL_MODEL_COST_MAP=true` |
| Anthropic beta headers | `raw.githubusercontent.com`, or `LITELLM_ANTHROPIC_BETA_HEADERS_URL` | First Anthropic or Bedrock request that sends a beta header, `/reload/anthropic_beta_headers` and its scheduled reload | Uses the bundled copy | `LITELLM_LOCAL_ANTHROPIC_BETA_HEADERS=true` |
| Auto router presets | `raw.githubusercontent.com`, or `LITELLM_AUTOROUTER_PRESETS_URL` | `/public/autorouter_presets`, called by the Admin UI auto router form | Uses the bundled copy | `LITELLM_LOCAL_AUTOROUTER_PRESETS=true` |
| Policy templates | `raw.githubusercontent.com` | `/policy/templates`, called by the Admin UI Policies page | Uses the bundled copy | `LITELLM_LOCAL_POLICY_TEMPLATES=true` |
| Blog posts | `docs.litellm.ai`, or `LITELLM_BLOG_POSTS_URL` | `/public/litellm_blog_posts`, called by the Admin UI Home page and Blog menu | Uses the bundled copy | `LITELLM_LOCAL_BLOG_POSTS=true` |
| Latest release | `docs.litellm.ai` and `api.github.com` | `/get/latest_release_info`, called by the Admin UI notifications bell | Returns `null`, so no upgrade notice shows | `LITELLM_DISABLE_LATEST_RELEASE_CHECK=true` |
| Breached password check | `api.pwnedpasswords.com` | Setting or changing a user password, and password login | Skipped | `general_settings.password_policy_check_breached_passwords: false` |
| Hugging Face tokenizers | `huggingface.co` | Token counting for Cohere, Llama 2 and Llama 3 models | Counts with the OpenAI tokenizer instead | `litellm_settings.disable_hf_tokenizer_download: true` |
| Kimi K3 tokenizer | `huggingface.co` | Token counting for Bedrock Kimi K3 models | Reads the file from the local Hugging Face cache, and estimates the count when it isn't cached | `litellm_settings.disable_hf_tokenizer_download: true` |

The breached password check sends only the first 5 characters of the password's SHA-1 hash, never the password.

Offline mode overrides the per-feature settings. With offline mode on, the breached password check stays off even when `password_policy_check_breached_passwords` is `true`, and the `*_URL` variables are ignored. To read a catalog from an internal mirror, leave offline mode off, set that catalog's `*_URL` variable, and turn off the other requests with their per-feature switches.

The bundled copies are as current as the installed LiteLLM version. New model prices, presets, templates and blog posts arrive when you upgrade.

## Requests offline mode doesn't stop

### Destinations you configure

Offline mode doesn't change requests to destinations in your config, such as LLM providers, logging callbacks, guardrail vendors, secret managers, SSO, email and alerting. It also doesn't change these:

- **Model info refresh.** For `openai`, `openai_like`, `text-completion-openai` and `hosted_vllm` deployments with an `api_base`, the proxy calls `{api_base}/v1/models` every 5 minutes. Set `general_settings.disable_model_info_refresh: true` to stop it.
- **License check.** With `LITELLM_LICENSE` set, the proxy checks the key against `license.litellm.ai` when it can't verify the key's signature locally.
- **Image URLs in requests.** When a request carries an image URL, token counting and some providers, such as Bedrock, download it.

### Hugging Face model lookups

These model lookups can call `huggingface.co`, and no switch turns them off:

- **Model config.** Looking up the context window of a `huggingface/` model reads its `config.json`. When the host is unreachable, the lookup returns no value.
- **Chat templates.** Providers that build a text prompt from chat messages, such as SageMaker, vLLM, Replicate, Triton, watsonx and Bedrock invoke, read the model's chat template. When the host is unreachable, LiteLLM falls back to a generic prompt format. Set a [custom prompt template](../completion/prompt_formatting) for the model to skip the lookup.
- **Embedding task.** `huggingface/` embedding requests look up the model's task, and the request fails when the host is unreachable. Send `input_type` in the request to skip the lookup.

### Database tooling

The proxy runs migrations with the Prisma CLI:

- **Prisma CLI install.** On a pip install, the first start downloads the Prisma CLI and its engines from `registry.npmjs.org` and `binaries.prisma.sh`, and Node.js from `nodejs.org` when it isn't installed. LiteLLM Docker images include them and set `PRISMA_OFFLINE_MODE=true`.
- **Prisma version check.** The Prisma CLI checks `checkpoint.prisma.io` for updates. Set `CHECKPOINT_DISABLE=1` to stop it.

### Tokenizer files

LiteLLM bundles the `cl100k_base`, `o200k_base` and `p50k_base` tiktoken files. Counting tokens for a legacy model, such as `davinci`, `ada` or `gpt2`, downloads its tokenizer from `openaipublic.blob.core.windows.net`. To avoid it, put the files in a folder and set `CUSTOM_TIKTOKEN_CACHE_DIR` to that folder.

### Callback packages

The `supabase`, `sentry` and `slack` callbacks run `pip install` when their package is missing. Install the package in the image instead.

### Browser requests

These requests come from the browser of the person using the Admin UI or API docs, not from the proxy:

- **ReDoc.** The `/redoc` page loads its script from `cdn.jsdelivr.net` and fonts from `fonts.googleapis.com`. Set `NO_REDOC=True` to turn off the page.
- **MCP server icons.** The MCP server catalog and OpenAPI picker in the Admin UI load icons from `cdn.simpleicons.org` and `raw.githubusercontent.com`. When they are blocked, the icons don't show.

The Admin UI and the Swagger page at `/` serve their own scripts and fonts.

## Related pages

- [Security Best Practices](https://docs.litellm.ai/docs/proxy/security_best_practices.md)
- [OWASP LLM Top 10 (2026) mapping](https://docs.litellm.ai/docs/proxy/security_owasp_llm_top10.md)