Security
Use these guides to protect your LiteLLM gateway, control its outbound requests, and store credentials safely.
Start with Security Best Practices for the production checklist. For installation and infrastructure setup, see Deploy.
Choose a topic
| Topic | What it covers |
|---|---|
| Security Best Practices | Secure releases, access controls, network settings, secrets, and audit logs. |
| Client Authentication with mTLS | Check client certificates at ingress and require LiteLLM keys. |
| Identity-Aware Proxy | Check identity and access before traffic reaches LiteLLM. |
| SSL & HTTP Proxies | Configure certificate verification, custom CA bundles, and outbound HTTP proxies. |
| Outbound Requests and Offline Mode | The external services LiteLLM contacts and which requests you can disable. |
| OWASP LLM Top 10 mapping | Which LLM risks LiteLLM controls address and which your application must handle. |
| FIPS Mode | Check current support and limits. FIPS mode remains in development. |
| Secret Managers | Read and store secrets with supported secret managers. These integrations require an Enterprise license. |
| Docker Image Security | Verify image signatures and review image security options. |
Identity and access
Authentication identifies callers and people who sign in to the Admin UI. Access Management controls which models, MCP servers, and agents they can use and manage.
