vLLM OpenAI-compatible server and API key scope

vllm serve <model> starts an HTTP server that implements OpenAI-style APIs, including /v1/chat/completions (which needs a chat template), /v1/completions, /v1/embeddings for embedding models, and /v1/models. --api-key or VLLM_API_KEY authenticates only endpoints under the /v1, /v2, and /inference prefixes; other endpoints on the same server, notably /invocations, are not authenticated. Koskamo editorial guidance: keep the model port on a private network behind a gateway that enforces its own key, rather than relying on --api-key alone. A /v1/models response proves the server answers, not that a generation succeeds. Reviewed September 21, 2026.