> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tokios.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Tokios exposes private local models through https://api.tokios.com using an outbound-only connector tunnel.
> Use 'connector' for the local tokios-connector process.
> Use 'deployment' for the public model name in the API model field.
> Use 'upstream model id' for the model served by Ollama, llama.cpp, vLLM, LM Studio, or another local backend.
> API keys use the prefix sk-tok-. Connector tokens use the prefix ct-tok-.

# Give your team access to local models

> Share your local models with your team through a single authenticated endpoint. No port forwarding, no Tailscale setup, no networking headaches — just OpenAI-compatible API access with per-person keys.

You're running a local model. Your team needs to use it. The hard part isn't the model — it's the networking, the authentication, the client configuration, and making sure everyone can reach it without you becoming a full-time IT support desk.

Tokios gives your team a single authenticated endpoint at `https://api.tokios.com` that calls your local model through an outbound-only tunnel. No inbound ports, no port forwarding, no Tailscale setup required. Each teammate gets their own API key scoped to specific models, and you can revoke access for one person without disrupting everyone else.

## What you get

* **OpenAI-compatible API endpoint** — any client that speaks OpenAI SDK works out of the box
* **Per-person API keys** — each teammate gets their own `sk-tok-…` key, scoped to specific models
* **No networking headaches** — the connector dials out, so it works behind CGNAT, Starlink, 5G, apartment ISPs, corporate firewalls
* **Model routing** — serve multiple models (Ollama, vLLM, llama.cpp) through one endpoint
* **Per-key revocation** — remove one person's access without touching anyone else's

## Set it up in 5 steps

**1. Install the connector on your model host**

On the machine running your model (Ollama, vLLM, llama.cpp, LM Studio), install the Tokios connector:

```bash Linux theme={"theme":{"light":"github-light","dark":"css-variables"}}
curl -fsSL https://tokios.com/downloads/install/linux | sh -s -- --code TKS-XXXX-XXXX
```

```bash macOS theme={"theme":{"light":"github-light","dark":"css-variables"}}
curl -fsSL https://tokios.com/downloads/install/macos | sh -s -- --code TKS-XXXX-XXXX
```

```bash Windows (PowerShell) theme={"theme":{"light":"github-light","dark":"css-variables"}}
irm https://tokios.com/downloads/install/windows.ps1 | iex
```

Get your one-time claim code `TKS-XXXX-XXXX` from the [dashboard](https://tokios.com/console) **Setup** tab. The code expires in about 15 minutes.

**2. Claim the connector in the dashboard**

Back in the dashboard, **approve** the device on the **Setup** or **Connectors** tab. The connector's token is delivered over the tunnel once approved — you never see it on screen or paste it into a file.

Point the connector at your runtime's local API:

* Ollama: `http://127.0.0.1:11434/v1`
* vLLM: `http://127.0.0.1:8000/v1`
* llama.cpp: `http://127.0.0.1:8080/v1`
* LM Studio: `http://127.0.0.1:1234/v1`

No inbound firewall rule is needed — the connector only dials out.

**3. Register your models as deployments**

On the **Models** tab, map each upstream model id (for example `llama3.1` or `qwen2.5:14b`) to a public deployment name your team will use, such as `team-llama` or `team-qwen`. Clients send this deployment name in the `model` field of every request, never the upstream id.

You can register multiple models from different runtimes behind the same endpoint — see [Model routing](https://docs.tokios.com/guides/model-routing.md) for details.

**4. Create API keys for each teammate**

On the **Keys** tab, click **Create key** for each teammate or app. Scope each key to specific deployment name patterns (comma-separated globs, `*` for all) so a teammate only reaches the models you intend.

Keys are `sk-tok-…` Bearer tokens, shown once at creation — copy the key before leaving the page. You can also use the **Share Key by email** flow to send a one-time reveal link directly to a teammate.

See [API keys](https://docs.tokios.com/setup/api-keys.md) for full details on scoping, sharing, and revocation.

**5. Share the endpoint and keys with your team**

Your team configures their client to use:

* **Base URL:** `https://api.tokios.com/v1`
* **API key:** their personal `sk-tok-…` key
* **Model:** the deployment name you registered (e.g., `team-llama`)

Any OpenAI-compatible client works — Python SDK, JavaScript SDK, curl, Continue, Cline, Open WebUI, and [dozens more](https://docs.tokios.com/guides/compatible-clients.md).

## Use it from any client

```bash curl theme={"theme":{"light":"github-light","dark":"css-variables"}}
curl https://api.tokios.com/v1/chat/completions \
  -H "Authorization: Bearer sk-tok-YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "team-llama",
    "stream": true,
    "messages": [{"role": "user", "content": "Hello from the team laptop"}]
  }'
```

```python OpenAI SDK theme={"theme":{"light":"github-light","dark":"css-variables"}}
from openai import OpenAI

client = OpenAI(
    base_url="https://api.tokios.com/v1",
    api_key="sk-tok-YOUR_KEY",
)

response = client.chat.completions.create(
    model="team-llama",
    messages=[{"role": "user", "content": "Hello from the team laptop"}],
)
print(response.choices[0].message.content)
```

```javascript OpenAI SDK theme={"theme":{"light":"github-light","dark":"css-variables"}}
import OpenAI from 'openai';

const client = new OpenAI({
  baseURL: 'https://api.tokios.com/v1',
  apiKey: 'sk-tok-YOUR_KEY',
});

const response = await client.chat.completions.create({
  model: 'team-llama',
  messages: [{ role: 'user', content: 'Hello from the team laptop' }],
});
console.log(response.choices[0].message.content);
```

## Key management for teams

**One key per person.** Don't share a single key across the team. Per-person keys let you:

* Scope access to specific models (a developer gets `team-llama` and `team-qwen`, a tester gets only `team-llama`)
* Revoke one person's access without disrupting everyone else
* Track usage per person (if request logging is enabled)

**Naming conventions.** Name keys by person and purpose: `alice-coding`, `bob-testing`, `ci-pipeline`, `demo-account`. You'll thank yourself when you have 20 keys and need to figure out which one to revoke.

**Rotation.** Rotate keys periodically (every 90 days is a reasonable default). Create the new key, update the client, then revoke the old one. The **Share Key by email** flow makes this painless — you send a one-time reveal link, the teammate clicks it, and they see the new key once.

**Revocation.** On the **Keys** tab, click **Revoke** next to the key you want to kill. The key stops working immediately. No need to restart the connector or touch the model host.

## Networking: how it works without the headaches

The connector opens an outbound WebSocket tunnel to `api.tokios.com`. Your runtime stays on `127.0.0.1` — no inbound ports, no firewall changes, no router config. This means:

* **CGNAT?** Works. Your ISP puts you behind carrier-grade NAT (Starlink, 5G, apartment buildings)? The connector dials out, so it doesn't matter — see [Serve a local LLM from behind CGNAT](https://docs.tokios.com/guides/llm-behind-cgnat.md) for why that's a router setting you can't fix yourself.
* **Corporate firewall?** Usually works. The connector only needs outbound HTTPS (port 443). If your IT team blocks outbound WebSocket, you'll need an exception — but most corporate firewalls allow it.
* **Remote teammates?** Works. Your teammate can be on the same LAN, across the country, or on a different continent. They call `https://api.tokios.com/v1` with their API key, and the request routes through the tunnel to your local model.

### Tokios vs Tailscale vs Cloudflare Tunnel

If you're already using Tailscale or Cloudflare Tunnel, you might wonder whether you need Tokios at all. The short answer:

* **Tailscale alone** is great for personal multi-device access, but it doesn't give you per-user API keys, model scoping, or OpenAI-compatible protocol translation. Every device on your tailnet has the same raw access to the runtime. See [Tokios vs Tailscale](https://docs.tokios.com/guides/tokios-vs-tailscale.md) for the full comparison.
* **Cloudflare Tunnel** works but has SSE buffering and timeout issues that break streaming responses — see [Tunnels and streaming](https://docs.tokios.com/guides/tunnels-and-streaming.md) for the gory details.
* **Tokios** is purpose-built for team access to local models: per-user keys, model routing, protocol translation, and a tunnel that handles streaming correctly.

You can also use Tokios **alongside** Tailscale — for example, Tailscale for your personal devices and Tokios for external teammates or apps.

## When to use Tokios

Tokios is the right choice when:

* You have a local model and your team needs to call it via API
* You want per-person authentication and model scoping
* You're behind CGNAT or can't open inbound ports
* You want an OpenAI-compatible endpoint without the networking plumbing

Tokios is **not** the right choice when:

* You're air-gapped (no internet at all) — the tunnel needs outbound internet
* You're in a regulated environment that requires on-premises-only infrastructure
* You already have a mature API gateway stack and just need a tunnel — use Cloudflare Tunnel or Tailscale instead
* You only need personal multi-device access — Tailscale alone is simpler

See [When to use Tokios](https://docs.tokios.com/guides/when-to-use-tokios.md) for the full decision framework.

## FAQ

> **Can my team use different models?**
>
> Yes. Register multiple deployments (e.g., `team-llama`, `team-qwen`, `team-coder`) and scope each API key to the deployments that person should access. A developer might get access to all three, while a tester gets only `team-llama`.

> **What happens when I swap models?**
>
> You can change the upstream model id for a deployment without touching your team's client config. They keep calling `team-llama`, but the request routes to the new model. This is useful for upgrading models (e.g., `llama3.1` → `llama3.2`) without updating every client.

> **Can I revoke access for one person?**
>
> Yes. On the **Keys** tab, click **Revoke** next to their key. The key stops working immediately. Other teammates are not affected.

> **Does this work remotely?**
>
> Yes. Your teammate can be anywhere with internet access. They call `https://api.tokios.com/v1` with their API key, and the request routes through the tunnel to your local model. No VPN, no Tailscale, no port forwarding required.

> **What about rate limits?**
>
> Tokios doesn't impose rate limits beyond what your hardware can handle. If your model serves 10 requests per second, your team can send 10 requests per second (collectively, not per person). Monitor your runtime's performance and scale your hardware accordingly.

> **Can I use this with Ollama, vLLM, llama.cpp, or LM Studio?**
>
> Yes. Tokios works with any runtime that exposes an OpenAI-compatible `/v1` API. That includes Ollama, vLLM, llama.cpp, LM Studio, SGLang, Xinference, and others. See [Supported backends](https://docs.tokios.com/setup/supported-backends.md) for the full list.

## Next steps

* [API keys reference](https://docs.tokios.com/setup/api-keys.md) — full details on scoping, sharing, and revocation
* [Model routing](https://docs.tokios.com/guides/model-routing.md) — serve multiple models through one endpoint
* [Tokios vs Tailscale](https://docs.tokios.com/guides/tokios-vs-tailscale.md) — detailed comparison
* [When to use Tokios](https://docs.tokios.com/guides/when-to-use-tokios.md) — decision framework
* [Compatible clients](https://docs.tokios.com/guides/compatible-clients.md) — find your client (Open WebUI, Continue, Cline, etc.)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.