AuthServer

Admin login accounts (email + password). All admins are equal — there are no roles. Add or remove admins here; passwords are set on creation and never shown. This is the same admin account set as on mnzLLM.

The token in the top bar is the server access token used for protected admin APIs. Save Current stores a hash of that token in encrypted storage so it remains accepted after restart. Generate creates a new token, returns it once, and keeps prior token records in history.

Vocabulary: ID is the encrypted-store record key. Label is the operator name for the token. Fingerprint is the first part of the token hash and is read-only. Source is manual or generated. Active means the record is accepted; revoked records are kept for history. Replacement token changes the stored hash and is never shown again.

mnzLLM is the client and owns the connection settings — this side is passive. Same-network links use HTTP + the X-Proxy-Auth token (no mTLS needed, already working). For an over-the-internet link you have two certificate sources: (a) Public — ACME/Let's Encrypt (automatic, trusted by public CAs): set OAUTH_PROXY_ACME_DOMAIN (+ OAUTH_PROXY_ACME_EMAIL); or (b) manual/corp files: place server.crt/server.key (and optionally ca.crt for mutual TLS) under the cert dir + set OAUTH_PROXY_TLS_ADDR. Re-test after either.

Reload re-reads runtime settings and refreshes the admin UI's data without dropping traffic — use after editing accounts/routes/lists elsewhere. Reset Server restarts the process (brief downtime, connections briefly interrupted) — use only after changing config that is not hot-reloaded.

Pools identify account groups that routes can use. Providers, tags, categories, and model patterns are reusable labels for filling Router and Account forms. Discover From Runtime merges values from current accounts, saved router rules, and recent gateway log entries into these lists without deleting existing values.

Pull models, providers, and users from the sibling mnzLLM service (GET {url}/api/sync/export). Authenticate with the mnzLLM master key or any admin-role virtual key (sk-mnz-…) as the bearer token. When this AuthServer runs in a container, a localhost URL is auto-mapped to the docker host. Model names merge into Model patterns and providers into Providers; existing values are kept. The key is stored encrypted and never shown again.

A route record maps gateway (mnzLLM) traffic to one vendor upstream and one pool. Route names are used by the gateway (mnzLLM) through X-Proxy-Route. Pools are configured in Admin lists and assigned to accounts on the Accounts page.

Off (default): each access group serves requests round-robin by least-recently-used account. On: one account is chosen at random weighted by each account's Balance weight (set on the Accounts form). Quarantined/disabled accounts are always skipped.

No router rules loaded.

Click a route name in the tree to load its first model pattern into Resolve. Click Edit to open that route in the Route Form. Save Route applies the change to live runtime routing after the API accepts the rule; Cancel Edit exits editing without saving; New Route clears the form for a new record.

Resolve does not call the vendor. It runs the same route decision logic the proxy uses for live traffic: first the optional X-Proxy-Route value, then model pattern matching, then default route, otherwise 404 no_route.

Pools group the accounts that routes draw from. Add a pool, then assign it to accounts on the Accounts page. Each pool below is a tree of its accounts, with activate/deactivate, archive and delete.

Add 2+ accounts to the same pool, then set its policy here (or edit it any time).
Distribution — how a request picks an account: failover = top account, next on failure; least_used = fewest requests today (spreads load, avoids one subscription being hammered into 429/403/quarantine); round_robin = rotate; weighted = by weight.
Fail path — which upstream results make a single request retry the NEXT account (like mnzLLM's routing policy): rate_limit (429), server_error (5xx), auth (401/403), timeout (unreachable). None ticked = fail over on all of them. Max tries = accounts per request (blank = 3).
Failure threshold = consecutive auth failures before an account is quarantined (blank/0 = default 3; auto-recovers after 5 min). Plus an optional request budget.

Request-count budgets (like mnzLLM). Assign a budget to an account (Accounts form) and/or a pool (Pools page). 0 = unlimited on that window. When any applicable budget is exhausted the account stops serving and failover moves to the next account.

Choose which endpoint the account Test Key button hits for each provider. When set, the selection overrides the route-derived test URL; choose custom to enter a free-text URL. Leave a provider blank to keep the default behavior.

Inbound traffic mapped end-to-end: a virtual key (from mnzLLM/clients) opens sessions; the routing table maps each virtual key through its pool to a selected account and the auth token assigned to reach it; the outbound table shows the vendor accounts in use. "+ Test connection" injects a synthetic connection.