koboldcpp.dev

Test your KoboldCpp API URL, key and client settings

KoboldCpp needs no API key unless you start it with --password; type your server address to check it, get the exact URL your app expects, and copy a working request.

Checked against KoboldCpp 1.124.2 · updated 13 Nov 2026
  • lab-lnx: Linux test VM · 4 vCPU · 15 GB · no GPU
How we test

API checker and request builder

Check your server, build a request or get the values to type into your app.

Runs in your browser. Nothing is uploaded.

Requests go from your browser straight to the address you typed. Nothing is sent to koboldcpp.dev, and the password is never put in a share link.

How this works

The checker asks your server four things from your browser (its version, its model, the OpenAI-style list and the context size) and sends a one-token reply request to see whether a password is set. The request builder writes the same call in six forms and can send it from this page. Both talk only to the address you type.

Data: KoboldCpp 1.124.2 · 13 Nov 2026 · methodology

KoboldCpp API key: do you need one?

No, unless you set one. By default there is nothing to log into and nothing to copy from a dashboard; any page that tells you to get a key from one is wrong. The key is the password you choose with (or the KCPP_PASSWORD environment variable), and clients send it as Authorization: Bearer <key>. With a password set, generation without the right key returned 401 and with it 200 in our test F25. The password does not hide the web page or the model-name request, so it protects generation, not discovery.

Which URL does my app want?

Base address by kind of app
KoboldAIhttp://localhost:5001SillyTavern 1.19.0, Text Completion → KoboldCpp (F48)An address ending in /v1 or /api/v1. SillyTavern tolerated /v1; other apps may not.
OpenAIhttp://localhost:5001/v1openai Python 3.51.0 and JavaScript 7.57.0 SDKs (F72)Leaving /v1 out (the bare address also worked in our SDK test) or typing /v1/v1.
Ollamahttp://localhost:5001Raw Ollama routes (F72)Adding /api or /v1.
Anthropichttp://localhost:5001anthropic Python 2.8.0 SDK (F72)None found: /v1 added also worked.

Other mistakes: https:// to a plain local server (it needs --ssl), localhost typed on a phone (it means the phone: use the PC’s address), and a wrong path, which gives the message Error: KoboldCpp HTTP Server is running, but this endpoint does not exist. Please check the URL and METHOD. F23. More in the API page. The table lists only clients we connected ourselves.

How to read the result

  • Server answers reads /api/extra/version: the KoboldCpp version. Do not use /api/v1/info/version, which reports 1.2.5, the version of the KoboldAI API KoboldCpp copies F24.
  • Loaded model is the model name. With a password it shows koboldcpp/protected-model until you give the key.
  • Capabilities lists what is loaded (vision, speech, images, embeddings and so on).
  • Context size is the limit set at launch.
  • A one-token reply shows the password state: 200 means no key was needed (or yours was right), 401 means the server has a password.
  • If embeddings are requested but no embeddings model is loaded, KoboldCpp answers with an empty vector and model: "inactive", which is not an error F24.

Why the live check may be blocked

A web page can only call your server if the browser allows it. KoboldCpp does its part: it answers cross-origin requests, including the preflight for an Authorization header F77. What can still block the call is the browser:

What we saw, by browser
http page, server on the same PCWorks, with and without a key (F77)Not tested
https page (this site), server at http://localhost or 127.0.0.1Works (F78)Not tested
https page, server at http://192.168… or another network addressBlocked as mixed content (F78)Not tested
https page, server behind an https tunnel addressNot tested; https to https is not mixed contentNot tested

When it is blocked, the tool says why and shows the same checks as commands to run on the PC (curl, or Invoke-RestMethod on Windows). Chrome may also show a permission prompt for access to devices on your local network in some versions: we did not see one in our headless run. See the API page for the commands.

What this tool assumes

  • The route list is KoboldCpp 1.124.2’s own (the API page).
  • The client settings tab lists only clients we connected ourselves: SillyTavern in both modes (F48) and the OpenAI, Anthropic and curl clients (F72, F23). Open WebUI, Janitor AI, Agnaistic, RisuAI, Continue, LangChain and n8n are not listed because we have not tested them.
  • Snippets use a placeholder model name; KoboldCpp ignores it F72.

Accuracy and our tests

  • Against a real server. The checks ran against KoboldCpp 1.124.2 with and without --password: the password state, the masked model name and the 401 for a wrong or missing key were as expected.
  • Snippets. 54 golden files (six endpoints in two modes, six languages) are compared byte for byte, and 28 snippets (curl, Python requests, the OpenAI Python SDK and Node fetch, streaming and not) were run against the real server and returned text. That run found and fixed one fault: the streaming completions snippet read the wrong field.
  • Browsers. One browser, Chromium 153; see the table above.
  • Last passed: 14 November 2026.

Privacy

Requests go from your browser straight to the address you typed. Nothing is sent to koboldcpp.dev. The password stays in the page: share links carry the address and the mode, never the key. This page is allowed to contact any address because it has to, and no other page on the site is. See privacy.

Frequently asked questions

What is my KoboldCpp API key?

There is none unless you set one. KoboldCpp has no accounts or dashboard. If you start it with --password, that password is the key and clients send it as a Bearer token. Without --password you can leave the key field empty, or type any text if the app insists.

Is the API key optional?

Yes. In our tests generation worked without any key on a server with no password, and returned 401 without the right key on a server with one. SillyTavern shows its optional key field with a red mark when it is empty, but the connection works.

What URL do I put in SillyTavern or Janitor AI?

For SillyTavern's Text Completion with the API type KoboldCpp: http://localhost:5001. For Chat Completion or any OpenAI-style app: http://localhost:5001/v1. Janitor AI is a website and cannot reach localhost; it needs a tunnel address. The client settings tab shows the exact values for the clients we connected.

Which port does KoboldCpp use?

5001 by default. Change it with --port, and then use the new number everywhere.

Why does my app get 404 or 401?

404 means the path or method does not match any route of that API: check the base address (KoboldAI apps want the bare address, OpenAI apps want it with /v1). 401 means the server has a password and the key is missing or wrong.

Can a website on the internet reach my local KoboldCpp?

A page in your own browser can: in our test KoboldCpp let a page from another origin call it, with or without a key, because it allows cross-origin requests. That is how this tool works, and also why a server without a password on your PC is open to any page you visit. Chrome let an https page call http://localhost but blocked a call to a network address as mixed content.