Key Generation
The router uses Argon2id-hashed keys for authentication — no plaintext secrets are stored.
# Print keys to stdout (for manual setup)
auxot-router setup
# Write keys to .env file
auxot-router setup --write-env
# Print as Fly.io secrets (fly secrets set format)
auxot-router setup --fly
# Print CLI worker configuration
auxot-router setup --cli --model opus
Required Environment Variables
| Variable | Description |
|---|---|
AUXOT_ADMIN_KEY_HASH | Argon2id hash of the GPU/worker registration key (adm_xxx) |
AUXOT_API_KEY_HASH | Argon2id hash of the API key for callers (rtr_xxx) |
Both hashes are generated by auxot-router setup. Never store the raw keys in the environment — only the hashes.
Model Policy
| Variable | Default | Description |
|---|---|---|
AUXOT_MODEL | Qwen3.5-35B-A3B | Model name from the embedded registry |
AUXOT_QUANTIZATION | (auto-selected) | Quantization level (e.g. Q4_K_S, Q8_0). Auto-selected based on available VRAM if omitted |
AUXOT_CTX_SIZE | 131072 | Context window size in tokens |
AUXOT_MAX_PARALLEL | 2 | Concurrent inference jobs per GPU worker |
Optional Variables
| Variable | Description |
|---|---|
AUXOT_REDIS_URL | External Redis connection string. Leave empty to use embedded miniredis |
AUXOT_TOOLS_KEY_HASH | Argon2id hash of the tools worker key. Required to enable tools workers |
AUXOT_ALLOWED_TOOLS | Comma-separated list of permitted tools (e.g. code_executor,web_search). Empty = all |
AUXOT_PORT | HTTP port (default: 8080) |
AUXOT_HOST | Bind address (default: 0.0.0.0) |
AUXOT_JOB_TIMEOUT | Max inference job duration (default: 5m) |
AUXOT_LOG_LEVEL | Log verbosity: debug, info, warn, error (default: info) |
Per-Tool Credentials
Tools workers read credentials from environment variables using the pattern AUXOT_TOOLS_{TOOL}_{VAR}:
# Brave Search
AUXOT_TOOLS_WEB_SEARCH__BRAVE_SEARCH_API_KEY=BSA...
# Any tool credential follows the same pattern
AUXOT_TOOLS_{TOOL_NAME}__{CREDENTIAL_NAME}=value
Double underscores (__) separate the tool name from the credential name because tool names themselves may contain underscores.