vLLM FrontendArgs / cli_args: api_key field ('If provided, the server will require one of these keys to be presented in the header')

Verified in the v0.11.0 tag of vllm/entrypoints/openai/cli_args.py (the module was relocated to vllm/entrypoints/launchers/ on main). api_key is Optional[list[str]] = None - the engine ships with NO authentication by default, and the control is a list of shared bearer keys checked at the HTTP layer only. There is no per-key rate limit, no per-key quota, and no per-key log attribution in this flag. | DEAD-LINK VERIFIED 2026-10-04. THREE independent GET probes returned HTTP 404 '404: Not Found' on raw.githubusercontent.com for vllm/entrypoints/openai/cli_args.py on main. This is an UPSTREAM MOVE, and the existing note already identified the cause: the module was relocated to vllm/entrypoints/launchers/. GitHub's contents API for vllm/entrypoints/openai still lists api_server.py and the same subpackages, so the flag survives under a new path. The claim - vLLM ships with NO authentication by default - was verified against the v0.11.0 tag and is not invalidated by the move. Re-point the URL at the tag or the new path; keep the record. | 2026-10-05 REPAIR: REPAIRED - URL REPOINTED TO THE POST-MOVE PATH AND RE-VERIFIED ON main. GitHub's authenticated contents API for vllm/entrypoints/openai no longer lists cli_args.py (contents: __init__.py, api_server.py, chat_completion, completion, models, parser, responses, run_batch.py), while vllm/entrypoints/launchers does (app.py, cli_args.py, launcher.py, dp_supervisor.py, grpc_server.py, ...). The new URL returns HTTP 200 and the claim was re-read from the live file, not from the earlier tag: line 325 is 'api_key: list[str] | None = None'. The security conclusion is unchanged and now rests on the current main rather than on v0.11.0 - vLLM ships with NO authentication by default, and the control is a list of shared bearer keys checked at the HTTP layer only, with no per-key rate limit, quota, or log attribution in this flag. Note the field type has drifted from the tag: Optional[list[str]] at v0.11.0, now list[str] | None (PEP 604 syntax) on main. Same semantics, different spelling - worth knowing if anyone greps for the old annotation.