{"record":{"id":"a3e3e8e4bffaa3b4","repo":"sgl-project/sglang","slug":"grpc-port-is-incompatible-with-api-key-admin","errorCode":null,"errorMessage":"--grpc-port is incompatible with --api-key/--admin-api-key: the native gRPC listener bypasses HTTP auth middleware.","messagePattern":"--grpc-port is incompatible with --api-key/--admin-api-key: the native gRPC listener bypasses HTTP auth middleware\\.","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"python/sglang/srt/server_args.py","lineNumber":4547,"sourceCode":"                raise ValueError(\"--sidecar requires --grpc-port or SGLANG_GRPC_PORT.\")\n        if native_grpc:\n            if cfg.use_ray:\n                raise ValueError(\n                    \"--grpc-port is not supported with --use-ray: the Ray \"\n                    \"serve launch path does not start the native gRPC server.\"\n                )\n            if cfg.encoder_only:\n                raise ValueError(\n                    \"--grpc-port is not supported with --encoder-only: \"\n                    \"encoder disaggregation uses its own server.\"\n                )\n            if cfg.tokenizer_worker_num > 1:\n                raise ValueError(\n                    \"Native gRPC does not yet support --tokenizer-worker-num > 1. \"\n                    \"Unset --grpc-port or set --tokenizer-worker-num 1.\"\n                )\n            if cfg.api_key or cfg.admin_api_key:\n                raise ValueError(\n                    \"--grpc-port is incompatible with --api-key/--admin-api-key: \"\n                    \"the native gRPC listener bypasses HTTP auth middleware.\"\n                )\n\n    def _handle_prefill_delayer_env_compat(self):\n        if envs.SGLANG_SCHEDULER_DECREASE_PREFILL_IDLE.get():\n            self._declare(\n                \"_handle_prefill_delayer_env_compat\",\n                enable_prefill_delayer=True,\n            )\n        if x := envs.SGLANG_PREFILL_DELAYER_MAX_DELAY_PASSES.get():\n            self._declare(\n                \"_handle_prefill_delayer_env_compat\",\n                prefill_delayer_max_delay_passes=x,\n            )\n        if x := envs.SGLANG_PREFILL_DELAYER_TOKEN_USAGE_LOW_WATERMARK.get():\n            self._declare(\n                \"_handle_prefill_delayer_env_compat\",","sourceCodeStart":4529,"sourceCodeEnd":4565,"githubUrl":"https://github.com/sgl-project/sglang/blob/0132848349585cfe6aae51c4941cbae872505f8a/python/sglang/srt/server_args.py#L4529-L4565","documentation":"The native gRPC listener bypasses SGLang's HTTP auth middleware, so API keys would not be enforced on the gRPC port. ServerArgs therefore rejects --grpc-port combined with --api-key or --admin-api-key.","triggerScenarios":"Passing --api-key and/or --admin-api-key together with --grpc-port or SGLANG_GRPC_PORT.","commonSituations":"Hardening a deployment with auth keys without realizing gRPC traffic would be unauthenticated; shared security baselines that set --api-key on every instance.","solutions":["Remove --api-key / --admin-api-key when using native gRPC","Or drop --grpc-port and serve over HTTP so auth middleware applies","If gRPC is required with auth, front the gRPC port with an authenticating proxy / network policy"],"exampleFix":"# before\n--grpc-port 50051 --api-key sk-123\n# after\n--api-key sk-123  # HTTP only","handlingStrategy":"validation","validationCode":"if (args.get(\"grpc_port\") or os.environ.get(\"SGLANG_GRPC_PORT\")) and (args.get(\"api_key\") or args.get(\"admin_api_key\")):\n    raise SystemExit(\"auth keys are incompatible with native gRPC; choose one\")","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Treat the gRPC port as unauthenticated: restrict it with network policy / firewall rules","Apply security baseline flags only to HTTP-serving deployments"],"tags":["grpc","security","api-key","flag-conflict"],"backgroundTag":"mutually-exclusive-options","analyzedSha":"0132848349585cfe6aae51c4941cbae872505f8a","analyzedAt":"2026-08-28T05:10:05.995Z","schemaVersion":2},"datasetVersion":"2026-08-28T06:17:29.519Z"}