> For the complete documentation index, see [llms.txt](https://docs.roboflow.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.roboflow.com/deployment/self-hosted/inference-server/configuration/model-security.md).

# Model Package Security

Configure per-model authorization and local or untrusted model package loading without confusing them with server authentication.

Model loading and server access use separate controls. Granting a client access to the server does not make every model package safe to execute.

Check [Security Configuration Migration](/deployment/self-hosted/inference-server/configuration/security-migration.md#release-status) for which changes are merged and which are pending.

## Server access and model authorization

`WORKSPACES_WHITELISTED_FOR_LOCAL_DEPLOYMENT` controls which Workspaces can call the server, including its integrated stream management routes. `MODELS_CACHE_AUTH_ENABLED=True` checks whether the caller's API key may access the requested Roboflow model when the server is online. Model authorization is not a replacement for [server authentication](/deployment/self-hosted/inference-server/configuration/security.md#enforce-authentication).

## Direct local packages

For trusted local packages in server Workflows, enable these settings and mount the package directory into the container:

```dotenv
USE_INFERENCE_MODELS=True
ALLOW_INFERENCE_MODELS_DIRECTLY_ACCESS_LOCAL_PACKAGES=True
MODELS_CACHE_AUTH_ENABLED=False
```

This allows callers to load readable local model packages, including their Python code. The local loading path does not itself require an API key, but any configured Workspace authentication still applies to the request.

An online server rejects startup if both `MODELS_CACHE_AUTH_ENABLED=True` and `ALLOW_INFERENCE_MODELS_DIRECTLY_ACCESS_LOCAL_PACKAGES=True`. Keep local loading disabled when you require per-model authorization; a filesystem path cannot be checked against a caller's Roboflow model access.

## Offline authorization

When `OFFLINE_MODE=True`, per-model API-key checks cannot run. If `MODELS_CACHE_AUTH_ENABLED=True` is also set, startup requires the explicit `ALLOW_OFFLINE_MODEL_CACHE_AUTH_BYPASS=True` opt-in. Use that bypass only for a trusted single-tenant deployment; it does not make API-key checks work offline.

Offline mode also rejects Workspace-whitelist or Dedicated Deployment authentication, which needs API connectivity. See [Offline Mode](/deployment/self-hosted/enterprise/offline-mode.md) for deployment context.

## Package trust defaults

In the pending runtime-hardening build described in the [migration guide](/deployment/self-hosted/inference-server/configuration/security-migration.md#model-package-trust), JetPack 5.1.1, 6.2.0, and 7.2.0 images set `ALLOW_INFERENCE_MODELS_UNTRUSTED_PACKAGES=False`, matching the core library's default. To load a package classified as untrusted, explicitly set it to `True` only after reviewing the package and its source.

This setting is separate from `ALLOW_INFERENCE_MODELS_DIRECTLY_ACCESS_LOCAL_PACKAGES`: rejecting untrusted downloaded packages does not disable direct local package loading. Neither setting replaces caller authentication.

## CLI benchmarks

The pending runtime-hardening build also changes `inference benchmark inference-models-speed` to reject untrusted packages by default. Use `--allow-untrusted-packages` when you deliberately trust the package; the adapter and Python benchmark helper use the same restrictive default.

For benchmark usage, see [Benchmark Inference](https://docs.roboflow.com/reference/inference/inference-cli/benchmark).