diff --git a/.env.example b/.env.example
index 97fb2c2..e9b5fe4 100644
--- a/.env.example
+++ b/.env.example
@@ -12,6 +12,14 @@ LLAMACPP_HOST=
 MLX_HOST=
 LMSTUDIO_HOST=
 
+# Optional bearer tokens for local providers deployed behind --api-key
+# (vllm-mlx, llama.cpp server, LM Studio with auth, or an authenticated
+# Ollama reverse-proxy). Leave blank for unauthenticated local serving.
+MLX_API_KEY=
+LLAMACPP_API_KEY=
+LMSTUDIO_API_KEY=
+OLLAMA_API_KEY=
+
 # Default per-request timeout in seconds. Applies to every provider.
 MODEL_REQUEST_TIMEOUT_SECONDS=30
 
diff --git a/lib/models.ts b/lib/models.ts
index 43641a1..68dae8e 100644
--- a/lib/models.ts
+++ b/lib/models.ts
@@ -115,17 +115,38 @@ function buildProviderBaseUrl(provider: ProviderName, envName: string): string {
 }
 
 function buildProviderApiKey(provider: ProviderName, envName: string): string | undefined {
-  if (provider !== "openrouter") {
-    return undefined;
+  if (provider === "openrouter") {
+    const apiKey = process.env.OPENROUTER_API_KEY?.trim();
+
+    if (!apiKey) {
+      throw new Error(`OPENROUTER_API_KEY is required when ${envName} includes an openrouter model.`);
+    }
+
+    return apiKey;
+  }
+
+  // Local OpenAI-compatible servers may be deployed behind a bearer token
+  // (e.g. vllm-mlx --api-key, llama.cpp server --api-key, LM Studio's auth
+  // toggle, an Ollama reverse-proxy with bearer auth). The key is optional;
+  // when unset the request goes out without an Authorization header, which
+  // is the default for unauthenticated local serving.
+  if (provider === "mlx") {
+    return process.env.MLX_API_KEY?.trim() || undefined;
+  }
+
+  if (provider === "llamacpp") {
+    return process.env.LLAMACPP_API_KEY?.trim() || undefined;
   }
 
-  const apiKey = process.env.OPENROUTER_API_KEY?.trim();
+  if (provider === "lmstudio") {
+    return process.env.LMSTUDIO_API_KEY?.trim() || undefined;
+  }
 
-  if (!apiKey) {
-    throw new Error(`OPENROUTER_API_KEY is required when ${envName} includes an openrouter model.`);
+  if (provider === "ollama") {
+    return process.env.OLLAMA_API_KEY?.trim() || undefined;
   }
 
-  return apiKey;
+  return undefined;
 }
 
 function parseProvider(rawProvider: string, index: number, envName: string): ProviderName {