# Preparing LiteLLM UI for model and key management

Prepare LiteLLM Admin UI with persistent state, managed access, one tested model, a scoped application key and a recovery procedure.

Author: Retrivium team
Updated: 2026-11-01
Canonical URL: https://retrivium.ai/journal/litellm-ui-setup/
Language: en

LiteLLM UI manages gateway models, keys and related accounting. It needs a prepared installation with the appropriate state and access. An accessible login page does not establish that a model is connected, client restrictions work or configuration survives a restart. Treat each capability as a separate acceptance check.

## Confirm the installation

Record the gateway address and version, then verify the UI belongs to the intended process. The Admin UI documentation describes database and initial-access requirements. A minimal container and a stateful management setup are different targets, even when both expose a web page.

Inspect the official Docker configuration, including images, variables, ports and volumes. Keep secrets out of public files. An administrative master key does not automatically create every management feature or a recovery procedure if storage becomes unavailable. Confirm the state the team intends to retain.

## Plan ongoing administration

Assign ownership of administrative access and its replacement. Separate the first setup credential from the method the team will use over time. Document how an authorized operator recovers management access without making private-credential sharing the usual onboarding process.

Check network exposure against the intended audience. A local pilot does not need to become an unrestricted administration endpoint. Verify the bind address and actual access route rather than assuming the browser address shows who else can connect. Keep a small inventory of permitted operators and dependent processes.

## Test one model and its records

| Check | Evidence |
| --- | --- |
| Entry appears in UI | Configuration was saved |
| Control request returns expected output | The basic route executes |
| Usage record appears | Data exists for reconciliation |
| Entry survives restart | A small lifecycle segment was verified |

Use one authorized endpoint, a non-sensitive prompt and a small output limit. A saved row does not prove upstream credentials, model identifiers and mandatory parameters work. Inspect the actual response and accounting instead of treating successful form submission as the entire installation test.

## Issue client access and recover

Create a scoped application key rather than distributing the administrative key. Test an allowed request and a deliberately excluded model in the authorized pilot. Revoke a separate test credential and confirm that old access stops working while unrelated applications retain their rights.

Restart the installation and confirm required records persist. Document retained volumes, restoration and eventual cleanup. For a hardware proposal, these checks show the management work around the model server.

Official references: [docs.litellm.ai — ui](https://docs.litellm.ai/docs/proxy/ui), [docs.litellm.ai — docker quick start](https://docs.litellm.ai/docs/proxy/docker_quick_start).

Related guides: [LiteLLM virtual keys: separate access for each application](/journal/litellm-virtual-key-scopes/), [LiteLLM budgets: periods, shared limits and overrun tests](/journal/litellm-budget-reset/).