> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vikat.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Client Configuration

> Configure the Vikat client: connection pool, logging, CORS, header filtering, compat shims, and MCP settings

The `vikat.client` block controls how Vikat manages its internal worker pool, request logging, authentication enforcement, header policies, SDK compatibility shims, and MCP agent behaviour. All settings map directly to the `client` section of the rendered `config.json`.

***

## Connection Pool

| Parameter                         | Description                                         | Default |
| --------------------------------- | --------------------------------------------------- | ------- |
| `vikat.client.initialPoolSize`    | Pre-allocated worker goroutines per provider queue  | `300`   |
| `vikat.client.dropExcessRequests` | Drop requests when queue is full instead of waiting | `false` |

A larger pool reduces latency spikes under burst load at the cost of higher baseline memory. For production workloads with multiple providers, `1000` is a common starting point.

```yaml theme={null}
# client-pool.yaml
image:
  tag: "v1.4.11"

vikat:
  client:
    initialPoolSize: 1000
    dropExcessRequests: true   # Return 429 instead of queuing indefinitely
```

```bash theme={null}
helm install vikat vikat/vikat -f client-pool.yaml

# Or set inline
helm upgrade vikat vikat/vikat \
  --reuse-values \
  --set vikat.client.initialPoolSize=1000 \
  --set vikat.client.dropExcessRequests=true
```

***

## Request & Response Logging

| Parameter                            | Description                                      | Default |
| ------------------------------------ | ------------------------------------------------ | ------- |
| `vikat.client.enableLogging`         | Log all LLM requests and responses               | `true`  |
| `vikat.client.disableContentLogging` | Strip message content from logs (keeps metadata) | `false` |
| `vikat.client.logRetentionDays`      | Days to retain log entries in the store          | `365`   |
| `vikat.client.loggingHeaders`        | HTTP request headers to capture in log metadata  | `[]`    |

Set `disableContentLogging: true` for HIPAA / PCI compliance workloads where message content must not be persisted.

```yaml theme={null}
vikat:
  client:
    enableLogging: true
    disableContentLogging: true    # PII / compliance: store metadata only
    logRetentionDays: 90
    loggingHeaders:
      - "x-request-id"
      - "x-user-id"
```

```bash theme={null}
helm upgrade vikat vikat/vikat \
  --reuse-values \
  --set vikat.client.disableContentLogging=true \
  --set vikat.client.logRetentionDays=90
```

***

## Security & CORS

| Parameter                              | Description                                              | Default |
| -------------------------------------- | -------------------------------------------------------- | ------- |
| `vikat.client.allowedOrigins`          | CORS allowed origins                                     | `["*"]` |
| `vikat.client.enforceGovernanceHeader` | Require `x-vikat-vk` virtual-key header on every request | `false` |
| `vikat.client.maxRequestBodySizeMb`    | Maximum allowed request body size                        | `100`   |
| `vikat.client.whitelistedRoutes`       | Routes that bypass auth middleware                       | `[]`    |

```yaml theme={null}
vikat:
  client:
    allowedOrigins:
      - "https://app.yourdomain.com"
      - "https://admin.yourdomain.com"
    enforceGovernanceHeader: true  # Every request must carry a virtual key
    maxRequestBodySizeMb: 50
    whitelistedRoutes:
      - "/health"
      - "/metrics"
```

```bash theme={null}
helm install vikat vikat/vikat \
  --set image.tag=v1.4.11 \
  --set vikat.client.enforceGovernanceHeader=true
```

***

## Header Filtering

Controls which `x-vikat-eh-*` headers are forwarded to upstream LLM providers.

| Parameter                                   | Description                                         | Default |
| ------------------------------------------- | --------------------------------------------------- | ------- |
| `vikat.client.headerFilterConfig.allowlist` | Only these headers are forwarded (whitelist mode)   | `[]`    |
| `vikat.client.headerFilterConfig.denylist`  | These headers are always blocked                    | `[]`    |
| `vikat.client.requiredHeaders`              | Headers that must be present on every request       | `[]`    |
| `vikat.client.allowedHeaders`               | Additional headers permitted for CORS and WebSocket | `[]`    |

When both lists are empty, all `x-vikat-eh-*` headers pass through. Specifying an `allowlist` enables strict whitelist mode - only listed headers are forwarded.

```yaml theme={null}
vikat:
  client:
    headerFilterConfig:
      allowlist:
        - "x-vikat-eh-anthropic-version"
        - "x-vikat-eh-openai-beta"
      denylist: []
    requiredHeaders:
      - "x-request-id"
```

***

## Authentication

| Parameter                                 | Description                                             | Default      |
| ----------------------------------------- | ------------------------------------------------------- | ------------ |
| `vikat.authConfig.isEnabled`              | Enable username/password auth for the API and dashboard | `false`      |
| `vikat.authConfig.adminUsername`          | Admin username (plain text, prefer secret)              | `""`         |
| `vikat.authConfig.adminPassword`          | Admin password (plain text, prefer secret)              | `""`         |
| `vikat.authConfig.existingSecret`         | Kubernetes Secret name for credentials                  | `""`         |
| `vikat.authConfig.usernameKey`            | Key within the secret for username                      | `"username"` |
| `vikat.authConfig.passwordKey`            | Key within the secret for password                      | `"password"` |
| `vikat.authConfig.disableAuthOnInference` | Skip auth check on `/v1/*` inference routes             | `false`      |

```bash theme={null}
# Create secret first
kubectl create secret generic vikat-admin \
  --from-literal=username='admin' \
  --from-literal=password='your-secure-password'
```

```yaml theme={null}
vikat:
  authConfig:
    isEnabled: true
    disableAuthOnInference: false
    existingSecret: "vikat-admin"
    usernameKey: "username"
    passwordKey: "password"
```

```bash theme={null}
helm upgrade vikat vikat/vikat \
  --reuse-values \
  -f auth-values.yaml
```

***

## Encryption

| Parameter                        | Description                                                                                                              | Default            |
| -------------------------------- | ------------------------------------------------------------------------------------------------------------------------ | ------------------ |
| `vikat.encryptionKey`            | Optional encryption key (plain text - use `encryptionKeySecret` in production). If omitted, data is stored in plaintext. | `""`               |
| `vikat.encryptionKeySecret.name` | Kubernetes Secret name containing the key                                                                                | `""`               |
| `vikat.encryptionKeySecret.key`  | Key within the secret                                                                                                    | `"encryption-key"` |

Always use a Kubernetes Secret in production:

```bash theme={null}
kubectl create secret generic vikat-encryption \
  --from-literal=encryption-key='your-32-byte-encryption-key-here'
```

```yaml theme={null}
vikat:
  encryptionKeySecret:
    name: "vikat-encryption"
    key: "encryption-key"
```

```bash theme={null}
helm install vikat vikat/vikat \
  --set image.tag=v1.4.11 \
  -f encryption-values.yaml
```

***

## Async Jobs & Database Pings

| Parameter                             | Description                                   | Default |
| ------------------------------------- | --------------------------------------------- | ------- |
| `vikat.client.disableDbPingsInHealth` | Exclude DB connectivity from `/health` checks | `false` |
| `vikat.client.asyncJobResultTTL`      | TTL (seconds) for async job results           | `3600`  |

***

## Compat Shims

Compatibility flags that let Vikat silently adapt request/response shapes for SDK integrations:

| Parameter                                    | Description                                              | Default |
| -------------------------------------------- | -------------------------------------------------------- | ------- |
| `vikat.client.compat.convertTextToChat`      | Wrap legacy text completions as chat messages            | `false` |
| `vikat.client.compat.convertChatToResponses` | Translate chat completions to Responses API format       | `false` |
| `vikat.client.compat.shouldDropParams`       | Silently drop unsupported parameters instead of erroring | `false` |
| `vikat.client.compat.shouldConvertParams`    | Auto-convert parameter names across provider schemas     | `false` |

```yaml theme={null}
vikat:
  client:
    compat:
      shouldDropParams: true     # Useful when proxying mixed SDK traffic
      convertTextToChat: true    # For clients using the legacy /v1/completions endpoint
```

***

## Prometheus Labels

Add custom labels to every Prometheus metric emitted by Vikat:

```yaml theme={null}
vikat:
  client:
    prometheusLabels:
      - name: "environment"
        value: "production"
      - name: "region"
        value: "us-east-1"
```

***

## MCP Agent Settings

| Parameter                                           | Description                                                                                                                                                                                                                                     | Default  |
| --------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| `vikat.mcp.toolManagerConfig.maxAgentDepth`         | Maximum tool-call recursion depth for MCP agent mode                                                                                                                                                                                            | `10`     |
| `vikat.mcp.toolManagerConfig.toolExecutionTimeout`  | Timeout per tool execution in seconds                                                                                                                                                                                                           | `30`     |
| `vikat.mcp.toolManagerConfig.codeModeBindingLevel`  | Code mode binding level (`server` or `tool`)                                                                                                                                                                                                    | `server` |
| `vikat.mcp.toolManagerConfig.disableAutoToolInject` | Disable automatic MCP tool injection                                                                                                                                                                                                            | `false`  |
| `vikat.mcp.toolSyncInterval`                        | Global tool sync interval as a Go duration string (for example `10m`). Use `0s` to use the runtime default (it does **not** disable sync). This differs from legacy `vikat.client.mcpToolSyncInterval: 0`, which represented disabled behavior. | `10m`    |

```yaml theme={null}
vikat:
  mcp:
    toolSyncInterval: "15m"
    toolManagerConfig:
      maxAgentDepth: 15
      toolExecutionTimeout: 60
      codeModeBindingLevel: "tool"
      disableAutoToolInject: false
```

***

## Full Example

```yaml theme={null}
# client-full.yaml
image:
  tag: "v1.4.11"

vikat:
  encryptionKeySecret:
    name: "vikat-encryption"
    key: "encryption-key"

  authConfig:
    isEnabled: true
    disableAuthOnInference: false
    existingSecret: "vikat-admin"
    usernameKey: "username"
    passwordKey: "password"

  client:
    initialPoolSize: 1000
    dropExcessRequests: true
    allowedOrigins:
      - "https://app.yourdomain.com"
    enableLogging: true
    disableContentLogging: false
    logRetentionDays: 90
    enforceGovernanceHeader: true
    maxRequestBodySizeMb: 100
    headerFilterConfig:
      allowlist: []
      denylist: []
    prometheusLabels:
      - name: "environment"
        value: "production"
  mcp:
    toolSyncInterval: "10m"
    toolManagerConfig:
      maxAgentDepth: 10
      toolExecutionTimeout: 30
      codeModeBindingLevel: "server"
      disableAutoToolInject: false
```

```bash theme={null}
# Create prerequisites
kubectl create secret generic vikat-encryption \
  --from-literal=encryption-key='your-32-byte-encryption-key-here'

kubectl create secret generic vikat-admin \
  --from-literal=username='admin' \
  --from-literal=password='your-secure-password'

# Install
helm install vikat vikat/vikat -f client-full.yaml
```