localhost:11434: Ollama's default port and API explained

Ollama's default port is 11434: the Ollama server listens on 127.0.0.1:11434 and serves its REST API at http://localhost:11434. Open that URL and a running server replies with the plain text Ollama is running. If the connection is refused, the Ollama server isn't running; if it works locally but not from another machine, it's still bound to loopback.

What runs on port 11434

Only Ollama. The useful endpoints:

curl http://localhost:11434/api/chat -d '{
  "model": "llama3.2",
  "messages": [{ "role": "user", "content": "Hello" }],
  "stream": false
}'

OpenAI SDKs work by setting the base URL to http://localhost:11434/v1 and any non-empty API key.

Fix "localhost:11434 refused to connect"

1. Start the server. The desktop app on macOS and Windows runs it in the background; on Linux it's usually the ollama systemd service (systemctl status ollama). Or run ollama serve in a terminal.
2. address already in use when you run ollama serve means the app or service is already running. That's fine: use it, or stop it first.
3. From Docker. A container's localhost is the container. On Docker Desktop, call http://host.docker.internal:11434. On Linux, add --add-host=host.docker.internal:host-gateway and set Ollama to listen on more than loopback.
4. Open WebUI and similar UIs need OLLAMA_BASE_URL (or their equivalent) pointing at an address the container can reach, not localhost.

Change the port or listen address: OLLAMA_HOST

OLLAMA_HOST sets where the server binds. Set it for the server process, then restart it:

# one-off
OLLAMA_HOST=0.0.0.0:11434 ollama serve

# Linux systemd service
sudo systemctl edit ollama.service
#   [Service]
#   Environment="OLLAMA_HOST=0.0.0.0:11434"
sudo systemctl restart ollama

# macOS app
launchctl setenv OLLAMA_HOST "0.0.0.0:11434"   # then quit and reopen Ollama

On Windows, add OLLAMA_HOST under user environment variables and restart Ollama from the tray. The same variable tells the ollama CLI which server to talk to, so OLLAMA_HOST=gpu-box:11434 ollama list queries a remote machine.

To free the port: lsof -i :11434 then kill -9 PID on macOS and Linux, or netstat -ano | findstr :11434 and taskkill /PID <pid> /F on Windows. If it's the systemd service, stop it with systemctl stop ollama instead or it restarts.

CORS: OLLAMA_ORIGINS

Ollama allows browser requests from localhost origins by default. A web app on another origin, or a browser extension, gets a 403 or CORS error until you add it:

OLLAMA_ORIGINS="https://my-app.example.com,chrome-extension://*" ollama serve

This controls which browsers may call the API. It isn't authentication: curl ignores CORS completely.

Exposing Ollama safely

Ollama has no authentication. Anyone who can reach 11434 can run prompts on your GPU, pull multi-gigabyte models, and delete the ones you have. Scans regularly find many thousands of Ollama servers left open on the internet. Before you make it reachable:

• Same LAN only: OLLAMA_HOST=0.0.0.0 and a firewall rule that limits 11434 to your subnet.
• Remote, personal use: an SSH tunnel (ssh -L 11434:localhost:11434 user@gpu-box) or a VPN such as WireGuard. Nothing public.
• Remote, shared or for an app: put a reverse proxy with authentication (Caddy, Nginx or Traefik with an API key or basic auth) in front of Ollama, and expose the proxy, not 11434:

relay connect --name my-llm http://localhost:8443   # your auth proxy, not Ollama

If Ollama is bound to loopback, it rejects requests whose Host header isn't a local name with a 403. Have the proxy set Host: localhost:11434 when it forwards upstream. Ollama's own docs recommend the same host-header rewrite for tunnels.

If you're building an AI agent that reacts to events (a GitHub issue, a Stripe payment), you usually don't need Ollama public at all. Receive the webhooks locally and call Ollama on localhost; see self-hosted AI agent webhooks.