Run with Docker or a binary
Run Maple Proxy independently with Docker or a release binary. Verify downloads, connect with your API key, and configure ports, browser access and timeouts.
Use a dedicated proxy when your tools run on a server or without the desktop app. Keep it on the same machine as your application where possible: the application-to-proxy connection is plaintext.
Docker
The image supports AMD64 and ARM64. Publish its port only on loopback:
docker run --rm -p 127.0.0.1:8080:8080 \
ghcr.io/mapleprivacylabs/maple-proxy:latestThe image enables CORS, so each request must send its own API key. It does not use MAPLE_API_KEY while CORS is on. It includes a local health check and connects to Maple’s production service.
For a persistent deployment, pin the image tag or digest you have tested. Only for a private deployment where every caller is trusted, add -e MAPLE_ENABLE_CORS=false -e MAPLE_API_KEY after exporting your key. See authentication.
Binary
Download the archive for your platform and the checksum file. These links use Maple release v3.4.3 (proxy 0.4.1).
Verify and extract the archive before running it. Linux x86_64:
curl -LO https://github.com/MaplePrivacyLabs/Maple/releases/download/v3.4.3/maple-proxy-linux-x86_64.tar.gz
curl -LO https://github.com/MaplePrivacyLabs/Maple/releases/download/v3.4.3/maple-proxy-release-final.sha256
sha256sum --check --ignore-missing maple-proxy-release-final.sha256
tar -xzf maple-proxy-linux-x86_64.tar.gz
export MAPLE_API_KEY='your-real-maple-api-key'
./maple-proxyOn macOS, verify with shasum -a 256 --check --ignore-missing maple-proxy-release-final.sha256. This binary is not notarized; after verifying and extracting it, remove the download quarantine with xattr -d com.apple.quarantine ./maple-proxy if macOS blocks it. On Windows, compare Get-FileHash <archive> -Algorithm SHA256 with the checksum file, extract the ZIP, set $env:MAPLE_API_KEY, and run ./maple-proxy.exe.
The binary defaults to 127.0.0.1:8080, with CORS off. It can use the exported key for requests without an Authorization header.
Connect your client
Create a Maple key and export it in the shell making requests. Starting the desktop app or a container does not set this shell variable:
export MAPLE_API_KEY='your-real-maple-api-key'
curl http://127.0.0.1:8080/v1/models \
-H "Authorization: Bearer $MAPLE_API_KEY"This checks the connection and credentials, and returns the API catalog; it does not prove model access or successful inference. Use http://127.0.0.1:8080/v1 as the client base URL, your real key, and a model suited to your task. See the API reference.
Settings
Environment variables configure the standalone proxy; command-line flags take priority. Run maple-proxy --help for all options in your version.
| Setting | Default | Use |
|---|---|---|
MAPLE_HOST, MAPLE_PORT | 127.0.0.1, 8080 | Numeric listen address and port. Docker listens on 0.0.0.0 inside the container; control exposure with the published port. |
MAPLE_ENABLE_CORS | Off; on in Docker | Browser response access. Requires per-request keys when on. |
MAPLE_API_KEY | None | Saved key for trusted callers when CORS is off. |
MAPLE_REQUEST_TIMEOUT_SECS | 300 | Time before a response starts; also caps the full non-streaming response. Initial enclave verification has a separate timeout budget. |
MAPLE_STREAM_IDLE_TIMEOUT_SECS | 300 | Maximum gap between response chunks. Streaming has no total-duration cap. |
MAPLE_DEBUG | false | Enable request method/path debug logs when diagnosing a problem. |
Both timeouts must be positive. A timeout after a response starts ends the body; do not assume retrying a request cannot run it twice.
Optionally keep MAPLE_CACHE_NAMESPACE_ROOT in your secrets manager to preserve cache continuity across restarts. Generate it once with openssl rand -base64 32; cache hits are not guaranteed. Keep it and API keys out of source control.
Last updated