Skip to content

Let web apps use your models

A web app, such as a Cinchapi app, can run your local models from the browser. It calls Ollama through pasture like any other tool, and it sees moved-away models in the model lists too. Ollama answers a web page only when the page's origin is one it accepts, so allow the app's origin first. The Cinchapi apps run at https://cinchapi.com, such as Relay at https://cinchapi.com/relay, so their origin is https://cinchapi.com:

pasture allow https://cinchapi.com

Choose the origin to allow

An origin is the scheme, host, and port of an address, without the path. So an origin covers every app served from it. Every Cinchapi app shares https://cinchapi.com, and allowing it lets all of them call your models. Another host is another origin. To use Cinchapi's staging or development site, allow https://staging.cinchapi.com or https://dev.cinchapi.com as well.

pasture saves the origin, adds it to the OLLAMA_ORIGINS of the ollama serve it starts, after any origins that pasture env OLLAMA_ORIGINS=... sets, and restarts Ollama, which reads that variable only when it starts. pasture status lists the allowed origins.

Give the origin as the browser's address bar shows it before the path: https:// or http://, the host, and a port when the address has one. Ollama compares origins as plain text, so pasture saves the form that the browser sends: in lowercase, without a default port, and without leading zeroes in the port. pasture refuses a port above 65535. It also refuses a wildcard, such as https://*.example.com, because Ollama matches a wildcard as plain text: https://*example.com would also allow https://evilexample.com. Allow each origin by name.

Ollama already accepts pages from localhost and 127.0.0.1 on any port, and pages that a desktop app loads from app://, file://, or tauri://. The Cinchapi desktop app loads from app://relay, so it needs no pasture allow. A desktop app needs pasture allow only when it loads the app from an https:// address.

What an allowed page can do

A page from an allowed origin can use Ollama's API as it could with Ollama alone: it can list, run, and download models, and delete the models on disk that have no archive copy. It cannot delete a model that is moved away or that the archive holds a copy of, which would delete the archive copy too, and it cannot use pasture's own commands. Both need the admin token. pasture serve writes a new token each time it starts, to a file that only you can read, and the pasture command sends it.

The model list for apps

GET /api/pasture/models lists every model in the library, on disk or moved away, with what each one can do. Cinchapi reads it, through the link, to offer your models. Listing a model does not bring it back.

{"models": [{"name": "qwen3:8b", "size": 5225376047, "where": "disk",
  "capabilities": ["completion", "tools", "thinking"],
  "context_length": 40960, "loaded": true, "pinned": false}]}
  • where is disk, archive (moved away, and comes back from the archive folder with no network), or registry (moved away, and comes back by download).
  • capabilities and context_length come from Ollama's /api/show. context_length is left out when Ollama does not report one.
  • loading is there only while a moved-away model comes back to the disk, and says how far it has come: {"done": 5000000000, "total": 10000000000} is halfway through a 10 GB model. where stays archive or registry until the model is back. The link sends the list again within 10 seconds of a change, so Cinchapi sees the progress as it goes.

pasture answers it under the same Host and Origin check as /api/tags, with the same CORS headers, so a web app on an origin that pasture allow allowed can read it. It needs no admin token.