chore(ocr): merge Rust cutover branch

Co-Authored-By: Ishaan Jaffer <155045088+ishaan-berri@users.noreply.github.com>
2026-10-06 02:48:13 +00:00 · 2026-07-27 17:56:26 +00:00 · 2026-07-27 17:56:26 +00:00 · 09421ed623
commit 09421ed623
parent 4a73fa4bbd b5818d194c
2072 changed files with 99851 additions and 35759 deletions
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@ -2731,7 +2731,7 @@ jobs:
            - ~/.cache/uv
      - restore_cache:
          keys:
-            - ui-e2e-node-deps-v2-{{ checksum "ui/litellm-dashboard/package-lock.json" }}
+            - ui-e2e-node-deps-v3-{{ checksum "ui/litellm-dashboard/package-lock.json" }}-{{ checksum "tests/e2e/ui/package-lock.json" }}
      - run:
          name: Install Node dependencies and Playwright
          # The cimg/python:3.12-browsers image already ships the Chromium system
@ -2742,11 +2742,14 @@ jobs:
          command: |
            cd ui/litellm-dashboard
            npm ci
+            cd ../../tests/e2e/ui
+            npm ci
            npx playwright install chromium
      - save_cache:
-          key: ui-e2e-node-deps-v2-{{ checksum "ui/litellm-dashboard/package-lock.json" }}
+          key: ui-e2e-node-deps-v3-{{ checksum "ui/litellm-dashboard/package-lock.json" }}-{{ checksum "tests/e2e/ui/package-lock.json" }}
          paths:
            - ui/litellm-dashboard/node_modules
+            - tests/e2e/ui/node_modules
            - ~/.cache/ms-playwright
      - run:
          name: Build UI from source
@ -2777,10 +2780,10 @@ jobs:
          name: Seed database
          command: |
            PGPASSWORD=e2epassword psql -h localhost -p 5432 -U e2euser -d litellm_e2e \
-              -f ui/litellm-dashboard/e2e_tests/fixtures/seed.sql
+              -f tests/e2e/ui/fixtures/seed.sql
      - run:
          name: Start mock LLM server
-          command: uv run --no-sync python ui/litellm-dashboard/e2e_tests/fixtures/mock_llm_server/server.py
+          command: uv run --no-sync python tests/e2e/ui/fixtures/mock_llm_server/server.py
          background: true
      - run:
          name: Start LiteLLM proxy
@ -2798,7 +2801,7 @@ jobs:
          command: |
            LITELLM_LICENSE="$LITELLM_LICENSE" \
              uv run --no-sync python -m litellm.proxy.proxy_cli \
-                --config ui/litellm-dashboard/e2e_tests/fixtures/config.yml \
+                --config tests/e2e/ui/fixtures/config.yml \
                --port 4000
          background: true
      - run:
@ -2819,15 +2822,15 @@ jobs:
          # Forward LITELLM_LICENSE so license.spec.ts can detect that the
          # proxy was launched with a license and assert premium_user=true.
          command: |
-            cd ui/litellm-dashboard
+            cd tests/e2e/ui
            LITELLM_LICENSE="$LITELLM_LICENSE" \
-              npx playwright test --config e2e_tests/playwright.config.ts
+              npx playwright test --config playwright.config.ts
          no_output_timeout: 10m
      - store_artifacts:
-          path: ui/litellm-dashboard/test-results
+          path: tests/e2e/ui/test-results
          destination: e2e-test-results
      - store_artifacts:
-          path: ui/litellm-dashboard/playwright-report
+          path: tests/e2e/ui/playwright-report
          destination: e2e-playwright-report

  e2e_ui_testing_server_root_path:
@ -2870,17 +2873,20 @@ jobs:
            - ~/.cache/uv
      - restore_cache:
          keys:
-            - ui-e2e-node-deps-v2-{{ checksum "ui/litellm-dashboard/package-lock.json" }}
+            - ui-e2e-node-deps-v3-{{ checksum "ui/litellm-dashboard/package-lock.json" }}-{{ checksum "tests/e2e/ui/package-lock.json" }}
      - run:
          name: Install Node dependencies and Playwright
          command: |
            cd ui/litellm-dashboard
            npm ci
+            cd ../../tests/e2e/ui
+            npm ci
            npx playwright install chromium
      - save_cache:
-          key: ui-e2e-node-deps-v2-{{ checksum "ui/litellm-dashboard/package-lock.json" }}
+          key: ui-e2e-node-deps-v3-{{ checksum "ui/litellm-dashboard/package-lock.json" }}-{{ checksum "tests/e2e/ui/package-lock.json" }}
          paths:
            - ui/litellm-dashboard/node_modules
+            - tests/e2e/ui/node_modules
            - ~/.cache/ms-playwright
      - run:
          name: Build UI from source
@ -2902,10 +2908,10 @@ jobs:
          name: Seed database
          command: |
            PGPASSWORD=e2epassword psql -h localhost -p 5432 -U e2euser -d litellm_e2e \
-              -f ui/litellm-dashboard/e2e_tests/fixtures/seed.sql
+              -f tests/e2e/ui/fixtures/seed.sql
      - run:
          name: Start mock LLM server
-          command: uv run --no-sync python ui/litellm-dashboard/e2e_tests/fixtures/mock_llm_server/server.py
+          command: uv run --no-sync python tests/e2e/ui/fixtures/mock_llm_server/server.py
          background: true
      - run:
          name: Start LiteLLM proxy under a server root path
@ -2918,7 +2924,7 @@ jobs:
          command: |
            LITELLM_LICENSE="$LITELLM_LICENSE" \
              uv run --no-sync python -m litellm.proxy.proxy_cli \
-                --config ui/litellm-dashboard/e2e_tests/fixtures/config.yml \
+                --config tests/e2e/ui/fixtures/config.yml \
                --port 4000
          background: true
      - run:
@ -2937,15 +2943,15 @@ jobs:
      - run:
          name: Run migration smoke under SERVER_ROOT_PATH
          command: |
-            cd ui/litellm-dashboard
+            cd tests/e2e/ui
            LITELLM_LICENSE="$LITELLM_LICENSE" \
-              npx playwright test --config e2e_tests/migration.serverRootPath.config.ts
+              npx playwright test --config migration.serverRootPath.config.ts
          no_output_timeout: 10m
      - store_artifacts:
-          path: ui/litellm-dashboard/test-results
+          path: tests/e2e/ui/test-results
          destination: e2e-server-root-path-test-results
      - store_artifacts:
-          path: ui/litellm-dashboard/playwright-report
+          path: tests/e2e/ui/playwright-report
          destination: e2e-server-root-path-playwright-report

  build_docker_database_image:
--- a/.circleci/scripts/classify_changes.sh
+++ b/.circleci/scripts/classify_changes.sh
@ -8,7 +8,7 @@ has_backend=false
 while IFS= read -r file || [ -n "$file" ]; do
  [ -n "$file" ] || continue
  case "$file" in
-    ui/*) has_client=true ;;
+    ui/* | tests/e2e/ui/*) has_client=true ;;
    docs/* | *.md | *.mdx) : ;;
    *) has_backend=true ;;
  esac
--- a/.github/ISSUE_TEMPLATE/bug_report.yml
+++ b/.github/ISSUE_TEMPLATE/bug_report.yml
@ -30,7 +30,7 @@ body:
    id: steps-to-reproduce
    attributes:
      label: Steps to Reproduce
-      description: Please provide detailed steps to reproduce this bug(A curl/python code to reproduce the bug)
+      description: Please provide a numbered list of the exact steps to reproduce this bug (include a curl/python snippet to reproduce it). Number each step (1., 2., 3., ...) in the order you performed them.
      placeholder: |
        1. config.yaml file/ .env file/ etc.
        2. Run the following code...
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@ -1,3 +1,18 @@
+## TLDR
+
+<!-- Fill in the bullets below and keep each one short and concrete: one line per bullet, roughly 10 words max
+     This section must be extremely human parsable, comprehensible, and readable: its target audience is humans, not AI agents -->
+
+Problem this solves:
+
+- <blah>
+- ...
+
+How it solves it:
+
+- <blah>
+- ...
+
 ## Relevant issues

 <!-- e.g., "Fixes #000" -->
--- a/.github/workflows/_test-unit-base.yml
+++ b/.github/workflows/_test-unit-base.yml
@ -80,7 +80,7 @@ jobs:
      - name: Install dependencies
        if: steps.changes.outputs.decision != 'skip'
        run: |
-          .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router
+          .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router --extra saml

      - name: Generate Prisma client
        if: steps.changes.outputs.decision != 'skip'
--- a/.github/workflows/codspeed.yml
+++ b/.github/workflows/codspeed.yml
@ -5,10 +5,24 @@ on:
    branches:
      - main
      - litellm_internal_staging
+    paths:
+      - "litellm/**"
+      - "tests/benchmarks/**"
+      - "pyproject.toml"
+      - "uv.lock"
+      - ".github/workflows/codspeed.yml"
+      - ".github/actions/setup-uv-with-retries/**"
  pull_request:
    branches:
      - main
      - litellm_internal_staging
+    paths:
+      - "litellm/**"
+      - "tests/benchmarks/**"
+      - "pyproject.toml"
+      - "uv.lock"
+      - ".github/workflows/codspeed.yml"
+      - ".github/actions/setup-uv-with-retries/**"
  # Allow CodSpeed to trigger backtest performance analysis
  # in order to generate initial data
  workflow_dispatch:
--- a/.github/workflows/create_daily_oss_branch.yml
+++ b/.github/workflows/create_daily_oss_branch.yml
@ -1,61 +0,0 @@
-name: Create Daily OSS Branch
-
-on:
-  schedule:
-    - cron: "0 16 * * 1-5" # 9am PT during daylight saving time, weekdays.
-  workflow_dispatch:
-    inputs:
-      date:
-        description: "Branch date in YYYY_MM_DD format. Defaults to today's UTC date."
-        required: false
-        type: string
-
-permissions:
-  contents: write
-
-jobs:
-  create-oss-branch:
-    if: github.repository == 'BerriAI/litellm'
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-
-      - name: Create dated OSS branch
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          REQUESTED_DATE: ${{ inputs.date }}
-        run: |
-          set -euo pipefail
-
-          if [ -n "${REQUESTED_DATE}" ]; then
-            if ! echo "${REQUESTED_DATE}" | grep -Eq '^[0-9]{4}_[0-9]{2}_[0-9]{2}$'; then
-              echo "::error::date must use YYYY_MM_DD format, got '${REQUESTED_DATE}'"
-              exit 1
-            fi
-            BRANCH_DATE="${REQUESTED_DATE}"
-          else
-            BRANCH_DATE="$(date -u +'%Y_%m_%d')"
-          fi
-
-          BRANCH_NAME="litellm_oss_daily_${BRANCH_DATE}"
-          echo "Creating branch: ${BRANCH_NAME}"
-
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-
-          git fetch origin main "${BRANCH_NAME}" || true
-
-          if git show-ref --verify --quiet "refs/remotes/origin/${BRANCH_NAME}"; then
-            echo "Branch ${BRANCH_NAME} already exists. Skipping creation."
-            exit 0
-          fi
-
-          git checkout -b "${BRANCH_NAME}" origin/main
-          git push "https://x-access-token:${GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" "${BRANCH_NAME}"
-          echo "Successfully created and pushed branch: ${BRANCH_NAME}"
--- a/.github/workflows/guard-main-branch.yml
+++ b/.github/workflows/guard-main-branch.yml
@ -31,12 +31,12 @@ jobs:
          echo "PR head repo: $HEAD_REPO"
          echo "PR head branch: $HEAD_REF"
          if [ "$HEAD_REPO" != "$BASE_REPO" ]; then
-            echo "::error::PRs to main must originate from the canonical repository ($BASE_REPO), not a fork ($HEAD_REPO). External contributors should open PRs against the current daily OSS branch (named litellm_oss_daily_YYYY_MM_DD; a fresh one is cut each weekday, so target the most recent) instead."
+            echo "::error::PRs to main must originate from the canonical repository ($BASE_REPO), not a fork ($HEAD_REPO). External contributors should open PRs against 'litellm_internal_staging' instead."
            exit 1
          fi
          if [ "$HEAD_REF" = "litellm_internal_staging" ] || [[ "$HEAD_REF" == litellm_hotfix_?* ]]; then
            echo "Allowed source branch."
            exit 0
          fi
-          echo "::error::PRs to main must originate from 'litellm_internal_staging' or a 'litellm_hotfix_*' branch. Got: '$HEAD_REF'. If this is a contribution, retarget the PR against the current daily OSS branch (named litellm_oss_daily_YYYY_MM_DD; a fresh one is cut each weekday, so target the most recent) instead."
+          echo "::error::PRs to main must originate from 'litellm_internal_staging' or a 'litellm_hotfix_*' branch. Got: '$HEAD_REF'. If this is a contribution, retarget the PR against 'litellm_internal_staging' instead."
          exit 1
--- a/.github/workflows/image-scan.yml
+++ b/.github/workflows/image-scan.yml
@ -9,6 +9,7 @@ on:
      - "litellm_**"
    paths:
      - docker/Dockerfile.non_root
+      - tests/proxy_migration_tests/test_offline_image_migration.py
      - uv.lock
      - ui/litellm-dashboard/package-lock.json
      - .github/workflows/image-scan.yml
@ -51,6 +52,23 @@ jobs:
      - name: Build runtime image
        run: docker build -f docker/Dockerfile.non_root -t litellm-image-scan:${{ github.sha }} .

+      # The prisma bake must migrate a fresh DB with no egress as an arbitrary
+      # non-root uid (OpenShift restricted-v2 / air-gapped / readOnlyRootFilesystem).
+      # `docker run` as the default uid with network hides a broken bake because
+      # the migration entrypoint exits 0 even when it applied nothing; asserting
+      # the schema was created is what catches it.
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+
+      - name: Verify offline migration as a non-root uid
+        env:
+          LITELLM_IMAGE: litellm-image-scan:${{ github.sha }}
+        run: |
+          python -m pip install "pytest==9.0.3"
+          python -m pytest tests/proxy_migration_tests/test_offline_image_migration.py -v
+
      # Scans the whole shipped artifact: OS/apk plus every language package
      # baked into the image, including ones no lockfile declares (e.g. prisma's
      # vendored node engine) that osv-scan cannot see. osv-scan stays the fast
@ -58,6 +76,8 @@ jobs:
      # free OSS, run as a pinned, checksum-verified binary; no GitHub Action
      # dependency and no vendor SaaS callout.
      - name: Scan image for fixable HIGH/CRITICAL CVEs
+        env:
+          GRYPE_MATCH_PYTHON_USING_CPES: "true"
        run: |
          "$RUNNER_TEMP/grype" litellm-image-scan:${{ github.sha }} \
            --only-fixed \
--- a/.github/workflows/mutation-test.yml
+++ b/.github/workflows/mutation-test.yml
@ -55,7 +55,7 @@ jobs:

      - name: Install dependencies
        run: |
-          .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router
+          .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router --extra saml

      - name: Generate Prisma client
        env:
--- a/.github/workflows/oss_daily_guardrails.yml
+++ b/.github/workflows/oss_daily_guardrails.yml
@ -1,50 +0,0 @@
-name: OSS Daily Guardrails
-
-on:
-  push:
-    branches:
-      - "litellm_oss_daily_20*"
-  pull_request:
-    branches:
-      - "litellm_oss_daily_20*"
-      - litellm_internal_staging
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  oss-safe-checks:
-    name: Run OSS daily safe checks
-    if: startsWith(github.ref_name, 'litellm_oss_daily_20') || startsWith(github.head_ref, 'litellm_oss_daily_20') || startsWith(github.base_ref, 'litellm_oss_daily_20')
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          persist-credentials: false
-
-      - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
-        with:
-          python-version: "3.12"
-
-      - name: Set up uv
-        uses: ./.github/actions/setup-uv-with-retries
-        with:
-          version: "0.10.9"
-
-      - name: Run secret scan test
-        run: |
-          uv run --frozen --with 'pytest==9.0.2' pytest tests/litellm/test_no_hardcoded_secrets.py -v
-
-      - name: Run Ruff
-        run: |
-          uv sync --frozen
-          cd litellm
-          uv run --no-sync ruff check .
--- a/.github/workflows/test-code-quality.yml
+++ b/.github/workflows/test-code-quality.yml
@ -115,6 +115,9 @@ jobs:
      - name: check_fastuuid_usage
        run: uv run --no-sync python ./tests/code_coverage_tests/check_fastuuid_usage.py

+      - name: check_e2e_no_raw_requests
+        run: uv run --no-sync python ./tests/code_coverage_tests/check_e2e_no_raw_requests.py
+
      - name: memory_test
        run: uv run --no-sync python ./tests/code_coverage_tests/memory_test.py

--- a/.github/workflows/test-litellm-ui-lint.yml
+++ b/.github/workflows/test-litellm-ui-lint.yml
@ -29,7 +29,15 @@ jobs:
        id: changed
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: |
+          # base.sha is the base branch tip from when the PR was opened, while
+          # actions/checkout leaves HEAD on a merge of the PR into the *current*
+          # base tip. "$BASE_SHA"...HEAD therefore spans every base-branch commit
+          # landed since, so a PR that touches no UI file still gets linted
+          # against hundreds of other people's files. Diff the PR head against its
+          # own merge base instead, which is exactly what this PR changed.
+          merge_base=$(git merge-base "$BASE_SHA" "$HEAD_SHA")
          : > "$RUNNER_TEMP/prettier_files.txt"
          : > "$RUNNER_TEMP/eslint_files.txt"
          while IFS= read -r f; do
@ -41,7 +49,7 @@ jobs:
              *.json | *.css | *.scss | *.md | *.mdx | *.yml | *.yaml | *.html)
                printf '%s\n' "$f" >> "$RUNNER_TEMP/prettier_files.txt" ;;
            esac
-          done < <(git diff --name-only --diff-filter=ACMR --relative "$BASE_SHA"...HEAD -- .)
+          done < <(git diff --name-only --diff-filter=ACMR --relative "$merge_base" "$HEAD_SHA" -- .)
          if [ -s "$RUNNER_TEMP/prettier_files.txt" ] || [ -s "$RUNNER_TEMP/eslint_files.txt" ]; then
            echo "has_files=true" >> "$GITHUB_OUTPUT"
          else
--- a/.github/workflows/test-litellm-ui-unit.yml
+++ b/.github/workflows/test-litellm-ui-unit.yml
@ -0,0 +1,57 @@
+name: UI Unit Tests
+permissions:
+  contents: read
+
+on:
+  pull_request:
+    branches:
+      - main
+      - litellm_internal_staging
+      - litellm_oss_staging
+      - "litellm_**"
+  push:
+    branches:
+      - litellm_internal_staging
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  ui-unit-tests:
+    runs-on: ubuntu-latest-16-cores
+    timeout-minutes: 20
+    defaults:
+      run:
+        working-directory: ui/litellm-dashboard
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Setup Node.js
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        with:
+          node-version: "20"
+          cache: "npm"
+          cache-dependency-path: ui/litellm-dashboard/package-lock.json
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Run UI unit tests (Vitest)
+        env:
+          CI: "true"
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+        run: |
+          if [ -n "$BASE_SHA" ]; then
+            echo "Pull request: running only tests related to changes since $BASE_SHA"
+            npm run test -- --run --changed "$BASE_SHA" --passWithNoTests \
+              --pool forks --poolOptions.forks.maxForks=14
+          else
+            echo "Push to $GITHUB_REF_NAME: running the full suite"
+            npm run test -- --run --pool forks --poolOptions.forks.maxForks=14
+          fi
--- a/.github/workflows/test-rust.yml
+++ b/.github/workflows/test-rust.yml
@ -61,5 +61,11 @@ jobs:
      - name: Run Clippy
        run: cargo clippy --workspace --all-targets --locked -- -D warnings

+      - name: Run Clippy with Bedrock auth
+        run: cargo clippy -p litellm-core --all-targets --features bedrock-auth --locked -- -D warnings
+
      - name: Run Rust tests
        run: cargo test --workspace --locked
+
+      - name: Run core tests with Bedrock auth
+        run: cargo test -p litellm-core --features bedrock-auth --locked
--- a/.github/workflows/test-unit-proxy-endpoints.yml
+++ b/.github/workflows/test-unit-proxy-endpoints.yml
@ -46,6 +46,7 @@ jobs:
        tests/test_litellm/proxy/rag_endpoints
        tests/test_litellm/proxy/realtime_endpoints
        tests/test_litellm/proxy/ui_crud_endpoints
+        tests/test_litellm/proxy/config_resolvers
        tests/test_litellm/proxy/utils
      workers: 2
      reruns: 2
--- a/.github/workflows/test_server_root_path.yml
+++ b/.github/workflows/test_server_root_path.yml
@ -1,151 +0,0 @@
-name: Test Proxy SERVER_ROOT_PATH Routing
-permissions:
-  contents: read
-
-on:
-  pull_request:
-    branches:
-      - main
-      - litellm_internal_staging
-      - litellm_oss_staging
-      - "litellm_**"
-
-jobs:
-  test-server-root-path:
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-
-    strategy:
-      fail-fast: false
-      matrix:
-        root_path: ["/api/v1", "/llmproxy"]
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          persist-credentials: false
-
-      - name: Free up disk space
-        run: |
-          sudo rm -rf /usr/local/lib/android /usr/share/dotnet /opt/ghc /usr/local/share/boost
-          sudo apt-get clean
-          df -h /
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
-
-      - name: Build Docker image
-        uses: docker/build-push-action@0adf9959216b96bec444f325f1e493d4aa344497 # v6.14.0
-        with:
-          context: .
-          file: ./docker/Dockerfile.non_root
-          tags: litellm-test:${{ github.sha }}
-          load: true
-          push: false
-
-      - name: Start LiteLLM container with SERVER_ROOT_PATH
-        run: |
-          docker run -d \
-            --name litellm-test \
-            -p 4000:4000 \
-            -e SERVER_ROOT_PATH="${{ matrix.root_path }}" \
-            -e LITELLM_MASTER_KEY="sk-1234" \
-            litellm-test:${{ github.sha }} \
-            --detailed_debug
-
-      - name: Wait for container to be healthy
-        run: |
-          echo "Waiting for LiteLLM to start..."
-          max_attempts=30
-          attempt=0
-
-          while [ $attempt -lt $max_attempts ]; do
-            if docker logs litellm-test 2>&1 | grep -q "Uvicorn running"; then
-              echo "LiteLLM started successfully"
-              break
-            fi
-            attempt=$((attempt + 1))
-            echo "Attempt $attempt/$max_attempts - waiting for server to start..."
-            sleep 2
-          done
-
-          if [ $attempt -eq $max_attempts ]; then
-            echo "Server failed to start within timeout"
-            docker logs litellm-test
-            exit 1
-          fi
-
-          sleep 5
-
-      - name: Show container logs
-        if: always()
-        run: docker logs litellm-test
-
-      - name: Test UI endpoint with root path
-        run: |
-          ROOT_PATH="${{ matrix.root_path }}"
-          echo "Testing UI at: http://localhost:4000${ROOT_PATH}/ui/"
-
-          for i in 1 2 3; do
-            content=$(curl -sL --max-time 5 -H "Authorization: Bearer sk-1234" "http://localhost:4000${ROOT_PATH}/ui/")
-            if echo "$content" | grep -q -E "(html|<!DOCTYPE|<head|<body)"; then
-              echo "UI page contains valid HTML content"
-              exit 0
-            fi
-            echo "Attempt $i/3 - no valid HTML, retrying in 5s..."
-            sleep 5
-          done
-          echo "UI page does not contain expected HTML content"
-          echo "Response: $content"
-          docker logs litellm-test
-          exit 1
-
-      - name: Setup Node for Playwright
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
-        with:
-          node-version: "20"
-
-      - name: Install UI deps and Chromium
-        working-directory: ui/litellm-dashboard
-        run: |
-          retry() {
-            local attempt=1
-            local max_attempts=4
-            until "$@"; do
-              if [ "$attempt" -ge "$max_attempts" ]; then
-                echo "Command failed after $attempt attempts: $*"
-                return 1
-              fi
-              echo "Attempt $attempt failed: $*. Retrying in $((attempt * 15))s..."
-              sleep $((attempt * 15))
-              attempt=$((attempt + 1))
-            done
-          }
-
-          npm config set fetch-retries 5
-          npm config set fetch-retry-mintimeout 20000
-          npm config set fetch-retry-maxtimeout 120000
-
-          retry npm ci
-          retry npx playwright install --with-deps chromium
-
-      - name: Run SERVER_ROOT_PATH redirect e2e
-        working-directory: ui/litellm-dashboard
-        env:
-          SERVER_ROOT_PATH: ${{ matrix.root_path }}
-        run: npx playwright test --config=e2e_tests/serverRootPath.config.ts
-
-      - name: Upload Playwright artifacts on failure
-        if: failure()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: playwright-trace-${{ strategy.job-index }}
-          path: ui/litellm-dashboard/test-results/
-          retention-days: 7
-
-      - name: Cleanup
-        if: always()
-        run: |
-          docker stop litellm-test || true
-          docker rm litellm-test || true
--- a/.github/workflows/weekly_load_anomaly.yml
+++ b/.github/workflows/weekly_load_anomaly.yml
@ -0,0 +1,81 @@
+name: "Weekly Load Anomaly Check"
+
+on:
+  schedule:
+    - cron: "0 12 * * 6"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  weekly-load-anomaly:
+    if: github.event_name != 'schedule' || github.repository == 'BerriAI/litellm'
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    services:
+      postgres:
+        image: postgres:16.6
+        env:
+          POSTGRES_USER: llmproxy
+          POSTGRES_PASSWORD: dbpassword9090
+          POSTGRES_DB: litellm
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U llmproxy"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+    env:
+      DATABASE_URL: postgresql://llmproxy:dbpassword9090@localhost:5432/litellm
+      LITELLM_MASTER_KEY: sk-weekly-anomaly-check
+      ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+      AWS_BEARER_TOKEN_BEDROCK: ${{ secrets.AWS_BEARER_TOKEN_BEDROCK }}
+    steps:
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+
+      - name: Set up uv
+        uses: ./.github/actions/setup-uv-with-retries
+        with:
+          version: "0.10.9"
+
+      - name: Install dependencies
+        run: |
+          .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra proxy
+
+      - name: Generate Prisma client
+        env:
+          PRISMA_BINARY_CACHE_DIR: ${{ runner.temp }}/prisma-cache
+        run: |
+          uv run --no-sync prisma generate --schema litellm/proxy/schema.prisma
+
+      - name: Start the proxy
+        run: |
+          nohup uv run --no-sync litellm --config tests/e2e/load/weekly_anomaly_config.yml --port 4000 > proxy.log 2>&1 &
+          for _ in $(seq 1 90); do
+            if curl -fs http://localhost:4000/health/liveliness > /dev/null; then
+              exit 0
+            fi
+            sleep 2
+          done
+          echo "proxy never became live"
+          tail -n 100 proxy.log
+          exit 1
+
+      - name: Run the weekly session anomaly test
+        env:
+          E2E_WEEKLY_ANOMALY: "1"
+        run: |
+          uv run --no-sync pytest tests/e2e/load/test_weekly_session_anomaly_e2e.py -v --tb=short -rA
+
+      - name: Show proxy log on failure
+        if: failure()
+        run: tail -n 300 proxy.log
--- a/CLAUDE.md
+++ b/CLAUDE.md
@ -19,7 +19,7 @@ Same thing for bug fixes. The tests should make it so that this specific bug can

 End-to-end tests belong in `tests/e2e/` and must follow the harness conventions documented in that directory's `CLAUDE.md`

-When creating PRs, don't set base to `main`. `litellm_internal_staging` serves that purpose for internal contributors; external / OSS contributions target the current daily OSS branch instead, named `litellm_oss_daily_YYYY_MM_DD` (a fresh one is cut each weekday, so use the most recent)
+When creating PRs, don't set base to `main`. `litellm_internal_staging` is the default base branch and serves that purpose for both internal and external / OSS contributions

 When writing a PR body, treat the comments and imperative instructions inside @.github/pull_request_template.md as rules to follow, not just layout. Agent harnesses may strip HTML comments from copies of that file injected into context, so read .github/pull_request_template.md from disk before writing a PR body to make sure you see every comment rule

--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@ -322,7 +322,7 @@ npm run build
 ## Submitting Your PR

 1. **Push your branch**: `git push origin your-feature-branch`
-2. **Create a PR**: Go to GitHub and open a pull request against the current daily OSS branch, named `litellm_oss_daily_YYYY_MM_DD`. A fresh one is cut each weekday, so pick the most recent from the [branch list](https://github.com/BerriAI/litellm/branches/all?query=litellm_oss_daily). Do not target `main`.
+2. **Create a PR**: Go to GitHub and open a pull request against [`litellm_internal_staging`](https://github.com/BerriAI/litellm/tree/litellm_internal_staging), which is the default base branch. Do not target `main`.
 3. **Fill out the PR template**: Provide clear description of changes
 4. **Wait for review**: Maintainers will review and provide feedback
 5. **Address feedback**: Make requested changes and push updates
--- a/2
+++ b/2
@ -64,6 +64,7 @@ RUN uv sync --frozen --no-install-project --no-install-workspace --no-default-gr
    --extra proxy-runtime \
    --extra extra_proxy \
    --extra semantic-router \
+    --extra saml \
    --python python3

 # Copy full source tree
@ -84,6 +85,7 @@ RUN uv sync --frozen --no-default-groups --no-editable \
    --extra proxy-runtime \
    --extra extra_proxy \
    --extra semantic-router \
+    --extra saml \
    --python python3

 RUN HOME=/opt/prisma XDG_CACHE_HOME=/opt/prisma/.cache PRISMA_BINARY_CACHE_DIR=/opt/prisma/binaries \
--- a/backend/routes/allowlist.py
+++ b/backend/routes/allowlist.py
@ -18,6 +18,7 @@ BACKEND_PATH_PREFIXES: tuple[str, ...] = (
    "/team/",
    "/v2/team/",
    "/organization/",
+    "/v2/organization/",
    "/customer/",
    "/end_user/",
    "/sso/",
--- a/docker/Dockerfile.database
+++ b/docker/Dockerfile.database
@ -62,6 +62,7 @@ RUN uv sync --frozen --no-install-project --no-install-workspace --no-default-gr
    --extra proxy-runtime \
    --extra extra_proxy \
    --extra semantic-router \
+    --extra saml \
    --python python3

 # Copy full source tree
@ -82,6 +83,7 @@ RUN uv sync --frozen --no-default-groups --no-editable \
    --extra proxy-runtime \
    --extra extra_proxy \
    --extra semantic-router \
+    --extra saml \
    --python python3

 RUN HOME=/opt/prisma XDG_CACHE_HOME=/opt/prisma/.cache PRISMA_BINARY_CACHE_DIR=/opt/prisma/binaries \
--- a/docker/Dockerfile.non_root
+++ b/docker/Dockerfile.non_root
@ -54,7 +54,6 @@ ENV UV_PROJECT_ENVIRONMENT=/app/.venv \
    UV_LINK_MODE=copy \
    PATH="/app/.venv/bin:${PATH}" \
    LITELLM_NON_ROOT=true \
-    PRISMA_BINARY_CACHE_DIR=/app/.cache/prisma-python/binaries \
    XDG_CACHE_HOME=/app/.cache

 # Copy dependency metadata first for layer caching
@ -69,6 +68,7 @@ RUN --mount=type=cache,target=/app/.cache/uv,id=litellm-uv-cache \
    --extra proxy-runtime \
    --extra extra_proxy \
    --extra semantic-router \
+    --extra saml \
    --python python3

 # Copy full source tree
@ -95,6 +95,7 @@ RUN --mount=type=cache,target=/app/.cache/uv,id=litellm-uv-cache \
        --extra proxy-runtime \
        --extra extra_proxy \
        --extra semantic-router \
+        --extra saml \
        --python python3 \
        --no-sources-package litellm-proxy-extras; \
    else \
@ -103,10 +104,13 @@ RUN --mount=type=cache,target=/app/.cache/uv,id=litellm-uv-cache \
        --extra proxy-runtime \
        --extra extra_proxy \
        --extra semantic-router \
+        --extra saml \
        --python python3; \
    fi

-RUN prisma generate --schema=./schema.prisma
+RUN HOME=/opt/prisma XDG_CACHE_HOME=/opt/prisma/.cache PRISMA_BINARY_CACHE_DIR=/opt/prisma/binaries \
+    npm_config_cache=/root/.npm \
+    prisma generate --schema=./schema.prisma

 RUN sed -i 's/\r$//' docker/entrypoint.sh && chmod +x docker/entrypoint.sh && \
    sed -i 's/\r$//' docker/prod_entrypoint.sh && chmod +x docker/prod_entrypoint.sh
@ -127,8 +131,6 @@ RUN for i in 1 2 3; do \
 # the rest of the builder's /app is source and build metadata that must not
 # ship (manifest-scanning tools attribute everything in it to this image).
 # entrypoint.sh invokes litellm/proxy/prisma_migration.py by source path.
-# Prisma caches live under /app/.cache here (XDG_CACHE_HOME /
-# PRISMA_BINARY_CACHE_DIR) so the runtime prisma generate finds them.
 COPY --from=builder /app/.venv /app/.venv
 COPY --from=builder /app/docker /app/docker
 COPY --from=builder /app/schema.prisma /app/schema.prisma
@ -138,21 +140,35 @@ COPY --from=builder /app/litellm/proxy/prisma_migration.py /app/litellm/proxy/pr
 # enterprise.enterprise_hooks from it)
 COPY --from=builder /app/enterprise /app/enterprise
 COPY --from=builder /app/litellm-proxy-extras /app/litellm-proxy-extras
-COPY --from=builder /app/.cache /app/.cache
+# Prisma CLI + engines are baked under /opt/prisma, a fixed path every runtime
+# uid can read and that no cache volume mount shadows (unlike /app/.cache or
+# $HOME/.cache under readOnlyRootFilesystem + emptyDir or arbitrary-uid setups).
+# PRISMA_CLI_QUERY_ENGINE_TYPE=binary makes the CLI use the baked binary query
+# engine directly, so `prisma migrate deploy` on a fresh database needs no npm
+# and no network access; without it the CLI looks for the library engine, which
+# prisma stopped baking, and falls back to a download that fails offline or as a
+# non-writable uid (#33650, #24554).
+COPY --from=builder /opt/prisma /opt/prisma
 COPY --from=builder /var/lib/litellm/ui /var/lib/litellm/ui
 COPY --from=builder /var/lib/litellm/assets /var/lib/litellm/assets

+# XDG_CACHE_HOME is intentionally left unset so it falls back to $HOME/.cache
+# (/app/.cache, writable by the runtime uid). The prisma bake at the read-only
+# /opt/prisma is anchored by PRISMA_BINARY_CACHE_DIR / PRISMA_CLI_PATH, so
+# nothing needs XDG to point there; pointing it at the read-only bake would
+# deny any XDG-aware library that writes a cache at runtime.
 ENV PATH="/app/.venv/bin:${PATH}" \
-    PRISMA_BINARY_CACHE_DIR=/app/.cache/prisma-python/binaries \
+    PRISMA_BINARY_CACHE_DIR=/opt/prisma/binaries \
+    PRISMA_CLI_PATH=/opt/prisma/binaries/node_modules/.bin/prisma \
+    PRISMA_CLI_QUERY_ENGINE_TYPE=binary \
    HOME=/app \
    LITELLM_NON_ROOT=true \
-    XDG_CACHE_HOME=/app/.cache \
    PRISMA_SKIP_POSTINSTALL_GENERATE=1 \
    PRISMA_HIDE_UPDATE_MESSAGE=1 \
    PRISMA_ENGINES_CHECKSUM_IGNORE_MISSING=1 \
    PRISMA_OFFLINE_MODE=true

-RUN mkdir -p /nonexistent /var/lib/litellm/assets /var/lib/litellm/ui && \
+RUN mkdir -p /nonexistent /app/.cache /var/lib/litellm/assets /var/lib/litellm/ui && \
    chown -R nobody:nogroup /app /var/lib/litellm/ui /var/lib/litellm/assets /nonexistent && \
    PRISMA_PATH=$(python -c "import os, prisma; print(os.path.dirname(prisma.__file__))") && \
    chown -R nobody:nogroup "$PRISMA_PATH" && \
@ -165,12 +181,14 @@ RUN mkdir -p /nonexistent /var/lib/litellm/assets /var/lib/litellm/ui && \
    [ -n "$LITELLM_PROXY_EXTRAS_PATH" ] && chmod -R g=u "$LITELLM_PROXY_EXTRAS_PATH" || true && \
    chmod -R g+w "$PRISMA_PATH" /var/lib/litellm/ui /var/lib/litellm/assets && \
    [ -n "$LITELLM_PROXY_EXTRAS_PATH" ] && chmod -R g+w "$LITELLM_PROXY_EXTRAS_PATH" || true && \
-    chmod -R g+rX "$PRISMA_PATH" /var/lib/litellm/ui /var/lib/litellm/assets /app/.cache
+    chmod -R g+rX "$PRISMA_PATH" /var/lib/litellm/ui /var/lib/litellm/assets && \
+    chmod -R a+rX /opt/prisma && \
+    test -x /opt/prisma/binaries/node_modules/.bin/prisma && \
+    test -f /opt/prisma/binaries/node_modules/prisma/build/index.js && \
+    ls /opt/prisma/binaries/node_modules/@prisma/engines/query-engine-* >/dev/null 2>&1

 USER 65534

-RUN prisma generate --schema=./schema.prisma
-
 EXPOSE 4000/tcp

 ENTRYPOINT ["/app/docker/prod_entrypoint.sh"]
--- a/enterprise/litellm_enterprise/proxy/hooks/managed_files.py
+++ b/enterprise/litellm_enterprise/proxy/hooks/managed_files.py
@ -316,26 +316,34 @@ class _PROXY_LiteLLMManagedFiles(CustomLogger, BaseFileEndpoints):
        where_clause: Dict[str, Any] = {"file_purpose": "batch", **owner_filter}

        if after:
-            where_clause["id"] = {"gt": after}
+            cursor_row = (
+                await self.prisma_client.db.litellm_managedobjecttable.find_first(
+                    where={**where_clause, "unified_object_id": after}
+                )
+            )
+            if cursor_row is None:
+                raise HTTPException(
+                    status_code=400,
+                    detail=f"Invalid 'after' cursor: no batch found with id '{after}'.",
+                )

-        fetch_limit = limit or 20
-        if target_model_names:
-            # Oversample so post-fetch model-name filtering still has enough rows.
-            fetch_limit = max(fetch_limit * 3, 100)
+        page_size = limit or 20
+        cursor_args: Dict[str, Any] = (
+            {"cursor": {"unified_object_id": after}, "skip": 1} if after else {}
+        )

        batches = await self.prisma_client.db.litellm_managedobjecttable.find_many(
            where=where_clause,
-            take=fetch_limit,
-            order={"created_at": "desc"},
+            take=page_size + 1,
+            order=[{"created_at": "desc"}, {"unified_object_id": "desc"}],
+            **cursor_args,
        )

-        batch_objects: List[LiteLLMBatch] = []
-        for batch in batches:
-            try:
-                # Stop once we have enough after filtering
-                if len(batch_objects) >= (limit or 20):
-                    break
+        has_more = len(batches) > page_size

+        batch_objects: List[LiteLLMBatch] = []
+        for batch in batches[:page_size]:
+            try:
                batch_data = (
                    json.loads(batch.file_object)
                    if isinstance(batch.file_object, str)
@ -351,9 +359,7 @@ class _PROXY_LiteLLMManagedFiles(CustomLogger, BaseFileEndpoints):
                )
                continue

-        return build_list_page(
-            batch_objects, has_more=len(batch_objects) == (limit or 20)
-        )
+        return build_list_page(batch_objects, has_more=has_more)

    async def get_user_created_file_ids(
        self, user_api_key_dict: UserAPIKeyAuth, model_object_ids: List[str]
--- a/enterprise/pyproject.toml
+++ b/enterprise/pyproject.toml
@ -1,6 +1,6 @@
 [project]
 name = "litellm-enterprise"
-version = "0.1.51"
+version = "0.1.52"
 description = "Package for LiteLLM Enterprise features"
 readme = "README.md"
 requires-python = ">=3.9"
@ -26,7 +26,7 @@ required-version = ">=0.10.9"
 module-root = ""

 [tool.commitizen]
-version = "0.1.51"
+version = "0.1.52"
 version_files = [
    "pyproject.toml:^version",
    "../pyproject.toml:litellm-enterprise==",
--- a/gateway/Dockerfile
+++ b/gateway/Dockerfile
@ -46,6 +46,7 @@ RUN --mount=type=cache,target=/root/.cache/uv \
        --extra proxy-runtime \
        --extra extra_proxy \
        --extra semantic-router \
+        --extra bedrock-realtime \
        --python python3

 # Stage 2 — copy source and install the project + workspace members.
@ -57,6 +58,7 @@ RUN --mount=type=cache,target=/root/.cache/uv \
        --extra proxy-runtime \
        --extra extra_proxy \
        --extra semantic-router \
+        --extra bedrock-realtime \
        --python python3

 RUN mkdir -p /home/nonroot && \
--- a/litellm-proxy-extras/litellm_proxy_extras/migrations/20260721000000_add_sso_identity_assertion/migration.sql
+++ b/litellm-proxy-extras/litellm_proxy_extras/migrations/20260721000000_add_sso_identity_assertion/migration.sql
@ -0,0 +1,9 @@
+-- CreateTable
+CREATE TABLE IF NOT EXISTS "LiteLLM_SSOIdentityAssertion" (
+    "user_id" TEXT NOT NULL,
+    "assertion_b64" TEXT NOT NULL,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "LiteLLM_SSOIdentityAssertion_pkey" PRIMARY KEY ("user_id")
+);
--- a/litellm-proxy-extras/litellm_proxy_extras/migrations/20260724000000_add_spend_log_tool_index_start_time_idx/migration.sql
+++ b/litellm-proxy-extras/litellm_proxy_extras/migrations/20260724000000_add_spend_log_tool_index_start_time_idx/migration.sql
@ -0,0 +1,2 @@
+-- CreateIndex
+CREATE INDEX IF NOT EXISTS "LiteLLM_SpendLogToolIndex_start_time_idx" ON "LiteLLM_SpendLogToolIndex"("start_time");
--- a/litellm-proxy-extras/litellm_proxy_extras/schema.prisma
+++ b/litellm-proxy-extras/litellm_proxy_extras/schema.prisma
@ -403,6 +403,15 @@ model LiteLLM_MCPServerOAuthClient {
  updated_at  DateTime @default(now()) @updatedAt @map("updated_at")
 }

+// The enterprise IdP identity assertion captured at SSO login, one row per user.
+// assertion_b64 is an encrypted JSON payload: {id_token, refresh_token?, issuer?, expires_at?}.
+model LiteLLM_SSOIdentityAssertion {
+  user_id       String   @id
+  assertion_b64 String
+  created_at    DateTime @default(now()) @map("created_at")
+  updated_at    DateTime @default(now()) @updatedAt @map("updated_at")
+}
+
 // Generate Tokens for Proxy
 model LiteLLM_VerificationToken {
    token      String   @id
@ -1085,6 +1094,7 @@ model LiteLLM_SpendLogToolIndex {

  @@id([request_id, tool_name])
  @@index([tool_name, start_time])
+  @@index([start_time])
 }

 // Prompt table for storing prompt configurations
--- a/litellm-proxy-extras/pyproject.toml
+++ b/litellm-proxy-extras/pyproject.toml
@ -1,6 +1,6 @@
 [project]
 name = "litellm-proxy-extras"
-version = "0.4.79"
+version = "0.4.81"
 description = "Additional files for the LiteLLM Proxy. Reduces the size of the main litellm package."
 readme = "README.md"
 requires-python = ">=3.9"
@ -26,7 +26,7 @@ required-version = ">=0.10.9"
 module-root = ""

 [tool.commitizen]
-version = "0.4.79"
+version = "0.4.81"
 version_files = [
    "pyproject.toml:^version",
    "../pyproject.toml:litellm-proxy-extras==",
--- a/litellm-rust/CLAUDE.md
+++ b/litellm-rust/CLAUDE.md
@ -62,6 +62,13 @@ Not allowed in `core`:

 Python owns rollout state and fallback while Rust is being introduced. Rust
 paths must be off by default until parity tests prove equivalence with Python.
+A new provider/route may instead be implemented rust-only with no Python
+reference; then the Python interface is a thin dispatch that calls Rust with no
+fallback, and you state the rust-only choice explicitly in the PR. Either way
+the Python side stays minimal (it only marshals inputs and calls the Rust
+interface), never add a per-route feature flag, and never push provider
+dispatch into `litellm/main.py`; put it in a thin dispatch class under
+`litellm/llms/<provider>/<route>/`.

 ## Production Bar

--- a/litellm-rust/Cargo.lock
+++ b/litellm-rust/Cargo.lock
--- a/litellm-rust/Cargo.toml
+++ b/litellm-rust/Cargo.toml
@ -7,10 +7,10 @@ members = [
 resolver = "3"

 [workspace.package]
-edition = "2021"
+edition = "2024"
+rust-version = "1.88"
 license = "MIT"
 repository = "https://github.com/BerriAI/litellm"
-rust-version = "1.86"

 [workspace.dependencies]
 litellm-core = { path = "crates/core" }
--- a/litellm-rust/crates/CODING_STANDARDS/PROVIDER_CODING_STANDARDS.md
+++ b/litellm-rust/crates/CODING_STANDARDS/PROVIDER_CODING_STANDARDS.md
@ -39,11 +39,17 @@ Rules for adding or changing an LLM provider/route in `litellm-rust`. OCR (`MIST

 19. Every provider transform ships tests for: supported-param filtering, request body shape, response normalization, missing/null fields, bad input, and `*_match_python` fixture parity.
 20. Lifecycle/hook tests cover hook order, success + failure callback payloads, pre-call guardrail blocking before any provider I/O, during-call body mutation, and provider-error mapping.
-21. Rust paths stay off by default and behind Python parity tests (disabled / enabled-equals-Python / bridge-unavailable fallback) until parity is proven.
+21. When a route has a Python reference implementation, the Rust path stays off by default and behind Python parity tests (disabled / enabled-equals-Python / bridge-unavailable fallback) until parity is proven. A new provider/route may instead be implemented rust-only with no Python reference; then the Python interface is a thin dispatch to Rust with no fallback, and tests cover the rust-backed path plus the unavailable-bridge error. State the rust-only choice explicitly in the PR.
+
+## Python bridge (SDK side)
+
+22. A Python -> Rust bridge keeps the Python side minimal: the Python interface only marshals inputs and calls the Rust interface, with no transform, handler, or business logic. Aim for well under 100 lines of interface code per route; if the Python grows past that, the logic belongs in Rust.
+23. Do not bloat `litellm/main.py`. A route's provider dispatch lives in a thin dispatch class under `litellm/llms/<provider>/<route>/` that calls the Rust bridge; `main.py` only instantiates it and calls its sync/async method.
+24. Do not add new feature flags unless explicitly requested. Reuse the existing litellm rust rollout mechanism (`use_litellm_rust`); never introduce a per-route env flag such as `LITELLM_USE_RUST_<ROUTE>`.

 ## Checks before push

-22. Run, and keep green:
+25. Run, and keep green:
    ```bash
    cd litellm-rust
    cargo fmt --check
--- a/litellm-rust/crates/ai-gateway/Cargo.toml
+++ b/litellm-rust/crates/ai-gateway/Cargo.toml
@ -14,7 +14,7 @@ path = "src/main.rs"
 required-features = ["server"]

 [dependencies]
-litellm-core.workspace = true
+litellm-core = { workspace = true, features = ["bedrock-auth"] }
 # reqwest (rustls + json) is used by io/ocr and ships realtime logs to the
 # Python proxy callbacks API.
 reqwest.workspace = true
--- a/litellm-rust/crates/ai-gateway/src/audio_transcription/common_utils.rs
+++ b/litellm-rust/crates/ai-gateway/src/audio_transcription/common_utils.rs
@ -0,0 +1,48 @@
+use std::collections::BTreeMap;
+
+use litellm_core::CoreResult;
+use litellm_core::audio_transcription::transformation::AudioTranscriptionProviderConfig;
+use litellm_core::error::CoreError;
+use litellm_core::providers::bedrock::audio_transcription::BEDROCK_AUDIO_TRANSCRIPTION_CONFIG;
+use serde_json::{Map, Value};
+
+pub(super) fn audio_transcription_provider_config(
+    provider: &str,
+) -> Option<&'static dyn AudioTranscriptionProviderConfig> {
+    match provider {
+        "bedrock" => Some(&BEDROCK_AUDIO_TRANSCRIPTION_CONFIG),
+        _ => None,
+    }
+}
+
+pub(super) fn string_headers(
+    headers: Option<Map<String, Value>>,
+) -> CoreResult<BTreeMap<String, String>> {
+    headers
+        .unwrap_or_default()
+        .into_iter()
+        .map(|(key, value)| {
+            value
+                .as_str()
+                .map(|value| (key.clone(), value.to_string()))
+                .ok_or_else(|| {
+                    CoreError::InvalidRequest(format!(
+                        "audio transcription extra_headers.{key} must be a string"
+                    ))
+                })
+        })
+        .collect()
+}
+
+pub(super) fn has_header(headers: &BTreeMap<String, String>, name: &str) -> bool {
+    headers.keys().any(|key| key.eq_ignore_ascii_case(name))
+}
+
+pub(super) fn truncate_error_body(body: &str) -> String {
+    let truncated: String = body.chars().take(256).collect();
+    if truncated.chars().count() == body.chars().count() {
+        truncated
+    } else {
+        format!("{truncated}... (truncated)")
+    }
+}
--- a/litellm-rust/crates/ai-gateway/src/audio_transcription/handler.rs
+++ b/litellm-rust/crates/ai-gateway/src/audio_transcription/handler.rs
@ -0,0 +1,89 @@
+use std::time::SystemTime;
+
+use litellm_core::CoreResult;
+use litellm_core::audio_transcription::transformation::AudioTranscriptionAuth;
+use litellm_core::error::CoreError;
+use litellm_core::providers::bedrock::audio_transcription::aws_auth_config;
+use litellm_core::providers::bedrock::aws_base::{resolve_credentials, sign_bedrock_post};
+use serde_json::Value;
+
+use super::common_utils::truncate_error_body;
+use super::types::ProviderAudioTranscriptionRequest;
+use crate::client::http_client;
+
+pub(crate) async fn execute_audio_transcription_provider_call(
+    request: ProviderAudioTranscriptionRequest,
+) -> CoreResult<Value> {
+    let body = serde_json::to_vec(&request.body).map_err(|error| {
+        CoreError::InvalidRequest(format!("invalid audio request body: {error}"))
+    })?;
+    let mut request_builder = http_client().post(&request.url).body(body.clone());
+    for (key, value) in &request.upstream_headers {
+        request_builder = request_builder.header(key, value);
+    }
+    if let Some(duration) = request.timeout {
+        request_builder = request_builder.timeout(duration);
+    }
+    let response = request_builder
+        .send()
+        .await
+        .map_err(|error| CoreError::Network(error.to_string()))?;
+    let status = response.status();
+    let text = response
+        .text()
+        .await
+        .map_err(|error| CoreError::Network(error.to_string()))?;
+    if !status.is_success() {
+        return Err(CoreError::Http {
+            status: status.as_u16(),
+            body: truncate_error_body(&text),
+        });
+    }
+    let response_json: Value = serde_json::from_str(&text).map_err(|error| {
+        CoreError::InvalidResponse(format!("invalid audio response JSON: {error}"))
+    })?;
+    Ok(request
+        .config
+        .transform_transcription_response(&request.model, response_json)?
+        .into_json())
+}
+
+pub(crate) async fn sign_request(
+    request: &ProviderAudioTranscriptionRequest,
+    optional_params: &serde_json::Map<String, Value>,
+) -> CoreResult<ProviderAudioTranscriptionRequest> {
+    let env_lookup = environment_lookup;
+    let auth = request
+        .config
+        .auth_strategy(&request.model, optional_params, &env_lookup)?;
+    let body = serde_json::to_vec(&request.body).map_err(|error| {
+        CoreError::InvalidRequest(format!("invalid audio request body: {error}"))
+    })?;
+    let mut headers = super::common_utils::string_headers(None)?;
+    headers.insert("Content-Type".to_string(), "application/json".to_string());
+    headers.extend(request.upstream_headers.iter().cloned());
+    match auth {
+        AudioTranscriptionAuth::Bearer => {}
+        AudioTranscriptionAuth::AwsSigV4 { region, .. } => {
+            let credentials =
+                resolve_credentials(aws_auth_config(optional_params, &env_lookup), &env_lookup)
+                    .await?;
+            headers.extend(sign_bedrock_post(
+                &request.url,
+                &body,
+                &headers,
+                &region,
+                &credentials,
+                SystemTime::now(),
+            )?);
+        }
+    }
+    Ok(ProviderAudioTranscriptionRequest {
+        upstream_headers: headers.into_iter().collect(),
+        ..request.clone()
+    })
+}
+
+pub(super) fn environment_lookup(key: &str) -> Option<String> {
+    std::env::var(key).ok()
+}
--- a/litellm-rust/crates/ai-gateway/src/audio_transcription/hooks.rs
+++ b/litellm-rust/crates/ai-gateway/src/audio_transcription/hooks.rs
@ -0,0 +1,301 @@
+use std::future::Future;
+use std::pin::Pin;
+
+use litellm_core::CoreResult;
+use litellm_core::audio_transcription::transformation::AudioTranscriptionAuth;
+use litellm_core::call_lifecycle::{CallLifecycleContext, CallLifecycleHooks, CallLifecycleTiming};
+use litellm_core::error::CoreError;
+use serde_json::{Map, Value, json};
+
+use super::common_utils::{audio_transcription_provider_config, has_header, string_headers};
+use super::handler::sign_request;
+use super::types::{PreparedAudioTranscriptionRequest, ProviderAudioTranscriptionRequest};
+use crate::integrations::custom_guardrail::{
+    CustomGuardrailRunner, GuardrailContext, GuardrailError, GuardrailRequest,
+};
+use crate::integrations::custom_logger::{
+    CallType, CallbackTiming, CallbackValue, CustomLoggerRunner, LoggingError, ModelCallDetails,
+};
+use crate::integrations::types::{
+    RequestMetadata, StandardLoggingMetadata, StandardLoggingPayload,
+};
+
+pub(crate) struct AudioTranscriptionLifecycleHooks {
+    logger_runner: CustomLoggerRunner,
+    guardrail_runner: CustomGuardrailRunner,
+    request_metadata: RequestMetadata,
+}
+
+type AudioFuture<'a, T> = Pin<Box<dyn Future<Output = CoreResult<T>> + Send + 'a>>;
+type AudioLogFuture<'a> = Pin<Box<dyn Future<Output = ()> + Send + 'a>>;
+
+impl AudioTranscriptionLifecycleHooks {
+    pub(crate) fn new(
+        logger_runner: CustomLoggerRunner,
+        guardrail_runner: CustomGuardrailRunner,
+        request_metadata: RequestMetadata,
+    ) -> Self {
+        Self {
+            logger_runner,
+            guardrail_runner,
+            request_metadata,
+        }
+    }
+
+    async fn run_pre_call_guardrails(
+        &self,
+        request: PreparedAudioTranscriptionRequest,
+    ) -> CoreResult<PreparedAudioTranscriptionRequest> {
+        if self.guardrail_runner.is_empty() {
+            return Ok(request);
+        }
+        let (guardrail_request, _) = self
+            .guardrail_runner
+            .run_pre_call(
+                &guardrail_context(&self.request_metadata),
+                GuardrailRequest::new(json!({
+                    "model": request.model,
+                    "custom_llm_provider": request.custom_llm_provider,
+                    "audio": request.audio,
+                    "optional_params": request.optional_params,
+                })),
+            )
+            .await
+            .map_err(guardrail_error_to_core_error)?;
+        let Value::Object(mut data) = guardrail_request.data else {
+            return Err(CoreError::InvalidRequest(
+                "audio transcription pre_call guardrail must return an object".to_string(),
+            ));
+        };
+        let audio = data.remove("audio").ok_or_else(|| {
+            CoreError::InvalidRequest("audio transcription guardrail removed audio".to_string())
+        })?;
+        let optional_params = match data.remove("optional_params") {
+            Some(Value::Object(value)) => value,
+            Some(_) => {
+                return Err(CoreError::InvalidRequest(
+                    "audio transcription optional_params must be an object".to_string(),
+                ));
+            }
+            None => Map::new(),
+        };
+        Ok(PreparedAudioTranscriptionRequest {
+            audio,
+            optional_params,
+            ..request
+        })
+    }
+
+    async fn prepare_provider_request(
+        &self,
+        request: PreparedAudioTranscriptionRequest,
+    ) -> CoreResult<ProviderAudioTranscriptionRequest> {
+        let config = audio_transcription_provider_config(&request.custom_llm_provider)
+            .ok_or_else(|| CoreError::InvalidProvider(request.custom_llm_provider.clone()))?;
+        let env_lookup = super::handler::environment_lookup;
+        let headers = string_headers(request.extra_headers)?;
+        let url = config.complete_url(
+            request.api_base.as_deref(),
+            &request.model,
+            &request.optional_params,
+            &env_lookup,
+        )?;
+        let filtered_params = config.map_transcription_params(&request.optional_params);
+        let body = config.transform_transcription_request(
+            &request.model,
+            request.audio,
+            filtered_params,
+        )?;
+        let auth = config.auth_strategy(&request.model, &request.optional_params, &env_lookup)?;
+        let mut upstream_headers = headers.into_iter().collect::<Vec<_>>();
+        if matches!(auth, AudioTranscriptionAuth::Bearer)
+            && !has_header(
+                &upstream_headers
+                    .iter()
+                    .cloned()
+                    .collect::<std::collections::BTreeMap<_, _>>(),
+                "authorization",
+            )
+            && let Some(api_key) = request.api_key.as_deref()
+        {
+            upstream_headers.push(("Authorization".to_string(), format!("Bearer {api_key}")));
+        }
+        let provider_request = ProviderAudioTranscriptionRequest {
+            model: request.model,
+            config,
+            url,
+            body: body.body,
+            upstream_headers,
+            timeout: request.timeout,
+        };
+        let provider_request = self.run_during_call_guardrails(provider_request).await?;
+        sign_request(&provider_request, &request.optional_params).await
+    }
+
+    async fn run_during_call_guardrails(
+        &self,
+        request: ProviderAudioTranscriptionRequest,
+    ) -> CoreResult<ProviderAudioTranscriptionRequest> {
+        if self.guardrail_runner.is_empty() {
+            return Ok(request);
+        }
+        let (guardrail_request, _) = self
+            .guardrail_runner
+            .run_during_call(
+                &guardrail_context(&self.request_metadata),
+                GuardrailRequest::new(json!({
+                    "model": request.model,
+                    "custom_llm_provider": "bedrock",
+                    "url": request.url,
+                    "body": request.body,
+                })),
+            )
+            .await
+            .map_err(guardrail_error_to_core_error)?;
+        let Value::Object(mut data) = guardrail_request.data else {
+            return Err(CoreError::InvalidRequest(
+                "audio transcription during_call guardrail must return an object".to_string(),
+            ));
+        };
+        let body = data.remove("body").ok_or_else(|| {
+            CoreError::InvalidRequest("audio transcription guardrail removed body".to_string())
+        })?;
+        Ok(ProviderAudioTranscriptionRequest { body, ..request })
+    }
+
+    fn logging_payload(
+        &self,
+        context: &CallLifecycleContext,
+        timing: &CallLifecycleTiming,
+    ) -> StandardLoggingPayload {
+        StandardLoggingPayload {
+            id: context.litellm_call_id.clone(),
+            litellm_call_id: context.litellm_call_id.clone(),
+            call_type: context.call_type.clone(),
+            model: context.model.clone(),
+            custom_llm_provider: context.custom_llm_provider.clone(),
+            response_cost: 0.0,
+            prompt_tokens: 0,
+            completion_tokens: 0,
+            total_tokens: 0,
+            start_time: timing.start_time,
+            end_time: timing.end_time,
+            stream: false,
+            metadata: StandardLoggingMetadata {
+                user_api_key_hash: self.request_metadata.user_api_key_hash.clone(),
+                user_api_key_user_id: self.request_metadata.user_api_key_user_id.clone(),
+                user_api_key_team_id: self.request_metadata.user_api_key_team_id.clone(),
+                ..Default::default()
+            },
+            messages: None,
+        }
+    }
+}
+
+impl CallLifecycleHooks<PreparedAudioTranscriptionRequest, ProviderAudioTranscriptionRequest, Value>
+    for AudioTranscriptionLifecycleHooks
+{
+    type PreCallFuture<'a> = AudioFuture<'a, PreparedAudioTranscriptionRequest>;
+    type DuringCallFuture<'a> = AudioFuture<'a, ProviderAudioTranscriptionRequest>;
+    type SuccessFuture<'a> = AudioLogFuture<'a>;
+    type FailureFuture<'a> = AudioLogFuture<'a>;
+
+    fn async_pre_call_hook<'a>(
+        &'a self,
+        _context: &'a CallLifecycleContext,
+        request: PreparedAudioTranscriptionRequest,
+    ) -> Self::PreCallFuture<'a> {
+        Box::pin(async move { self.run_pre_call_guardrails(request).await })
+    }
+
+    fn async_during_call_hook<'a>(
+        &'a self,
+        _context: &'a CallLifecycleContext,
+        request: PreparedAudioTranscriptionRequest,
+    ) -> Self::DuringCallFuture<'a> {
+        Box::pin(async move { self.prepare_provider_request(request).await })
+    }
+
+    fn async_log_success_event<'a>(
+        &'a self,
+        context: &'a CallLifecycleContext,
+        response: &'a Value,
+        timing: &'a CallLifecycleTiming,
+    ) -> Self::SuccessFuture<'a> {
+        Box::pin(async move {
+            if self.logger_runner.is_empty() {
+                return;
+            }
+            self.logger_runner
+                .async_log_success_event(
+                    &ModelCallDetails::from_standard_logging_payload(
+                        self.logging_payload(context, timing),
+                    ),
+                    &CallbackValue::new("audio_transcription", response.clone()),
+                    CallbackTiming::new(timing.start_time, timing.end_time),
+                )
+                .await;
+        })
+    }
+
+    fn async_log_failure_event<'a>(
+        &'a self,
+        context: &'a CallLifecycleContext,
+        error: &'a CoreError,
+        timing: &'a CallLifecycleTiming,
+    ) -> Self::FailureFuture<'a> {
+        Box::pin(async move {
+            if self.logger_runner.is_empty() {
+                return;
+            }
+            let logging_error = LoggingError {
+                message: error.to_string(),
+                kind: core_error_kind(error).to_string(),
+            };
+            self.logger_runner
+                .async_log_failure_event(
+                    &ModelCallDetails::from_standard_logging_payload(
+                        self.logging_payload(context, timing),
+                    )
+                    .with_failure_error(logging_error.clone()),
+                    Some(&CallbackValue::new(
+                        "error",
+                        json!({"message": logging_error.message, "kind": logging_error.kind}),
+                    )),
+                    CallbackTiming::new(timing.start_time, timing.end_time),
+                )
+                .await;
+        })
+    }
+}
+
+fn guardrail_context(metadata: &RequestMetadata) -> GuardrailContext {
+    GuardrailContext {
+        call_type: CallType::Other("audio_transcription".to_string()),
+        selected_guardrails: Vec::new(),
+        metadata: std::collections::HashMap::new(),
+        user_api_key_hash: metadata.user_api_key_hash.clone(),
+        user_api_key_user_id: metadata.user_api_key_user_id.clone(),
+        user_api_key_team_id: metadata.user_api_key_team_id.clone(),
+        trace_parent: None,
+    }
+}
+
+fn guardrail_error_to_core_error(error: GuardrailError) -> CoreError {
+    CoreError::InvalidRequest(format!("{}: {}", error.kind, error.message))
+}
+
+fn core_error_kind(error: &CoreError) -> &'static str {
+    match error {
+        CoreError::Auth(_) => "AuthError",
+        CoreError::InvalidProvider(_) => "InvalidProvider",
+        CoreError::InvalidRequest(_) => "InvalidRequest",
+        CoreError::InvalidType { .. } => "InvalidType",
+        CoreError::MissingField(_) => "MissingField",
+        CoreError::Http { .. } => "HttpError",
+        CoreError::InvalidResponse(_) => "InvalidResponse",
+        CoreError::Timeout => "Timeout",
+        CoreError::Network(_) => "NetworkError",
+        CoreError::Routing(_) => "RoutingError",
+    }
+}
--- a/litellm-rust/crates/ai-gateway/src/audio_transcription/mod.rs
+++ b/litellm-rust/crates/ai-gateway/src/audio_transcription/mod.rs
@ -0,0 +1,25 @@
+use litellm_core::CoreResult;
+use litellm_core::call_lifecycle::CallLifecycle;
+use serde_json::Value;
+
+mod common_utils;
+mod handler;
+mod hooks;
+mod prepare;
+mod types;
+
+pub use types::AudioTranscriptionRequest;
+
+use handler::execute_audio_transcription_provider_call;
+use prepare::{PreparedAudioTranscriptionCall, prepare_audio_transcription_call};
+
+pub async fn audio_transcription(request: AudioTranscriptionRequest<'_>) -> CoreResult<Value> {
+    let PreparedAudioTranscriptionCall { request, hooks } =
+        prepare_audio_transcription_call(request);
+    CallLifecycle::default()
+        .run_request(request, &hooks, execute_audio_transcription_provider_call)
+        .await
+}
+
+#[cfg(test)]
+mod tests;
--- a/litellm-rust/crates/ai-gateway/src/audio_transcription/prepare.rs
+++ b/litellm-rust/crates/ai-gateway/src/audio_transcription/prepare.rs
@ -0,0 +1,55 @@
+use std::sync::atomic::{AtomicU64, Ordering};
+use std::time::{SystemTime, UNIX_EPOCH};
+
+use litellm_core::routing_utils::provider::{CustomLlmProvider, get_custom_llm_provider};
+
+use super::hooks::AudioTranscriptionLifecycleHooks;
+use super::types::{AudioTranscriptionRequest, PreparedAudioTranscriptionRequest};
+use crate::integrations::custom_guardrail::CustomGuardrailRunner;
+use crate::integrations::custom_logger::CustomLoggerRunner;
+
+pub(crate) struct PreparedAudioTranscriptionCall {
+    pub(crate) request: PreparedAudioTranscriptionRequest,
+    pub(crate) hooks: AudioTranscriptionLifecycleHooks,
+}
+
+pub(crate) fn prepare_audio_transcription_call(
+    request: AudioTranscriptionRequest<'_>,
+) -> PreparedAudioTranscriptionCall {
+    let call_id = request
+        .litellm_call_id
+        .map(str::to_string)
+        .unwrap_or_else(new_audio_transcription_call_id);
+    let provider_info = get_custom_llm_provider(request.model, request.custom_llm_provider)
+        .unwrap_or(CustomLlmProvider {
+            model: request.model,
+            custom_llm_provider: "bedrock",
+        });
+    PreparedAudioTranscriptionCall {
+        request: PreparedAudioTranscriptionRequest {
+            model: provider_info.model.to_string(),
+            custom_llm_provider: provider_info.custom_llm_provider.to_string(),
+            litellm_call_id: call_id,
+            audio: request.audio,
+            api_key: request.api_key.map(str::to_string),
+            api_base: request.api_base.map(str::to_string),
+            extra_headers: request.extra_headers,
+            optional_params: request.optional_params,
+            timeout: request.timeout,
+        },
+        hooks: AudioTranscriptionLifecycleHooks::new(
+            CustomLoggerRunner::new(request.callbacks),
+            CustomGuardrailRunner::new(request.guardrails),
+            request.request_metadata,
+        ),
+    }
+}
+
+fn new_audio_transcription_call_id() -> String {
+    static COUNTER: AtomicU64 = AtomicU64::new(1);
+    let sequence = COUNTER.fetch_add(1, Ordering::Relaxed);
+    let timestamp = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .map_or(0, |duration| duration.as_nanos());
+    format!("audio-transcription-{timestamp}-{sequence}")
+}
--- a/litellm-rust/crates/ai-gateway/src/audio_transcription/tests.rs
+++ b/litellm-rust/crates/ai-gateway/src/audio_transcription/tests.rs
@ -0,0 +1,53 @@
+use std::io::{Read, Write};
+use std::net::TcpListener;
+use std::thread;
+
+use serde_json::{Map, json};
+
+use super::{AudioTranscriptionRequest, audio_transcription};
+
+#[tokio::test]
+async fn bedrock_request_is_signed_and_contains_audio() {
+    let listener = TcpListener::bind("127.0.0.1:0").expect("listener");
+    let address = listener.local_addr().expect("address");
+    let server = thread::spawn(move || {
+        let (mut stream, _) = listener.accept().expect("connection");
+        let mut request = Vec::new();
+        let mut buffer = [0_u8; 16_384];
+        let count = stream.read(&mut buffer).expect("request");
+        request.extend_from_slice(&buffer[..count]);
+        let request = String::from_utf8_lossy(&request);
+        assert!(request.contains("POST /model/mistral.voxtral-mini-3b-2507/converse"));
+        assert!(request.contains("authorization: AWS4-HMAC-SHA256"));
+        assert!(request.contains("x-amz-date:"));
+        assert!(request.contains("\"bytes\":\"AQI=\""));
+        assert!(request.contains("Transcribe the audio. Respond with only the transcript."));
+        let response = b"HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nContent-Length: 53\r\nConnection: close\r\n\r\n{\"output\":{\"message\":{\"content\":[{\"text\":\"hello\"}]}}}";
+        stream.write_all(response).expect("response");
+    });
+
+    let optional_params = Map::from_iter([
+        ("aws_access_key_id".to_string(), json!("access-key")),
+        ("aws_secret_access_key".to_string(), json!("secret-key")),
+        ("aws_region_name".to_string(), json!("us-east-1")),
+    ]);
+    let api_base = format!("http://{address}");
+    let response = audio_transcription(AudioTranscriptionRequest {
+        model: "mistral.voxtral-mini-3b-2507",
+        audio: json!({"data": "AQI=", "format": "wav", "filename": "audio.wav"}),
+        api_key: None,
+        api_base: Some(&api_base),
+        custom_llm_provider: Some("bedrock"),
+        extra_headers: None,
+        optional_params,
+        timeout: None,
+        callbacks: Vec::new(),
+        guardrails: Vec::new(),
+        request_metadata: Default::default(),
+        litellm_call_id: None,
+    })
+    .await
+    .expect("transcription");
+    assert_eq!(response, json!({"text": "hello"}));
+    server.join().expect("server");
+}
--- a/litellm-rust/crates/ai-gateway/src/audio_transcription/types.rs
+++ b/litellm-rust/crates/ai-gateway/src/audio_transcription/types.rs
@ -0,0 +1,58 @@
+use std::sync::Arc;
+use std::time::Duration;
+
+use litellm_core::audio_transcription::transformation::AudioTranscriptionProviderConfig;
+use litellm_core::call_lifecycle::{CallLifecycleContext, CallLifecycleRequest};
+use serde_json::{Map, Value};
+
+use crate::integrations::custom_guardrail::CustomGuardrail;
+use crate::integrations::custom_logger::CustomLogger;
+use crate::integrations::types::RequestMetadata;
+
+pub struct AudioTranscriptionRequest<'a> {
+    pub model: &'a str,
+    pub audio: Value,
+    pub api_key: Option<&'a str>,
+    pub api_base: Option<&'a str>,
+    pub custom_llm_provider: Option<&'a str>,
+    pub extra_headers: Option<Map<String, Value>>,
+    pub optional_params: Map<String, Value>,
+    pub timeout: Option<Duration>,
+    pub callbacks: Vec<Arc<dyn CustomLogger>>,
+    pub guardrails: Vec<Arc<dyn CustomGuardrail>>,
+    pub request_metadata: RequestMetadata,
+    pub litellm_call_id: Option<&'a str>,
+}
+
+pub(crate) struct PreparedAudioTranscriptionRequest {
+    pub(crate) model: String,
+    pub(crate) custom_llm_provider: String,
+    pub(crate) litellm_call_id: String,
+    pub(crate) audio: Value,
+    pub(crate) api_key: Option<String>,
+    pub(crate) api_base: Option<String>,
+    pub(crate) extra_headers: Option<Map<String, Value>>,
+    pub(crate) optional_params: Map<String, Value>,
+    pub(crate) timeout: Option<Duration>,
+}
+
+impl CallLifecycleRequest for PreparedAudioTranscriptionRequest {
+    fn lifecycle_context(&self) -> CallLifecycleContext {
+        CallLifecycleContext::new(
+            "audio_transcription",
+            self.model.clone(),
+            self.custom_llm_provider.clone(),
+            self.litellm_call_id.clone(),
+        )
+    }
+}
+
+#[derive(Clone)]
+pub(crate) struct ProviderAudioTranscriptionRequest {
+    pub(crate) model: String,
+    pub(crate) config: &'static dyn AudioTranscriptionProviderConfig,
+    pub(crate) url: String,
+    pub(crate) body: Value,
+    pub(crate) upstream_headers: Vec<(String, String)>,
+    pub(crate) timeout: Option<Duration>,
+}
--- a/litellm-rust/crates/ai-gateway/src/auth/mod.rs
+++ b/litellm-rust/crates/ai-gateway/src/auth/mod.rs
@ -9,9 +9,9 @@
 //! runs during extraction, before the handler body. Routes never re-implement it.

 use axum::extract::FromRequestParts;
+use axum::http::StatusCode;
 use axum::http::header::AUTHORIZATION;
 use axum::http::request::Parts;
-use axum::http::StatusCode;
 use sha2::{Digest, Sha256};
 use subtle::ConstantTimeEq;

--- a/litellm-rust/crates/ai-gateway/src/ocr/client.rs
+++ b/litellm-rust/crates/ai-gateway/src/ocr/client.rs
@ -1,24 +1,24 @@
 use std::sync::OnceLock;
 use std::time::Duration;

-use crate::constants::DEFAULT_OCR_REQUEST_TIMEOUT_SECS;
+use crate::constants::DEFAULT_HTTP_CLIENT_TIMEOUT_SECS;

-pub(super) fn http_client() -> &'static reqwest::Client {
+pub(crate) fn http_client() -> &'static reqwest::Client {
    static CLIENT: OnceLock<reqwest::Client> = OnceLock::new();
    CLIENT.get_or_init(|| {
        reqwest::Client::builder()
-            .timeout(Duration::from_secs(DEFAULT_OCR_REQUEST_TIMEOUT_SECS))
+            .timeout(Duration::from_secs(DEFAULT_HTTP_CLIENT_TIMEOUT_SECS))
            .build()
            .expect("failed to build reqwest client")
    })
 }

-pub(super) fn safe_fetch_client() -> &'static reqwest::Client {
+pub(crate) fn safe_fetch_client() -> &'static reqwest::Client {
    static CLIENT: OnceLock<reqwest::Client> = OnceLock::new();
    CLIENT.get_or_init(|| {
        reqwest::Client::builder()
            .redirect(reqwest::redirect::Policy::none())
-            .timeout(Duration::from_secs(DEFAULT_OCR_REQUEST_TIMEOUT_SECS))
+            .timeout(Duration::from_secs(DEFAULT_HTTP_CLIENT_TIMEOUT_SECS))
            .build()
            .expect("failed to build reqwest client")
    })
--- a/litellm-rust/crates/ai-gateway/src/constants.rs
+++ b/litellm-rust/crates/ai-gateway/src/constants.rs
@ -37,6 +37,7 @@ pub(crate) const VERTEX_CREDENTIALS_CACHE_CAPACITY: usize = 64;
 pub(crate) const ENV_REFERENCE_PREFIX: &str = "os.environ/";

 pub(crate) const DEFAULT_OCR_REQUEST_TIMEOUT_SECS: u64 = 600;
+pub(crate) const DEFAULT_HTTP_CLIENT_TIMEOUT_SECS: u64 = 600;

 pub(crate) const OCR_ERROR_BODY_MAX_CHARS: usize = 256;

--- a/litellm-rust/crates/ai-gateway/src/io/audio_transcription.rs
+++ b/litellm-rust/crates/ai-gateway/src/io/audio_transcription.rs
@ -0,0 +1 @@
+pub use crate::audio_transcription::{AudioTranscriptionRequest, audio_transcription};
--- a/litellm-rust/crates/ai-gateway/src/io/messages.rs
+++ b/litellm-rust/crates/ai-gateway/src/io/messages.rs
@ -1 +1 @@
-pub use crate::messages::{messages, MessagesRequest};
+pub use crate::messages::{MessagesRequest, messages};
--- a/litellm-rust/crates/ai-gateway/src/io/mod.rs
+++ b/litellm-rust/crates/ai-gateway/src/io/mod.rs
@ -1,3 +1,4 @@
+pub mod audio_transcription;
 pub mod messages;
 pub mod ocr;
 pub mod realtime;
--- a/litellm-rust/crates/ai-gateway/src/io/ocr.rs
+++ b/litellm-rust/crates/ai-gateway/src/io/ocr.rs
@ -1 +1 @@
-pub use crate::ocr::{ocr, OcrRequest};
+pub use crate::ocr::{OcrRequest, ocr};
--- a/litellm-rust/crates/ai-gateway/src/io/realtime.rs
+++ b/litellm-rust/crates/ai-gateway/src/io/realtime.rs
@ -15,16 +15,16 @@ use std::time::Duration;

 use futures_util::stream::{SplitSink, SplitStream};
 use futures_util::{Sink, SinkExt, Stream, StreamExt};
+use litellm_core::CoreResult;
 use litellm_core::error::CoreError;
 use litellm_core::realtime::transformation::RealtimeProviderConfig;
 use litellm_core::realtime::types::RealtimeEvent;
-use litellm_core::CoreResult;
 use tokio::net::TcpStream;
-use tokio_tungstenite::tungstenite::client::IntoClientRequest;
-use tokio_tungstenite::tungstenite::http::header::AUTHORIZATION;
-use tokio_tungstenite::tungstenite::http::HeaderValue;
 use tokio_tungstenite::tungstenite::Message;
-use tokio_tungstenite::{connect_async, MaybeTlsStream, WebSocketStream};
+use tokio_tungstenite::tungstenite::client::IntoClientRequest;
+use tokio_tungstenite::tungstenite::http::HeaderValue;
+use tokio_tungstenite::tungstenite::http::header::AUTHORIZATION;
+use tokio_tungstenite::{MaybeTlsStream, WebSocketStream, connect_async};

 use litellm_core::providers::openai::realtime::transformation::OPENAI_REALTIME_CONFIG;

@ -113,7 +113,7 @@ pub(crate) async fn read_event(upstream_rx: &mut UpstreamRx) -> CoreResult<Realt
            Message::Close(_) => {
                return Err(CoreError::Network(
                    "upstream closed before first event".to_string(),
-                ))
+                ));
            }
            _ => continue,
        }
--- a/litellm-rust/crates/ai-gateway/src/io/realtime_pool.rs
+++ b/litellm-rust/crates/ai-gateway/src/io/realtime_pool.rs
@ -28,11 +28,11 @@ use std::sync::{Arc, Mutex};
 use std::time::{Duration, Instant};

 use futures_util::StreamExt;
-use litellm_core::realtime::types::RealtimeEvent;
 use litellm_core::CoreResult;
+use litellm_core::realtime::types::RealtimeEvent;

 use crate::io::realtime::{
-    dial_upstream, read_event, resolve_api_key, UpstreamRx, UpstreamTx, UpstreamWs,
+    UpstreamRx, UpstreamTx, UpstreamWs, dial_upstream, read_event, resolve_api_key,
 };

 /// Default target warm sockets per key when pooling is enabled.
@ -473,8 +473,8 @@ pub fn upstream_key(
 /// unhealthy — we'd rather discard and fresh-dial than hand over a socket in an
 /// unexpected state. `Pending` (the healthy case) returns `false`.
 fn is_dead(rx: &mut UpstreamRx) -> bool {
-    use futures_util::task::noop_waker_ref;
    use futures_util::Stream;
+    use futures_util::task::noop_waker_ref;
    use std::pin::Pin;
    use std::task::{Context, Poll};

@ -523,15 +523,15 @@ mod tests {
            ))
            .await;
        while let Some(Ok(msg)) = ws.next().await {
-            if let Message::Text(text) = msg {
-                if text.contains("response.create") {
-                    for frame in [
-                        r#"{"type":"response.created"}"#,
-                        r#"{"type":"response.output_audio.delta","delta":"AAAA"}"#,
-                        r#"{"type":"response.done"}"#,
-                    ] {
-                        let _ = ws.send(Message::Text(frame.to_string())).await;
-                    }
+            if let Message::Text(text) = msg
+                && text.contains("response.create")
+            {
+                for frame in [
+                    r#"{"type":"response.created"}"#,
+                    r#"{"type":"response.output_audio.delta","delta":"AAAA"}"#,
+                    r#"{"type":"response.done"}"#,
+                ] {
+                    let _ = ws.send(Message::Text(frame.to_string())).await;
                }
            }
        }
--- a/litellm-rust/crates/ai-gateway/src/io/responses_ws.rs
+++ b/litellm-rust/crates/ai-gateway/src/io/responses_ws.rs
@ -10,19 +10,18 @@ use litellm_core::responses::websocket::ResponsesWebSocketProviderConfig;
 use litellm_core::{CoreError, CoreResult};
 use tokio::net::TcpStream;
 use tokio::sync::Mutex;
-use tokio_tungstenite::tungstenite::client::IntoClientRequest;
-use tokio_tungstenite::tungstenite::http::header::{HeaderName, AUTHORIZATION};
-use tokio_tungstenite::tungstenite::http::HeaderValue;
 use tokio_tungstenite::tungstenite::Message;
-use tokio_tungstenite::{connect_async, MaybeTlsStream, WebSocketStream};
+use tokio_tungstenite::tungstenite::client::IntoClientRequest;
+use tokio_tungstenite::tungstenite::http::HeaderValue;
+use tokio_tungstenite::tungstenite::http::header::{AUTHORIZATION, HeaderName};
+use tokio_tungstenite::{MaybeTlsStream, WebSocketStream, connect_async};

 use crate::constants::{
    DEFAULT_RESPONSES_WS_CONNECT_TIMEOUT_SECS, DEFAULT_RESPONSES_WS_IDLE_TIMEOUT_SECS,
 };

 const OPENAI_API_KEY_ENV: &str = "OPENAI_API_KEY";
-const MISSING_KEY_MESSAGE: &str =
-    "Missing OpenAI API Key - a Responses WebSocket call is being made but no key was passed via params or the OPENAI_API_KEY environment variable";
+const MISSING_KEY_MESSAGE: &str = "Missing OpenAI API Key - a Responses WebSocket call is being made but no key was passed via params or the OPENAI_API_KEY environment variable";

 pub type ResponsesUpstreamWs = WebSocketStream<MaybeTlsStream<TcpStream>>;
 type UpstreamTx = SplitSink<ResponsesUpstreamWs, Message>;
@ -83,8 +82,8 @@ impl ResponsesWebSocketConnection {
    }

    pub async fn recv_text(&self) -> CoreResult<Option<String>> {
-        let mut socket = self.socket.lock().await;
-        let Some(socket) = socket.as_mut() else {
+        let mut socket_guard = self.socket.lock().await;
+        let Some(socket) = socket_guard.as_mut() else {
            return Ok(None);
        };
        match socket.next().await {
@ -456,9 +455,11 @@ mod tests {
        assert_eq!(fourth.event_type, ResponsesWsEventType::ResponseCompleted);
        let observed: Vec<_> = observed_rx.collect().await;
        assert_eq!(observed.len(), 4);
-        assert!(observed
-            .iter()
-            .all(|event| event.event_type != ResponsesWsEventType::ResponseCreate));
+        assert!(
+            observed
+                .iter()
+                .all(|event| event.event_type != ResponsesWsEventType::ResponseCreate)
+        );
    }

    #[tokio::test]
--- a/litellm-rust/crates/ai-gateway/src/io/vertex_ai/vertex_ai_base.rs
+++ b/litellm-rust/crates/ai-gateway/src/io/vertex_ai/vertex_ai_base.rs
@ -11,19 +11,19 @@ use std::sync::{Once, OnceLock};

 use google_cloud_auth::credentials::service_account::AccessSpecifier;
 use google_cloud_auth::credentials::{
-    external_account, impersonated, service_account, user_account, AccessTokenCredentials,
-    Builder as AdcBuilder,
+    AccessTokenCredentials, Builder as AdcBuilder, external_account, impersonated, service_account,
+    user_account,
 };
+use litellm_core::CoreResult;
 use litellm_core::cache::in_memory::InMemoryCache;
 use litellm_core::error::CoreError;
-use litellm_core::CoreResult;
 use serde_json::{Map, Value};
 use sha2::{Digest, Sha256};
 use tokio::sync::Mutex;

 use crate::config::resolve_env_reference;
 use crate::constants::{
-    CLOUD_PLATFORM_SCOPE, VERTEXAI_CREDENTIALS_ENV, VERTEX_CREDENTIALS_CACHE_CAPACITY,
+    CLOUD_PLATFORM_SCOPE, VERTEX_CREDENTIALS_CACHE_CAPACITY, VERTEXAI_CREDENTIALS_ENV,
 };

 type CacheKey = [u8; 32];
@ -183,12 +183,12 @@ fn build_from_json(json: Value) -> CoreResult<AccessTokenCredentials> {
        Some(_) => {
            return Err(CoreError::Auth(
                "Unsupported Vertex credential type".to_string(),
-            ))
+            ));
        }
        None => {
            return Err(CoreError::Auth(
                "Vertex credentials JSON is missing the required `type` field".to_string(),
-            ))
+            ));
        }
    };
    credentials.map_err(|_| CoreError::Auth("Failed to load Vertex credentials".to_string()))
--- a/litellm-rust/crates/ai-gateway/src/lib.rs
+++ b/litellm-rust/crates/ai-gateway/src/lib.rs
@ -11,6 +11,8 @@
 //!   binary turns on. The `python-config` feature additionally pulls in [`python`]
 //!   for the load-time config reader.

+pub mod audio_transcription;
+mod client;
 pub(crate) mod config;
 pub mod io;
 pub mod messages;
--- a/litellm-rust/crates/ai-gateway/src/main.rs
+++ b/litellm-rust/crates/ai-gateway/src/main.rs
@ -11,7 +11,7 @@

 use std::sync::Arc;

-use litellm_ai_gateway::io::realtime_pool::{upstream_key, PoolConfig, RealtimePool};
+use litellm_ai_gateway::io::realtime_pool::{PoolConfig, RealtimePool, upstream_key};
 use litellm_ai_gateway::routes;
 use litellm_ai_gateway::state::AppState;
 use litellm_core::router::{Deployment, LiteLLMParams, Router};
--- a/litellm-rust/crates/ai-gateway/src/messages/common_utils.rs
+++ b/litellm-rust/crates/ai-gateway/src/messages/common_utils.rs
@ -1,8 +1,8 @@
-use litellm_core::error::{json_type_name, CoreError};
+use litellm_core::CoreResult;
+use litellm_core::error::{CoreError, json_type_name};
 use litellm_core::messages::transformation::AnthropicMessagesProviderConfig;
 use litellm_core::providers::anthropic::messages::transformation::ANTHROPIC_MESSAGES_CONFIG;
 use litellm_core::providers::azure_ai::messages::transformation::AZURE_ANTHROPIC_MESSAGES_CONFIG;
-use litellm_core::CoreResult;
 use serde_json::{Map, Value};

 use crate::constants::MESSAGES_ERROR_BODY_MAX_CHARS;
@ -50,3 +50,15 @@ pub(super) fn has_header(headers: &[(String, String)], name: &str) -> bool {
        .iter()
        .any(|(key, _)| key.eq_ignore_ascii_case(name))
 }
+
+pub(super) fn has_bearer_auth(headers: &[(String, String)]) -> bool {
+    headers.iter().any(|(name, value)| {
+        if !name.eq_ignore_ascii_case("authorization") {
+            return false;
+        }
+        let value = value.trim();
+        value.len() > 7
+            && value[..7].eq_ignore_ascii_case("bearer ")
+            && !value[7..].trim().is_empty()
+    })
+}
--- a/litellm-rust/crates/ai-gateway/src/messages/handler.rs
+++ b/litellm-rust/crates/ai-gateway/src/messages/handler.rs
@ -1,5 +1,5 @@
-use litellm_core::error::CoreError;
 use litellm_core::CoreResult;
+use litellm_core::error::CoreError;
 use serde_json::Value;

 use super::client::http_client;
--- a/litellm-rust/crates/ai-gateway/src/messages/prepare.rs
+++ b/litellm-rust/crates/ai-gateway/src/messages/prepare.rs
@ -1,9 +1,9 @@
-use litellm_core::messages::transformation::MessagesAuthStrategy;
-use litellm_core::routing_utils::provider::{get_custom_llm_provider, CustomLlmProvider};
 use litellm_core::CoreError;
 use litellm_core::CoreResult;
+use litellm_core::messages::transformation::MessagesAuthStrategy;
+use litellm_core::routing_utils::provider::{CustomLlmProvider, get_custom_llm_provider};

-use super::common_utils::{has_header, messages_provider_config, string_headers};
+use super::common_utils::{has_bearer_auth, has_header, messages_provider_config, string_headers};
 use super::types::{MessagesRequest, ProviderMessagesRequest};

 pub(super) fn prepare_messages_call(
@ -33,7 +33,9 @@ pub(super) fn prepare_messages_call(
    let mut headers = string_headers(request.extra_headers)?;

    let auth_strategy = config.auth_strategy();
-    if !has_header(&headers, auth_strategy.header_name()) {
+    let already_authorized = has_header(&headers, auth_strategy.header_name())
+        || (config.accepts_bearer_auth() && has_bearer_auth(&headers));
+    if !already_authorized {
        let api_key = config.resolve_api_key(request.api_key, &env_lookup)?;
        let auth_header = match auth_strategy {
            MessagesAuthStrategy::Bearer => {
--- a/litellm-rust/crates/ai-gateway/src/messages/tests.rs
+++ b/litellm-rust/crates/ai-gateway/src/messages/tests.rs
@ -1,14 +1,14 @@
 use std::time::Duration;

 use litellm_core::error::CoreError;
-use serde_json::{json, Map, Value};
+use serde_json::{Map, Value, json};
 use tokio::io::{AsyncReadExt, AsyncWriteExt};
 use tokio::net::{TcpListener, TcpStream};

 use super::common_utils::{
-    has_header, messages_provider_config, string_headers, truncate_error_body,
+    has_bearer_auth, has_header, messages_provider_config, string_headers, truncate_error_body,
 };
-use super::{messages, MessagesRequest};
+use super::{MessagesRequest, messages};

 async fn read_http_request(socket: &mut TcpStream) -> String {
    let mut request = Vec::new();
@ -85,6 +85,34 @@ fn has_header_is_case_insensitive() {
    assert!(!has_header(&headers, "authorization"));
 }

+#[test]
+fn has_bearer_auth_requires_a_nonempty_bearer_token() {
+    assert!(has_bearer_auth(&[(
+        "Authorization".to_string(),
+        "Bearer tok".to_string()
+    )]));
+    assert!(has_bearer_auth(&[(
+        "authorization".to_string(),
+        "bearer tok".to_string()
+    )]));
+    assert!(!has_bearer_auth(&[(
+        "authorization".to_string(),
+        "Bearer ".to_string()
+    )]));
+    assert!(!has_bearer_auth(&[(
+        "authorization".to_string(),
+        String::new()
+    )]));
+    assert!(!has_bearer_auth(&[(
+        "authorization".to_string(),
+        "Basic abc".to_string()
+    )]));
+    assert!(!has_bearer_auth(&[(
+        "x-api-key".to_string(),
+        "sk".to_string()
+    )]));
+}
+
 #[tokio::test]
 async fn messages_round_trip_builds_azure_request_and_passes_response_through() {
    let listener = TcpListener::bind("127.0.0.1:0").await.expect("binds");
@ -252,6 +280,112 @@ async fn messages_does_not_duplicate_auth_when_x_api_key_supplied() {
    assert!(!head.contains("rust-fallback-key"), "{head}");
 }

+#[tokio::test]
+async fn messages_forwards_entra_id_bearer_without_requiring_api_key() {
+    let listener = TcpListener::bind("127.0.0.1:0").await.expect("binds");
+    let addr = listener.local_addr().expect("addr");
+
+    let server = tokio::spawn(async move {
+        let (mut socket, _) = listener.accept().await.expect("accepts request");
+        let request = read_http_request(&mut socket).await;
+        let response_body =
+            r#"{"id":"msg_3","type":"message","role":"assistant","content":[],"model":"m"}"#;
+        socket
+            .write_all(write_response(response_body).as_bytes())
+            .await
+            .expect("writes response");
+        request
+    });
+
+    let mut headers = Map::new();
+    headers.insert(
+        "Authorization".to_string(),
+        Value::String("Bearer entra-token".to_string()),
+    );
+
+    messages(MessagesRequest {
+        model: "claude-sonnet-4-5",
+        body: json!({"model": "claude-sonnet-4-5", "max_tokens": 8, "messages": []}),
+        api_key: None,
+        api_base: Some(&format!("http://{addr}")),
+        custom_llm_provider: Some("azure_ai"),
+        extra_headers: Some(headers),
+        timeout: Some(Duration::from_secs(5)),
+    })
+    .await
+    .expect("entra id request succeeds without api key");
+
+    let request = server.await.expect("server task completes");
+    let head = request
+        .split_once("\r\n\r\n")
+        .expect("has body")
+        .0
+        .to_ascii_lowercase();
+    assert!(head.contains("authorization: bearer entra-token"), "{head}");
+    assert!(!head.contains("x-api-key"), "{head}");
+}
+
+#[tokio::test]
+async fn messages_requires_auth_when_no_key_and_no_header() {
+    let err = messages(MessagesRequest {
+        model: "claude-sonnet-4-5",
+        body: json!({"model": "claude-sonnet-4-5", "max_tokens": 8, "messages": []}),
+        api_key: None,
+        api_base: Some("http://127.0.0.1:1"),
+        custom_llm_provider: Some("azure_ai"),
+        extra_headers: None,
+        timeout: Some(Duration::from_millis(50)),
+    })
+    .await
+    .expect_err("missing auth errors");
+
+    assert!(matches!(err, CoreError::Auth(_)));
+}
+
+#[tokio::test]
+async fn messages_ignores_malformed_authorization_and_uses_api_key() {
+    let listener = TcpListener::bind("127.0.0.1:0").await.expect("binds");
+    let addr = listener.local_addr().expect("addr");
+
+    let server = tokio::spawn(async move {
+        let (mut socket, _) = listener.accept().await.expect("accepts request");
+        let request = read_http_request(&mut socket).await;
+        let response_body =
+            r#"{"id":"msg_4","type":"message","role":"assistant","content":[],"model":"m"}"#;
+        socket
+            .write_all(write_response(response_body).as_bytes())
+            .await
+            .expect("writes response");
+        request
+    });
+
+    let mut headers = Map::new();
+    headers.insert(
+        "Authorization".to_string(),
+        Value::String("Bearer ".to_string()),
+    );
+
+    messages(MessagesRequest {
+        model: "claude-sonnet-4-5",
+        body: json!({"model": "claude-sonnet-4-5", "max_tokens": 8, "messages": []}),
+        api_key: Some("sk-azure"),
+        api_base: Some(&format!("http://{addr}")),
+        custom_llm_provider: Some("azure_ai"),
+        extra_headers: Some(headers),
+        timeout: Some(Duration::from_secs(5)),
+    })
+    .await
+    .expect("falls back to api key");
+
+    let request = server.await.expect("server task completes");
+    let head = request
+        .split_once("\r\n\r\n")
+        .expect("has body")
+        .0
+        .to_ascii_lowercase();
+    assert!(head.contains("x-api-key: sk-azure"), "{head}");
+}
+
 #[tokio::test]
 async fn messages_maps_provider_error_status_to_http_error() {
    let listener = TcpListener::bind("127.0.0.1:0").await.expect("binds");
--- a/litellm-rust/crates/ai-gateway/src/ocr/common_utils.rs
+++ b/litellm-rust/crates/ai-gateway/src/ocr/common_utils.rs
@ -1,12 +1,12 @@
 use std::net::{IpAddr, Ipv4Addr};
 use std::time::{Duration, Instant};

-use base64::engine::general_purpose::STANDARD as BASE64_STANDARD;
 use base64::Engine;
+use base64::engine::general_purpose::STANDARD as BASE64_STANDARD;
+use litellm_core::CoreResult;
 use litellm_core::error::CoreError;
 use litellm_core::ocr::mime::resolve_document_mime;
 use litellm_core::ocr::transformation::OcrProviderConfig;
-use litellm_core::CoreResult;
 use reqwest::Url;
 use serde_json::{Map, Value};

@ -22,7 +22,7 @@ use litellm_core::providers::vertex_ai::ocr::transformation::{
    VERTEX_AI_DEEPSEEK_OCR_CONFIG, VERTEX_AI_OCR_CONFIG,
 };

-use super::client::{http_client, safe_fetch_client};
+use crate::client::{http_client, safe_fetch_client};
 use crate::constants::{
    AZURE_DOCUMENT_INTELLIGENCE_POLL_TIMEOUT_SECS, DEFAULT_MAX_IMAGE_URL_DOWNLOAD_SIZE_MB,
    DEFAULT_OCR_REQUEST_TIMEOUT_SECS, MAX_SAFE_FETCH_REDIRECTS, OCR_ERROR_BODY_MAX_CHARS,
--- a/litellm-rust/crates/ai-gateway/src/ocr/handler.rs
+++ b/litellm-rust/crates/ai-gateway/src/ocr/handler.rs
@ -1,13 +1,13 @@
+use litellm_core::CoreResult;
 use litellm_core::error::CoreError;
 use litellm_core::ocr::transformation::OcrResponseHandling;
-use litellm_core::CoreResult;
 use serde_json::Value;

-use super::client::http_client;
 use super::common_utils::{
    classify_reqwest_error, poll_document_intelligence, truncate_error_body,
 };
 use super::types::ProviderOcrRequest;
+use crate::client::http_client;

 pub(crate) async fn execute_ocr_provider_call(request: ProviderOcrRequest) -> CoreResult<Value> {
    let mut request_builder = http_client().post(&request.url).json(&request.body);
--- a/litellm-rust/crates/ai-gateway/src/ocr/hooks.rs
+++ b/litellm-rust/crates/ai-gateway/src/ocr/hooks.rs
@ -1,11 +1,11 @@
 use std::future::Future;
 use std::pin::Pin;

+use litellm_core::CoreResult;
 use litellm_core::call_lifecycle::{CallLifecycleContext, CallLifecycleHooks, CallLifecycleTiming};
 use litellm_core::error::CoreError;
 use litellm_core::ocr::transformation::{OcrAuth, OcrAuthStrategy, OcrDocumentPreparation};
-use litellm_core::CoreResult;
-use serde_json::{json, Map, Value};
+use serde_json::{Map, Value, json};

 use super::common_utils::{
    convert_document_url_to_data_uri, has_header, ocr_provider_config, string_headers,
@ -319,7 +319,7 @@ fn parse_ocr_pre_call_guardrail_request(
        Some(_) => {
            return Err(CoreError::InvalidRequest(
                "OCR pre_call guardrail optional_params must be an object".to_string(),
-            ))
+            ));
        }
        None => Map::new(),
    };
--- a/litellm-rust/crates/ai-gateway/src/ocr/mod.rs
+++ b/litellm-rust/crates/ai-gateway/src/ocr/mod.rs
@ -1,8 +1,7 @@
-use litellm_core::call_lifecycle::CallLifecycle;
 use litellm_core::CoreResult;
+use litellm_core::call_lifecycle::CallLifecycle;
 use serde_json::Value;

-mod client;
 mod common_utils;
 mod handler;
 mod hooks;
@ -12,7 +11,7 @@ mod types;
 pub use types::OcrRequest;

 use handler::execute_ocr_provider_call;
-use prepare::{prepare_ocr_call, PreparedOcrCall};
+use prepare::{PreparedOcrCall, prepare_ocr_call};

 pub async fn ocr(request: OcrRequest<'_>) -> CoreResult<Value> {
    let PreparedOcrCall { request, hooks } = prepare_ocr_call(request);
--- a/litellm-rust/crates/ai-gateway/src/ocr/prepare.rs
+++ b/litellm-rust/crates/ai-gateway/src/ocr/prepare.rs
@ -1,7 +1,7 @@
 use std::sync::atomic::{AtomicU64, Ordering};
 use std::time::{SystemTime, UNIX_EPOCH};

-use litellm_core::routing_utils::provider::{get_custom_llm_provider, CustomLlmProvider};
+use litellm_core::routing_utils::provider::{CustomLlmProvider, get_custom_llm_provider};

 use super::hooks::OcrLifecycleHooks;
 use super::types::{OcrRequest, PreparedOcrRequest};
--- a/litellm-rust/crates/ai-gateway/src/ocr/tests.rs
+++ b/litellm-rust/crates/ai-gateway/src/ocr/tests.rs
@ -3,12 +3,12 @@ use std::time::Duration;

 use litellm_core::error::CoreError;
 use litellm_core::ocr::transformation::OcrResponseHandling;
-use serde_json::{json, Map, Value};
+use serde_json::{Map, Value, json};
 use tokio::io::{AsyncReadExt, AsyncWriteExt};
 use tokio::net::{TcpListener, TcpStream};

 use super::common_utils::{has_header, ocr_provider_config, string_headers, truncate_error_body};
-use super::{ocr, OcrRequest};
+use super::{OcrRequest, ocr};
 use crate::integrations::custom_guardrail::{
    CustomGuardrail, GuardrailContext, GuardrailDecision, GuardrailError, GuardrailEventHook,
    GuardrailFuture, GuardrailRequest,
@ -234,19 +234,23 @@ fn truncate_error_body_does_not_split_multibyte_chars() {
 #[test]
 fn ocr_dispatch_supports_migrated_providers() {
    assert!(ocr_provider_config("mistral", "mistral-ocr-latest").is_some());
-    assert!(ocr_provider_config("azure_ai", "pixtral-12b-2409")
-        .expect("azure ai config resolves")
-        .requires_data_uri_document());
+    assert!(
+        ocr_provider_config("azure_ai", "pixtral-12b-2409")
+            .expect("azure ai config resolves")
+            .requires_data_uri_document()
+    );
    assert_eq!(
        ocr_provider_config("azure_ai", "doc-intelligence/prebuilt-read")
            .expect("document intelligence config resolves")
            .response_handling(),
        OcrResponseHandling::AzureDocumentIntelligencePoll
    );
-    assert!(ocr_provider_config("vertex_ai", "deepseek-ocr-maas")
-        .expect("vertex deepseek config resolves")
-        .supported_ocr_params()
-        .contains(&"temperature"));
+    assert!(
+        ocr_provider_config("vertex_ai", "deepseek-ocr-maas")
+            .expect("vertex deepseek config resolves")
+            .supported_ocr_params()
+            .contains(&"temperature")
+    );
    assert!(ocr_provider_config("openai", "gpt-4o").is_none());
 }

--- a/litellm-rust/crates/ai-gateway/src/python/config.rs
+++ b/litellm-rust/crates/ai-gateway/src/python/config.rs
@ -7,9 +7,9 @@
 //!
 //! Compiled only under the `python-config` feature.

+use litellm_core::CoreResult;
 use litellm_core::error::CoreError;
 use litellm_core::router::{Deployment, Router};
-use litellm_core::CoreResult;
 use pyo3::prelude::*;

 use crate::gil;
--- a/litellm-rust/crates/ai-gateway/src/realtime/streaming.rs
+++ b/litellm-rust/crates/ai-gateway/src/realtime/streaming.rs
@ -106,16 +106,16 @@ impl RealTimeStreaming {
    /// `litellm_call_id`, replacing the gateway-generated fallback.
    fn on_session(&mut self, event: &RealtimeEvent) {
        let session = event.data.get("session").and_then(Value::as_object);
-        if let Some(id) = session.and_then(|s| s.get("id")).and_then(Value::as_str) {
-            if !id.is_empty() {
-                self.id = id.to_string();
-                self.litellm_call_id = id.to_string();
-            }
+        if let Some(id) = session.and_then(|s| s.get("id")).and_then(Value::as_str)
+            && !id.is_empty()
+        {
+            self.id = id.to_string();
+            self.litellm_call_id = id.to_string();
        }
-        if let Some(model) = session.and_then(|s| s.get("model")).and_then(Value::as_str) {
-            if !model.is_empty() {
-                self.model = model.to_string();
-            }
+        if let Some(model) = session.and_then(|s| s.get("model")).and_then(Value::as_str)
+            && !model.is_empty()
+        {
+            self.model = model.to_string();
        }
    }

--- a/litellm-rust/crates/ai-gateway/src/routes/health.rs
+++ b/litellm-rust/crates/ai-gateway/src/routes/health.rs
@ -1,8 +1,8 @@
 //! Health probes. Simple-route template: a `router()` plus its handlers, in one file.

+use axum::Router;
 use axum::http::StatusCode;
 use axum::routing::get;
-use axum::Router;

 use crate::state::AppState;

--- a/litellm-rust/crates/ai-gateway/src/routes/messages/mod.rs
+++ b/litellm-rust/crates/ai-gateway/src/routes/messages/mod.rs
@ -2,13 +2,13 @@

 mod service;

+use axum::Router;
 use axum::body::Body;
 use axum::extract::{Json, State};
-use axum::http::header::{HeaderMap, HeaderValue, CACHE_CONTROL, CONTENT_TYPE};
 use axum::http::StatusCode;
+use axum::http::header::{CACHE_CONTROL, CONTENT_TYPE, HeaderMap, HeaderValue};
 use axum::response::{IntoResponse, Response};
 use axum::routing::post;
-use axum::Router;
 use litellm_core::CoreError;
 use serde_json::{Map, Value};

@ -126,9 +126,9 @@ mod tests {
    use std::sync::Arc;

    use axum::body::Body;
-    use axum::http::header::{CACHE_CONTROL, CONTENT_TYPE};
    use axum::http::Request;
    use axum::http::StatusCode;
+    use axum::http::header::{CACHE_CONTROL, CONTENT_TYPE};
    use litellm_core::router::{Deployment, LiteLLMParams, Router as ModelRouter};
    use serde_json::json;
    use tokio::io::{AsyncReadExt, AsyncWriteExt};
@ -440,8 +440,8 @@ mod tests {
            .await
            .expect("response body reads");
        assert_eq!(
-            serde_json::from_slice::<serde_json::Value>(&response_body).expect("error is json")
-                ["error"]["message"],
+            serde_json::from_slice::<serde_json::Value>(&response_body).expect("error is json")["error"]
+                ["message"],
            "messages provider request failed"
        );
        server.await.expect("upstream task completes");
--- a/litellm-rust/crates/ai-gateway/src/routes/messages/service.rs
+++ b/litellm-rust/crates/ai-gateway/src/routes/messages/service.rs
@ -5,7 +5,7 @@ use litellm_core::{CoreError, CoreResult};
 use serde_json::{Map, Value};

 use crate::constants::ANTHROPIC_MESSAGES_PROVIDER;
-use crate::messages::{execute_messages, MessagesRequest};
+use crate::messages::{MessagesRequest, execute_messages};

 pub(crate) enum MessagesResponse {
    Json(Value),
--- a/litellm-rust/crates/ai-gateway/src/routes/realtime/mod.rs
+++ b/litellm-rust/crates/ai-gateway/src/routes/realtime/mod.rs
@ -6,17 +6,17 @@

 mod service;

-use std::sync::atomic::{AtomicU64, Ordering};
 use std::sync::Arc;
+use std::sync::atomic::{AtomicU64, Ordering};
 use std::time::{SystemTime, UNIX_EPOCH};

 use crate::io::realtime_pool::RealtimePool;
+use axum::Router;
 use axum::extract::ws::{Message, WebSocket, WebSocketUpgrade};
 use axum::extract::{Query, State};
 use axum::http::StatusCode;
 use axum::response::Response;
 use axum::routing::get;
-use axum::Router;
 use futures_util::{SinkExt, StreamExt};
 use litellm_core::realtime::types::RealtimeEvent;
 use litellm_core::router::Router as ModelRouter;
--- a/litellm-rust/crates/ai-gateway/src/routes/realtime/service.rs
+++ b/litellm-rust/crates/ai-gateway/src/routes/realtime/service.rs
@ -9,12 +9,12 @@

 use std::time::Duration;

-use crate::io::realtime_pool::{upstream_key, RealtimePool};
+use crate::io::realtime_pool::{RealtimePool, upstream_key};
 use futures_util::{Sink, Stream};
+use litellm_core::CoreResult;
 use litellm_core::error::CoreError;
 use litellm_core::realtime::types::RealtimeEvent;
 use litellm_core::router::Router;
-use litellm_core::CoreResult;

 /// Select a deployment for `model` and splice the client stream to the provider.
 ///
@ -51,18 +51,17 @@ where
        provider_model,
        params.api_key.as_deref(),
        params.api_base.as_deref(),
-    ) {
-        if let Some(handoff) = pool.take(&key) {
-            return crate::io::realtime::realtime_warm(
-                provider_model,
-                handoff,
-                idle_timeout,
-                observe,
-                client_in,
-                client_out,
-            )
-            .await;
-        }
+    ) && let Some(handoff) = pool.take(&key)
+    {
+        return crate::io::realtime::realtime_warm(
+            provider_model,
+            handoff,
+            idle_timeout,
+            observe,
+            client_in,
+            client_out,
+        )
+        .await;
    }

    // Cold path: fresh dial (the original behavior).
--- a/litellm-rust/crates/ai-gateway/src/routes/responses/mod.rs
+++ b/litellm-rust/crates/ai-gateway/src/routes/responses/mod.rs
@ -1,15 +1,15 @@
 mod service;

-use std::sync::atomic::{AtomicU64, Ordering};
 use std::sync::Arc;
+use std::sync::atomic::{AtomicU64, Ordering};
 use std::time::{SystemTime, UNIX_EPOCH};

+use axum::Router;
 use axum::extract::ws::{Message, WebSocket, WebSocketUpgrade};
 use axum::extract::{Query, State};
 use axum::http::StatusCode;
 use axum::response::Response;
 use axum::routing::get;
-use axum::Router;
 use futures_util::{Sink, SinkExt, StreamExt};
 use litellm_core::responses::types::{ResponsesErrorFrame, ResponsesWsEvent, ResponsesWsEventType};
 use litellm_core::router::Router as ModelRouter;
--- a/litellm-rust/crates/core/Cargo.toml
+++ b/litellm-rust/crates/core/Cargo.toml
@ -11,6 +11,25 @@ rand.workspace = true
 serde.workspace = true
 serde_json.workspace = true
 thiserror.workspace = true
+sha2.workspace = true
+aws-config = { version = "1.9.0", default-features = false, features = ["rustls", "rt-tokio"], optional = true }
+aws-credential-types = { version = "1.3.0", features = ["hardcoded-credentials"], optional = true }
+aws-sdk-sts = { version = "1.108.0", default-features = false, features = ["rustls", "rt-tokio"], optional = true }
+aws-sigv4 = { version = "1.5.1", optional = true }
+aws-types = { version = "1.4.0", optional = true }
+aws-smithy-runtime-api = { version = "1.13.0", optional = true }
+
+[features]
+default = []
+bedrock-auth = [
+    "dep:aws-config",
+    "dep:aws-credential-types",
+    "dep:aws-sdk-sts",
+    "dep:aws-sigv4",
+    "dep:aws-types",
+    "dep:aws-smithy-runtime-api",
+]

 [dev-dependencies]
+reqwest.workspace = true
 tokio = { workspace = true, features = ["macros", "rt-multi-thread"] }
--- a/litellm-rust/crates/core/src/audio_transcription/mod.rs
+++ b/litellm-rust/crates/core/src/audio_transcription/mod.rs
@ -0,0 +1,2 @@
+pub mod transformation;
+pub mod types;
--- a/litellm-rust/crates/core/src/audio_transcription/transformation.rs
+++ b/litellm-rust/crates/core/src/audio_transcription/transformation.rs
@ -0,0 +1,57 @@
+use serde_json::{Map, Value};
+
+use crate::CoreResult;
+
+use super::types::{AudioTranscriptionRequestData, AudioTranscriptionResponseData};
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum AudioTranscriptionAuth {
+    Bearer,
+    AwsSigV4 {
+        region: String,
+        service: &'static str,
+    },
+}
+
+pub trait AudioTranscriptionProviderConfig: Sync {
+    fn supported_transcription_params(&self) -> &'static [&'static str];
+
+    fn map_transcription_params(&self, params: &Map<String, Value>) -> Map<String, Value> {
+        params
+            .iter()
+            .filter(|(key, _)| {
+                self.supported_transcription_params()
+                    .contains(&key.as_str())
+            })
+            .map(|(key, value)| (key.clone(), value.clone()))
+            .collect()
+    }
+
+    fn transform_transcription_request(
+        &self,
+        model: &str,
+        audio: Value,
+        optional_params: Map<String, Value>,
+    ) -> CoreResult<AudioTranscriptionRequestData>;
+
+    fn transform_transcription_response(
+        &self,
+        model: &str,
+        response_json: Value,
+    ) -> CoreResult<AudioTranscriptionResponseData>;
+
+    fn complete_url(
+        &self,
+        api_base: Option<&str>,
+        model: &str,
+        optional_params: &Map<String, Value>,
+        env_lookup: &dyn Fn(&str) -> Option<String>,
+    ) -> CoreResult<String>;
+
+    fn auth_strategy(
+        &self,
+        model: &str,
+        optional_params: &Map<String, Value>,
+        env_lookup: &dyn Fn(&str) -> Option<String>,
+    ) -> CoreResult<AudioTranscriptionAuth>;
+}
--- a/litellm-rust/crates/core/src/audio_transcription/types.rs
+++ b/litellm-rust/crates/core/src/audio_transcription/types.rs
@ -0,0 +1,20 @@
+use serde::{Deserialize, Serialize};
+use serde_json::Value;
+
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+pub struct AudioTranscriptionRequestData {
+    pub body: Value,
+}
+
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+pub struct AudioTranscriptionResponseData {
+    pub text: String,
+}
+
+impl AudioTranscriptionResponseData {
+    pub fn into_json(self) -> Value {
+        serde_json::json!({
+            "text": self.text,
+        })
+    }
+}
--- a/litellm-rust/crates/core/src/caching/in_memory_cache.rs
+++ b/litellm-rust/crates/core/src/caching/in_memory_cache.rs
@ -0,0 +1,258 @@
+use std::cmp::Reverse;
+use std::collections::{BinaryHeap, HashMap};
+use std::time::{Duration, SystemTime, UNIX_EPOCH};
+
+const DEFAULT_MAX_SIZE_IN_MEMORY: usize = 200;
+const DEFAULT_TTL: Duration = Duration::from_secs(600);
+
+pub struct InMemoryCache<V: Clone> {
+    pub cache_dict: HashMap<String, V>,
+    pub ttl_dict: HashMap<String, Duration>,
+    pub expiration_heap: BinaryHeap<Reverse<(Duration, String)>>,
+    pub max_size_in_memory: usize,
+    pub default_ttl: Duration,
+    now: Box<dyn Fn() -> Duration + Send + Sync>,
+}
+
+impl<V: Clone> Default for InMemoryCache<V> {
+    fn default() -> Self {
+        Self::new(None, None)
+    }
+}
+
+impl<V: Clone> InMemoryCache<V> {
+    pub fn new(max_size_in_memory: Option<usize>, default_ttl: Option<Duration>) -> Self {
+        Self::with_clock(max_size_in_memory, default_ttl, || {
+            SystemTime::now()
+                .duration_since(UNIX_EPOCH)
+                .unwrap_or_default()
+        })
+    }
+
+    pub fn with_clock(
+        max_size_in_memory: Option<usize>,
+        default_ttl: Option<Duration>,
+        now: impl Fn() -> Duration + Send + Sync + 'static,
+    ) -> Self {
+        Self {
+            cache_dict: HashMap::new(),
+            ttl_dict: HashMap::new(),
+            expiration_heap: BinaryHeap::new(),
+            max_size_in_memory: max_size_in_memory.unwrap_or(DEFAULT_MAX_SIZE_IN_MEMORY),
+            default_ttl: default_ttl.unwrap_or(DEFAULT_TTL),
+            now: Box::new(now),
+        }
+    }
+
+    pub fn evict_cache(&mut self) {
+        if self.max_size_in_memory == 0 {
+            return;
+        }
+
+        let current_time = (self.now)();
+        while let Some(Reverse((expiration_time, key))) = self.expiration_heap.peek().cloned() {
+            if self.ttl_dict.get(&key).copied() != Some(expiration_time) {
+                self.expiration_heap.pop();
+            } else if expiration_time <= current_time {
+                self.expiration_heap.pop();
+                self.remove_key(&key);
+            } else {
+                break;
+            }
+        }
+
+        while self.cache_dict.len() >= self.max_size_in_memory {
+            let Some(Reverse((expiration_time, key))) = self.expiration_heap.pop() else {
+                break;
+            };
+            if self.ttl_dict.get(&key).copied() == Some(expiration_time) {
+                self.remove_key(&key);
+            }
+        }
+    }
+
+    pub fn allow_ttl_override(&self, key: &str) -> bool {
+        match self.ttl_dict.get(key).copied() {
+            None => true,
+            Some(expiration_time) => expiration_time < (self.now)(),
+        }
+    }
+
+    pub fn set_cache(&mut self, key: impl Into<String>, value: V, ttl: Option<Duration>) {
+        if self.max_size_in_memory == 0 {
+            return;
+        }
+
+        self.evict_cache();
+        let key = key.into();
+        self.cache_dict.insert(key.clone(), value);
+        if self.allow_ttl_override(&key) {
+            let expiration_time = (self.now)() + ttl.unwrap_or(self.default_ttl);
+            self.ttl_dict.insert(key.clone(), expiration_time);
+            self.expiration_heap.push(Reverse((expiration_time, key)));
+        }
+    }
+
+    // Generic values intentionally omit Python's per-item size check.
+    pub fn get_cache(&mut self, key: &str) -> Option<V> {
+        if self.cache_dict.contains_key(key) {
+            if self.is_key_expired(key) {
+                self.remove_key(key);
+                return None;
+            }
+            return self.cache_dict.get(key).cloned();
+        }
+        None
+    }
+
+    pub fn get_ttl(&self, key: &str) -> Option<Duration> {
+        self.ttl_dict.get(key).copied()
+    }
+
+    pub fn delete_cache(&mut self, key: &str) {
+        self.remove_key(key);
+    }
+
+    pub fn flush_cache(&mut self) {
+        self.cache_dict.clear();
+        self.ttl_dict.clear();
+        self.expiration_heap.clear();
+    }
+
+    fn is_key_expired(&self, key: &str) -> bool {
+        self.ttl_dict
+            .get(key)
+            .is_some_and(|expiration_time| *expiration_time < (self.now)())
+    }
+
+    fn remove_key(&mut self, key: &str) {
+        self.cache_dict.remove(key);
+        self.ttl_dict.remove(key);
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::sync::{
+        Arc,
+        atomic::{AtomicU64, Ordering},
+    };
+
+    use super::InMemoryCache;
+    use std::time::Duration;
+
+    fn cache(now: Arc<AtomicU64>, max_size: usize, default_ttl: Duration) -> InMemoryCache<String> {
+        InMemoryCache::with_clock(Some(max_size), Some(default_ttl), move || {
+            Duration::from_secs(now.load(Ordering::Relaxed))
+        })
+    }
+
+    #[test]
+    fn ttl_expiry_is_deterministic() {
+        let now = Arc::new(AtomicU64::new(100));
+        let mut cache = cache(now.clone(), 10, Duration::from_secs(60));
+        cache.set_cache("key", "value".to_string(), None);
+        assert_eq!(cache.get_cache("key"), Some("value".to_string()));
+        now.store(161, Ordering::Relaxed);
+        assert_eq!(cache.get_cache("key"), None);
+        assert_eq!(cache.get_ttl("key"), None);
+    }
+
+    #[test]
+    fn default_and_per_set_ttl_are_applied() {
+        let now = Arc::new(AtomicU64::new(100));
+        let mut cache = cache(now.clone(), 10, Duration::from_secs(60));
+        cache.set_cache("default", "value".to_string(), None);
+        cache.set_cache("custom", "value".to_string(), Some(Duration::from_secs(20)));
+        assert_eq!(cache.get_ttl("default"), Some(Duration::from_secs(160)));
+        assert_eq!(cache.get_ttl("custom"), Some(Duration::from_secs(120)));
+    }
+
+    #[test]
+    fn unexpired_entries_do_not_allow_ttl_override() {
+        let now = Arc::new(AtomicU64::new(100));
+        let mut cache = cache(now.clone(), 10, Duration::from_secs(60));
+        cache.set_cache("key", "first".to_string(), Some(Duration::from_secs(20)));
+        cache.set_cache("key", "second".to_string(), Some(Duration::from_secs(80)));
+        assert_eq!(cache.get_cache("key"), Some("second".to_string()));
+        assert_eq!(cache.get_ttl("key"), Some(Duration::from_secs(120)));
+        now.store(121, Ordering::Relaxed);
+        cache.set_cache("key", "third".to_string(), Some(Duration::from_secs(80)));
+        assert_eq!(cache.get_ttl("key"), Some(Duration::from_secs(201)));
+    }
+
+    #[test]
+    fn max_size_evicts_earliest_expiration() {
+        let now = Arc::new(AtomicU64::new(100));
+        let mut cache = cache(now, 2, Duration::from_secs(60));
+        cache.set_cache("early", "value".to_string(), Some(Duration::from_secs(10)));
+        cache.set_cache("late", "value".to_string(), Some(Duration::from_secs(20)));
+        cache.set_cache("new", "value".to_string(), Some(Duration::from_secs(30)));
+        assert_eq!(cache.get_cache("early"), None);
+        assert!(cache.get_cache("late").is_some());
+        assert!(cache.get_cache("new").is_some());
+    }
+
+    #[test]
+    fn expired_entries_are_evicted_before_live_entries() {
+        let now = Arc::new(AtomicU64::new(100));
+        let mut cache = cache(now.clone(), 3, Duration::from_secs(60));
+        cache.set_cache(
+            "expired-one",
+            "value".to_string(),
+            Some(Duration::from_secs(10)),
+        );
+        cache.set_cache(
+            "expired-two",
+            "value".to_string(),
+            Some(Duration::from_secs(20)),
+        );
+        cache.set_cache("live", "value".to_string(), Some(Duration::from_secs(100)));
+        now.store(121, Ordering::Relaxed);
+        cache.set_cache("new", "value".to_string(), Some(Duration::from_secs(100)));
+        assert_eq!(cache.get_cache("expired-one"), None);
+        assert_eq!(cache.get_cache("expired-two"), None);
+        assert!(cache.get_cache("live").is_some());
+        assert!(cache.get_cache("new").is_some());
+    }
+
+    #[test]
+    fn stale_heap_entries_are_skipped() {
+        let now = Arc::new(AtomicU64::new(100));
+        let mut cache = cache(now, 1, Duration::from_secs(60));
+        cache.set_cache(
+            "removed",
+            "value".to_string(),
+            Some(Duration::from_secs(10)),
+        );
+        cache.delete_cache("removed");
+        cache.set_cache("kept", "value".to_string(), Some(Duration::from_secs(20)));
+        cache.set_cache("new", "value".to_string(), Some(Duration::from_secs(30)));
+        assert_eq!(cache.get_cache("removed"), None);
+        assert_eq!(cache.get_cache("kept"), None);
+        assert!(cache.get_cache("new").is_some());
+    }
+
+    #[test]
+    fn delete_and_flush_remove_values_and_ttls() {
+        let now = Arc::new(AtomicU64::new(100));
+        let mut cache = cache(now, 10, Duration::from_secs(60));
+        cache.set_cache("one", "value".to_string(), None);
+        cache.set_cache("two", "value".to_string(), None);
+        cache.delete_cache("one");
+        assert_eq!(cache.get_cache("one"), None);
+        cache.flush_cache();
+        assert!(cache.cache_dict.is_empty());
+        assert!(cache.ttl_dict.is_empty());
+        assert!(cache.expiration_heap.is_empty());
+    }
+
+    #[test]
+    fn zero_max_size_does_not_cache() {
+        let now = Arc::new(AtomicU64::new(100));
+        let mut cache = cache(now, 0, Duration::from_secs(60));
+        cache.set_cache("key", "value".to_string(), None);
+        assert_eq!(cache.get_cache("key"), None);
+        assert!(cache.cache_dict.is_empty());
+    }
+}
--- a/litellm-rust/crates/core/src/caching/mod.rs
+++ b/litellm-rust/crates/core/src/caching/mod.rs
@ -0,0 +1 @@
+pub mod in_memory_cache;
--- a/litellm-rust/crates/core/src/lib.rs
+++ b/litellm-rust/crates/core/src/lib.rs
@ -1,4 +1,6 @@
+pub mod audio_transcription;
 pub mod cache;
+pub mod caching;
 pub mod call_lifecycle;
 pub mod constants;
 pub mod error;
--- a/litellm-rust/crates/core/src/messages/transformation.rs
+++ b/litellm-rust/crates/core/src/messages/transformation.rs
@ -35,6 +35,10 @@ pub trait AnthropicMessagesProviderConfig: Sync {
        MessagesAuthStrategy::Header("x-api-key")
    }

+    fn accepts_bearer_auth(&self) -> bool {
+        false
+    }
+
    fn default_headers(&self) -> &'static [(&'static str, &'static str)] {
        &[
            ("anthropic-version", "2023-06-01"),
--- a/litellm-rust/crates/core/src/providers/azure_ai/messages/transformation.rs
+++ b/litellm-rust/crates/core/src/providers/azure_ai/messages/transformation.rs
@ -5,7 +5,7 @@ use crate::messages::types::{
    MessageContent, SystemPrompt,
 };
 use crate::providers::anthropic::messages::transformation::{
-    non_empty, AnthropicMessagesConfig, ANTHROPIC_MESSAGES_CONFIG,
+    ANTHROPIC_MESSAGES_CONFIG, AnthropicMessagesConfig, non_empty,
 };
 use serde_json::{Map, Value};

@ -163,6 +163,10 @@ impl AnthropicMessagesProviderConfig for AzureAnthropicMessagesConfig {
        self.anthropic.auth_strategy()
    }

+    fn accepts_bearer_auth(&self) -> bool {
+        true
+    }
+
    fn default_headers(&self) -> &'static [(&'static str, &'static str)] {
        self.anthropic.default_headers()
    }
@ -294,6 +298,11 @@ mod tests {
        );
    }

+    #[test]
+    fn accepts_bearer_auth_for_entra_id() {
+        assert!(AZURE_ANTHROPIC_MESSAGES_CONFIG.accepts_bearer_auth());
+    }
+
    #[test]
    fn default_headers_match_python() {
        assert_eq!(
--- a/litellm-rust/crates/core/src/providers/azure_ai/ocr/transformation.rs
+++ b/litellm-rust/crates/core/src/providers/azure_ai/ocr/transformation.rs
@ -1,9 +1,9 @@
 use std::collections::BTreeSet;

-use crate::error::{json_type_name, CoreError, CoreResult};
+use crate::error::{CoreError, CoreResult, json_type_name};
 use crate::ocr::transformation::{OcrAuthStrategy, OcrProviderConfig, OcrResponseHandling};
 use crate::ocr::types::{OcrRequestData, OcrResponseData};
-use serde_json::{json, Map, Value};
+use serde_json::{Map, Value, json};

 use crate::providers::mistral::ocr::transformation::MISTRAL_OCR_CONFIG;

@ -206,11 +206,11 @@ pub fn complete_document_intelligence_url(
        AZURE_DOCUMENT_INTELLIGENCE_API_VERSION
    );

-    if let Some(pages) = optional_params.get("pages") {
-        if let Some(normalized) = normalize_pages_param(pages)? {
-            url.push_str("&pages=");
-            url.push_str(&normalized);
-        }
+    if let Some(pages) = optional_params.get("pages")
+        && let Some(normalized) = normalize_pages_param(pages)?
+    {
+        url.push_str("&pages=");
+        url.push_str(&normalized);
    }

    Ok(url)
@ -231,7 +231,7 @@ fn document_url_from_mistral_document(document: &Value) -> CoreResult<&str> {
        other => {
            return Err(CoreError::InvalidRequest(format!(
                "Invalid document type: {other}. Must be 'document_url' or 'image_url'"
-            )))
+            )));
        }
    };
    object
--- a/litellm-rust/crates/core/src/providers/bedrock/audio_transcription.rs
+++ b/litellm-rust/crates/core/src/providers/bedrock/audio_transcription.rs
@ -0,0 +1,310 @@
+use serde_json::{Map, Value, json};
+
+use crate::audio_transcription::transformation::{
+    AudioTranscriptionAuth, AudioTranscriptionProviderConfig,
+};
+use crate::audio_transcription::types::{
+    AudioTranscriptionRequestData, AudioTranscriptionResponseData,
+};
+use crate::error::{CoreError, CoreResult, json_type_name};
+
+use super::aws_base::AwsAuthConfig;
+use super::constants::{
+    AWS_REGION, AWS_REGION_NAME, BEDROCK_RUNTIME_ENDPOINT_TEMPLATE, BEDROCK_SERVICE,
+    DEFAULT_BEDROCK_REGION,
+};
+
+const SUPPORTED_PARAMS: &[&str] = &["language", "prompt", "temperature", "response_format"];
+
+pub static BEDROCK_AUDIO_TRANSCRIPTION_CONFIG: BedrockAudioTranscriptionConfig =
+    BedrockAudioTranscriptionConfig;
+
+pub struct BedrockAudioTranscriptionConfig;
+
+pub fn bedrock_model_id_and_region(model: &str) -> (String, Option<String>) {
+    let mut stripped = model;
+    for prefix in ["bedrock/converse/", "bedrock/", "converse/"] {
+        if let Some(value) = stripped.strip_prefix(prefix) {
+            stripped = value;
+            break;
+        }
+    }
+    let mut region = None;
+    if let Some((candidate, remainder)) = stripped.split_once('/')
+        && is_bedrock_region(candidate)
+    {
+        region = Some(candidate.to_string());
+        stripped = remainder;
+    }
+    for prefix in ["nova-2/", "nova/"] {
+        if let Some(value) = stripped.strip_prefix(prefix) {
+            stripped = value;
+            break;
+        }
+    }
+    if region.is_none() {
+        region = stripped
+            .strip_prefix("arn:")
+            .and_then(|value| value.split(':').nth(3))
+            .filter(|value| !value.is_empty())
+            .map(str::to_string);
+    }
+    (stripped.to_string(), region)
+}
+
+fn is_bedrock_region(value: &str) -> bool {
+    value.len() > 3
+        && value.contains('-')
+        && value
+            .chars()
+            .all(|char| char.is_ascii_alphanumeric() || char == '-')
+}
+
+pub fn resolve_bedrock_region(
+    model_region: Option<&str>,
+    optional_params: &Map<String, Value>,
+    env_lookup: &dyn Fn(&str) -> Option<String>,
+) -> String {
+    if let Some(region) = optional_params
+        .get("aws_region_name")
+        .and_then(Value::as_str)
+    {
+        return region.to_string();
+    }
+    if let Some(region) = model_region {
+        return region.to_string();
+    }
+    env_lookup(AWS_REGION_NAME)
+        .or_else(|| env_lookup(AWS_REGION))
+        .unwrap_or_else(|| DEFAULT_BEDROCK_REGION.to_string())
+}
+
+fn audio_fields(audio: Value) -> CoreResult<(String, String)> {
+    let object = audio.as_object().ok_or_else(|| CoreError::InvalidType {
+        expected: "object",
+        actual: json_type_name(&audio),
+    })?;
+    let data = object
+        .get("data")
+        .and_then(Value::as_str)
+        .filter(|value| !value.is_empty())
+        .ok_or(CoreError::MissingField("audio.data"))?;
+    let format = object
+        .get("format")
+        .and_then(Value::as_str)
+        .filter(|value| matches!(*value, "wav" | "mp3" | "flac" | "ogg"))
+        .ok_or_else(|| {
+            CoreError::InvalidRequest("audio.format must be wav, mp3, flac, or ogg".to_string())
+        })?;
+    Ok((data.to_string(), format.to_string()))
+}
+
+fn optional_string<'a>(params: &'a Map<String, Value>, key: &str) -> Option<&'a str> {
+    params
+        .get(key)
+        .and_then(Value::as_str)
+        .filter(|value| !value.is_empty())
+}
+
+impl AudioTranscriptionProviderConfig for BedrockAudioTranscriptionConfig {
+    fn supported_transcription_params(&self) -> &'static [&'static str] {
+        SUPPORTED_PARAMS
+    }
+
+    fn transform_transcription_request(
+        &self,
+        _model: &str,
+        audio: Value,
+        optional_params: Map<String, Value>,
+    ) -> CoreResult<AudioTranscriptionRequestData> {
+        let (data, format) = audio_fields(audio)?;
+        let mut instruction = "Transcribe the audio. Respond with only the transcript.".to_string();
+        if let Some(language) = optional_string(&optional_params, "language") {
+            instruction.push_str(&format!(" The audio language is {language}."));
+        }
+        if let Some(prompt) = optional_string(&optional_params, "prompt") {
+            instruction.push_str(&format!(" Additional context: {prompt}"));
+        }
+        let mut inference_config = Map::from_iter([("maxTokens".to_string(), json!(4096))]);
+        if let Some(temperature) = optional_params.get("temperature") {
+            inference_config.insert("temperature".to_string(), temperature.clone());
+        }
+        Ok(AudioTranscriptionRequestData {
+            body: json!({
+                "messages": [{
+                    "role": "user",
+                    "content": [
+                        {"audio": {"format": format, "source": {"bytes": data}}},
+                        {"text": instruction}
+                    ]
+                }],
+                "system": [{"text": "You are a transcription assistant."}],
+                "inferenceConfig": inference_config,
+            }),
+        })
+    }
+
+    fn transform_transcription_response(
+        &self,
+        _model: &str,
+        response_json: Value,
+    ) -> CoreResult<AudioTranscriptionResponseData> {
+        let content = response_json
+            .get("output")
+            .and_then(|value| value.get("message"))
+            .and_then(|value| value.get("content"))
+            .and_then(Value::as_array)
+            .ok_or_else(|| {
+                CoreError::InvalidResponse("Bedrock response has no output content".to_string())
+            })?;
+        let mut text = String::new();
+        for block in content {
+            if let Some(value) = block.get("text").and_then(Value::as_str) {
+                text.push_str(value);
+            }
+        }
+        Ok(AudioTranscriptionResponseData { text })
+    }
+
+    fn complete_url(
+        &self,
+        api_base: Option<&str>,
+        model: &str,
+        optional_params: &Map<String, Value>,
+        env_lookup: &dyn Fn(&str) -> Option<String>,
+    ) -> CoreResult<String> {
+        let (model_id, model_region) = bedrock_model_id_and_region(model);
+        let region = resolve_bedrock_region(model_region.as_deref(), optional_params, env_lookup);
+        let endpoint = optional_params
+            .get("aws_bedrock_runtime_endpoint")
+            .and_then(Value::as_str)
+            .or(api_base)
+            .map(str::trim)
+            .filter(|value| !value.is_empty())
+            .map(str::to_string)
+            .unwrap_or_else(|| BEDROCK_RUNTIME_ENDPOINT_TEMPLATE.replace("{region}", &region));
+        Ok(format!(
+            "{}/model/{model_id}/converse",
+            endpoint.trim_end_matches('/')
+        ))
+    }
+
+    fn auth_strategy(
+        &self,
+        model: &str,
+        optional_params: &Map<String, Value>,
+        env_lookup: &dyn Fn(&str) -> Option<String>,
+    ) -> CoreResult<AudioTranscriptionAuth> {
+        let (_, model_region) = bedrock_model_id_and_region(model);
+        Ok(AudioTranscriptionAuth::AwsSigV4 {
+            region: resolve_bedrock_region(model_region.as_deref(), optional_params, env_lookup),
+            service: BEDROCK_SERVICE,
+        })
+    }
+}
+
+pub fn aws_auth_config(
+    optional_params: &Map<String, Value>,
+    env_lookup: &dyn Fn(&str) -> Option<String>,
+) -> AwsAuthConfig {
+    let value = |key: &str| {
+        optional_params
+            .get(key)
+            .and_then(Value::as_str)
+            .map(str::to_string)
+    };
+    let env = |key: &str| env_lookup(key);
+    AwsAuthConfig {
+        access_key_id: value("aws_access_key_id").or_else(|| env("AWS_ACCESS_KEY_ID")),
+        secret_access_key: value("aws_secret_access_key").or_else(|| env("AWS_SECRET_ACCESS_KEY")),
+        session_token: value("aws_session_token").or_else(|| env("AWS_SESSION_TOKEN")),
+        region_name: value("aws_region_name").or_else(|| env(AWS_REGION_NAME)),
+        session_name: value("aws_session_name").or_else(|| env("AWS_SESSION_NAME")),
+        profile_name: value("aws_profile_name").or_else(|| env("AWS_PROFILE_NAME")),
+        role_name: value("aws_role_name").or_else(|| env("AWS_ROLE_NAME")),
+        web_identity_token: value("aws_web_identity_token")
+            .or_else(|| env("AWS_WEB_IDENTITY_TOKEN")),
+        sts_endpoint: value("aws_sts_endpoint").or_else(|| env("AWS_STS_ENDPOINT")),
+        external_id: value("aws_external_id").or_else(|| env("AWS_EXTERNAL_ID")),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn no_env(_: &str) -> Option<String> {
+        None
+    }
+
+    #[test]
+    fn request_matches_python_shape() {
+        let params = Map::from_iter([
+            ("language".to_string(), json!("en")),
+            ("prompt".to_string(), json!("Speaker names")),
+            ("temperature".to_string(), json!(0)),
+            ("timestamp_granularities".to_string(), json!(["word"])),
+        ]);
+        let params = BEDROCK_AUDIO_TRANSCRIPTION_CONFIG.map_transcription_params(&params);
+        let result = BEDROCK_AUDIO_TRANSCRIPTION_CONFIG
+            .transform_transcription_request(
+                "mistral.voxtral-mini-3b-2507",
+                json!({"data": "AQI=", "format": "wav", "filename": "sample.wav"}),
+                params,
+            )
+            .expect("request");
+        assert_eq!(
+            result.body,
+            json!({
+                "messages": [{
+                    "role": "user",
+                    "content": [
+                        {"audio": {"format": "wav", "source": {"bytes": "AQI="}}},
+                        {"text": "Transcribe the audio. Respond with only the transcript. The audio language is en. Additional context: Speaker names"}
+                    ]
+                }],
+                "system": [{"text": "You are a transcription assistant."}],
+                "inferenceConfig": {"maxTokens": 4096, "temperature": 0}
+            })
+        );
+    }
+
+    #[test]
+    fn response_concatenates_content_blocks() {
+        let result = BEDROCK_AUDIO_TRANSCRIPTION_CONFIG
+            .transform_transcription_response(
+                "model",
+                json!({"output": {"message": {"content": [{"text": "hello "}, {"text": "world"}]}}}),
+            )
+            .expect("response");
+        assert_eq!(result.text, "hello world");
+        assert_eq!(result.into_json(), json!({"text": "hello world"}));
+    }
+
+    #[test]
+    fn invalid_audio_is_rejected() {
+        let result = BEDROCK_AUDIO_TRANSCRIPTION_CONFIG.transform_transcription_request(
+            "model",
+            json!({"data": "AQI="}),
+            Map::new(),
+        );
+        assert!(result.is_err());
+    }
+
+    #[test]
+    fn region_and_url_precedence_match_python() {
+        let params = Map::from_iter([("aws_region_name".to_string(), json!("eu-west-1"))]);
+        let url = BEDROCK_AUDIO_TRANSCRIPTION_CONFIG
+            .complete_url(
+                None,
+                "bedrock/us-east-1/mistral.voxtral-mini-3b-2507",
+                &params,
+                &no_env,
+            )
+            .expect("url");
+        assert_eq!(
+            url,
+            "https://bedrock-runtime.eu-west-1.amazonaws.com/model/mistral.voxtral-mini-3b-2507/converse"
+        );
+    }
+}
--- a/litellm-rust/crates/core/src/providers/bedrock/aws_base.rs
+++ b/litellm-rust/crates/core/src/providers/bedrock/aws_base.rs
@ -0,0 +1,726 @@
+use std::collections::BTreeMap;
+use std::sync::{Mutex, OnceLock};
+use std::time::Duration;
+use std::time::{SystemTime, UNIX_EPOCH};
+
+use crate::caching::in_memory_cache::InMemoryCache;
+use crate::error::{CoreError, CoreResult};
+use aws_credential_types::Credentials;
+use aws_credential_types::provider::ProvideCredentials;
+use aws_sigv4::http_request::{
+    SignableBody, SignableRequest, SigningParams, SigningSettings, sign,
+};
+use aws_sigv4::sign::v4;
+use aws_smithy_runtime_api::client::identity::Identity;
+use sha2::{Digest, Sha256};
+
+use super::constants::{
+    AWS_ACCESS_KEY_ID, AWS_EXTERNAL_ID, AWS_PROFILE_NAME, AWS_REGION_NAME, AWS_ROLE_ARN,
+    AWS_ROLE_NAME, AWS_SECRET_ACCESS_KEY, AWS_SESSION_NAME, AWS_SESSION_TOKEN, AWS_STS_ENDPOINT,
+    AWS_WEB_IDENTITY_TOKEN, AWS_WEB_IDENTITY_TOKEN_FILE, BEDROCK_SERVICE,
+    DEFAULT_SESSION_NAME_PREFIX,
+};
+
+const STATIC_CREDENTIALS_TTL: Duration = Duration::from_secs(3600 - 60);
+const AMBIENT_CREDENTIALS_TTL: Duration = Duration::from_secs(600);
+
+static IAM_CREDENTIALS_CACHE: OnceLock<Mutex<InMemoryCache<Credentials>>> = OnceLock::new();
+
+fn credential_cache_ttl(flow: &AwsAuthFlow) -> Option<Duration> {
+    match flow {
+        AwsAuthFlow::StaticKeys { .. } => Some(STATIC_CREDENTIALS_TTL),
+        AwsAuthFlow::DefaultChain => Some(AMBIENT_CREDENTIALS_TTL),
+        AwsAuthFlow::WebIdentity { .. }
+        | AwsAuthFlow::AssumeRole { .. }
+        | AwsAuthFlow::Profile { .. }
+        | AwsAuthFlow::SessionToken { .. } => None,
+    }
+}
+
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+pub struct AwsAuthConfig {
+    pub access_key_id: Option<String>,
+    pub secret_access_key: Option<String>,
+    pub session_token: Option<String>,
+    pub region_name: Option<String>,
+    pub session_name: Option<String>,
+    pub profile_name: Option<String>,
+    pub role_name: Option<String>,
+    pub web_identity_token: Option<String>,
+    pub sts_endpoint: Option<String>,
+    pub external_id: Option<String>,
+}
+
+impl AwsAuthConfig {
+    fn with_environment(self, env_lookup: &(dyn Fn(&str) -> Option<String> + Sync)) -> Self {
+        Self {
+            access_key_id: self.access_key_id.or_else(|| env_lookup(AWS_ACCESS_KEY_ID)),
+            secret_access_key: self
+                .secret_access_key
+                .or_else(|| env_lookup(AWS_SECRET_ACCESS_KEY)),
+            session_token: self.session_token.or_else(|| env_lookup(AWS_SESSION_TOKEN)),
+            region_name: self.region_name.or_else(|| env_lookup(AWS_REGION_NAME)),
+            session_name: self.session_name.or_else(|| env_lookup(AWS_SESSION_NAME)),
+            profile_name: self.profile_name.or_else(|| env_lookup(AWS_PROFILE_NAME)),
+            role_name: self.role_name.or_else(|| env_lookup(AWS_ROLE_NAME)),
+            web_identity_token: self
+                .web_identity_token
+                .or_else(|| env_lookup(AWS_WEB_IDENTITY_TOKEN)),
+            sts_endpoint: self.sts_endpoint.or_else(|| env_lookup(AWS_STS_ENDPOINT)),
+            external_id: self.external_id.or_else(|| env_lookup(AWS_EXTERNAL_ID)),
+        }
+    }
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum AwsAuthFlow {
+    WebIdentity {
+        token: String,
+        role: String,
+        session_name: String,
+    },
+    AssumeRole {
+        role: String,
+        session_name: Option<String>,
+    },
+    Profile {
+        name: String,
+    },
+    SessionToken {
+        access_key_id: String,
+        secret_access_key: String,
+        session_token: String,
+    },
+    StaticKeys {
+        access_key_id: String,
+        secret_access_key: String,
+        region_name: String,
+    },
+    DefaultChain,
+}
+
+fn cache_key(config: &AwsAuthConfig, flow: &AwsAuthFlow) -> String {
+    let mut hasher = Sha256::new();
+    hasher.update(format!("{config:?}:{flow:?}"));
+    format!("{:x}", hasher.finalize())
+}
+
+fn get_cached_credentials(key: &str) -> Option<Credentials> {
+    let cache = IAM_CREDENTIALS_CACHE.get_or_init(|| Mutex::new(InMemoryCache::default()));
+    let mut entries = cache.lock().ok()?;
+    entries.get_cache(key)
+}
+
+fn set_cached_credentials(key: String, credentials: Credentials, ttl: Duration) {
+    let cache = IAM_CREDENTIALS_CACHE.get_or_init(|| Mutex::new(InMemoryCache::default()));
+    if let Ok(mut entries) = cache.lock() {
+        entries.set_cache(key, credentials, Some(ttl));
+    }
+}
+
+fn role_identity(arn: &str) -> Option<(&str, &str, &str)> {
+    let mut parts = arn.splitn(6, ':');
+    let ("arn", partition, _, _, account, resource) = (
+        parts.next()?,
+        parts.next()?,
+        parts.next()?,
+        parts.next()?,
+        parts.next()?,
+        parts.next()?,
+    ) else {
+        return None;
+    };
+    let role = if let Some(role) = resource.strip_prefix("role/") {
+        role.rsplit('/').next()?
+    } else {
+        resource.strip_prefix("assumed-role/")?.split('/').next()?
+    };
+    Some((partition, account, role))
+}
+
+fn same_role_arns(target: &str, caller: &str) -> bool {
+    role_identity(target) == role_identity(caller)
+}
+
+pub fn classify_auth(
+    config: AwsAuthConfig,
+    env_lookup: &(dyn Fn(&str) -> Option<String> + Sync),
+) -> AwsAuthFlow {
+    let config = config.with_environment(env_lookup);
+    if let (Some(token), Some(role), Some(session_name)) = (
+        config.web_identity_token.clone(),
+        config.role_name.clone(),
+        config.session_name.clone(),
+    ) {
+        return AwsAuthFlow::WebIdentity {
+            token,
+            role,
+            session_name,
+        };
+    }
+    if let Some(role) = config.role_name.clone() {
+        return AwsAuthFlow::AssumeRole {
+            role,
+            session_name: config.session_name.clone(),
+        };
+    }
+    if let Some(name) = config.profile_name {
+        return AwsAuthFlow::Profile { name };
+    }
+    if let (Some(access_key_id), Some(secret_access_key), Some(session_token)) = (
+        config.access_key_id.clone(),
+        config.secret_access_key.clone(),
+        config.session_token,
+    ) {
+        return AwsAuthFlow::SessionToken {
+            access_key_id,
+            secret_access_key,
+            session_token,
+        };
+    }
+    if let (Some(access_key_id), Some(secret_access_key), Some(region_name)) = (
+        config.access_key_id,
+        config.secret_access_key,
+        config.region_name,
+    ) {
+        return AwsAuthFlow::StaticKeys {
+            access_key_id,
+            secret_access_key,
+            region_name,
+        };
+    }
+    AwsAuthFlow::DefaultChain
+}
+
+pub async fn resolve_credentials(
+    config: AwsAuthConfig,
+    env_lookup: &(dyn Fn(&str) -> Option<String> + Sync),
+) -> CoreResult<Credentials> {
+    let resolved = config.clone().with_environment(env_lookup);
+    let flow = classify_auth(config, env_lookup);
+    match flow {
+        AwsAuthFlow::SessionToken {
+            access_key_id,
+            secret_access_key,
+            session_token,
+        } => Ok(Credentials::new(
+            access_key_id,
+            secret_access_key,
+            Some(session_token),
+            None,
+            "litellm-static-session",
+        )),
+        AwsAuthFlow::StaticKeys {
+            access_key_id,
+            secret_access_key,
+            region_name,
+        } => {
+            let flow = AwsAuthFlow::StaticKeys {
+                access_key_id: access_key_id.clone(),
+                secret_access_key: secret_access_key.clone(),
+                region_name,
+            };
+            let key = cache_key(&resolved, &flow);
+            if let Some(credentials) = get_cached_credentials(&key) {
+                return Ok(credentials);
+            }
+            let credentials = Credentials::new(
+                access_key_id,
+                secret_access_key,
+                None,
+                None,
+                "litellm-static",
+            );
+            set_cached_credentials(
+                key,
+                credentials.clone(),
+                credential_cache_ttl(&flow).unwrap_or(STATIC_CREDENTIALS_TTL),
+            );
+            Ok(credentials)
+        }
+        AwsAuthFlow::Profile { name } => {
+            let provider = aws_config::profile::ProfileFileCredentialsProvider::builder()
+                .profile_name(name)
+                .build();
+            provider.provide_credentials().await.map_err(|error| {
+                CoreError::Auth(format!("AWS profile credentials failed: {error}"))
+            })
+        }
+        AwsAuthFlow::AssumeRole { role, session_name } => {
+            if is_already_running_as_role(&role, &resolved).await? {
+                let ambient_flow = AwsAuthFlow::DefaultChain;
+                let key = cache_key(&resolved, &ambient_flow);
+                if let Some(credentials) = get_cached_credentials(&key) {
+                    return Ok(credentials);
+                }
+                let provider =
+                    aws_config::default_provider::credentials::DefaultCredentialsChain::builder()
+                        .build()
+                        .await;
+                let credentials = provider.provide_credentials().await.map_err(|error| {
+                    CoreError::Auth(format!("AWS default credentials failed: {error}"))
+                })?;
+                set_cached_credentials(
+                    key,
+                    credentials.clone(),
+                    credential_cache_ttl(&ambient_flow).unwrap_or(AMBIENT_CREDENTIALS_TTL),
+                );
+                return Ok(credentials);
+            }
+            let mut loader = aws_config::defaults(aws_config::BehaviorVersion::latest());
+            if let Some(region) = resolved.region_name.clone() {
+                loader = loader.region(aws_types::region::Region::new(region));
+            }
+            if let Some(endpoint) = resolved.sts_endpoint.clone() {
+                loader = loader.endpoint_url(endpoint);
+            }
+            if let (Some(access_key_id), Some(secret_access_key)) =
+                (resolved.access_key_id, resolved.secret_access_key)
+            {
+                loader = loader.credentials_provider(Credentials::new(
+                    access_key_id,
+                    secret_access_key,
+                    resolved.session_token,
+                    None,
+                    "litellm-role-source",
+                ));
+            }
+            let sdk_config = loader.load().await;
+            let builder = aws_config::sts::AssumeRoleProvider::builder(role);
+            let builder = match session_name {
+                Some(name) => builder.session_name(name),
+                None => builder.session_name(default_session_name()),
+            };
+            let builder = match resolved.external_id {
+                Some(id) => builder.external_id(id),
+                None => builder,
+            };
+            let provider = builder.configure(&sdk_config).build().await;
+            provider
+                .provide_credentials()
+                .await
+                .map_err(|error| CoreError::Auth(format!("AWS role credentials failed: {error}")))
+        }
+        AwsAuthFlow::WebIdentity {
+            token,
+            role,
+            session_name,
+        } => {
+            let mut loader = aws_config::defaults(aws_config::BehaviorVersion::latest());
+            if let Some(region) = resolved.region_name {
+                loader = loader.region(aws_types::region::Region::new(region));
+            }
+            if let Some(endpoint) = resolved.sts_endpoint {
+                loader = loader.endpoint_url(endpoint);
+            }
+            let sdk_config = loader.load().await;
+            let client = aws_sdk_sts::Client::new(&sdk_config);
+            let response = client
+                .assume_role_with_web_identity()
+                .role_arn(role)
+                .role_session_name(session_name)
+                .web_identity_token(token)
+                .send()
+                .await
+                .map_err(|error| {
+                    CoreError::Auth(format!("AWS web identity credentials failed: {error}"))
+                })?;
+            let credentials = response.credentials().ok_or_else(|| {
+                CoreError::Auth("AWS web identity response had no credentials".to_string())
+            })?;
+            let expiration = SystemTime::try_from(*credentials.expiration()).map_err(|error| {
+                CoreError::Auth(format!("AWS web identity expiration was invalid: {error}"))
+            })?;
+            Ok(Credentials::new(
+                credentials.access_key_id(),
+                credentials.secret_access_key(),
+                Some(credentials.session_token().to_string()),
+                Some(expiration),
+                "litellm-web-identity",
+            ))
+        }
+        AwsAuthFlow::DefaultChain => {
+            let key = cache_key(&resolved, &AwsAuthFlow::DefaultChain);
+            if let Some(credentials) = get_cached_credentials(&key) {
+                return Ok(credentials);
+            }
+            let provider =
+                aws_config::default_provider::credentials::DefaultCredentialsChain::builder()
+                    .build()
+                    .await;
+            let credentials = provider.provide_credentials().await.map_err(|error| {
+                CoreError::Auth(format!("AWS default credentials failed: {error}"))
+            })?;
+            set_cached_credentials(
+                key,
+                credentials.clone(),
+                credential_cache_ttl(&AwsAuthFlow::DefaultChain).unwrap_or(AMBIENT_CREDENTIALS_TTL),
+            );
+            Ok(credentials)
+        }
+    }
+}
+
+async fn is_already_running_as_role(role: &str, config: &AwsAuthConfig) -> CoreResult<bool> {
+    if role_identity(role).is_none() {
+        return Ok(false);
+    }
+    if let (Ok(current_role), Ok(token_file)) = (
+        std::env::var(AWS_ROLE_ARN),
+        std::env::var(AWS_WEB_IDENTITY_TOKEN_FILE),
+    ) && !token_file.is_empty()
+    {
+        return Ok(same_role_arns(role, &current_role));
+    }
+
+    let mut loader = aws_config::defaults(aws_config::BehaviorVersion::latest());
+    if let Some(region) = config.region_name.clone() {
+        loader = loader.region(aws_types::region::Region::new(region));
+    }
+    if let Some(endpoint) = config.sts_endpoint.clone() {
+        loader = loader.endpoint_url(endpoint);
+    }
+    let sdk_config = loader.load().await;
+    let response = match aws_sdk_sts::Client::new(&sdk_config)
+        .get_caller_identity()
+        .send()
+        .await
+    {
+        Ok(response) => response,
+        Err(_) => return Ok(false),
+    };
+    Ok(response
+        .arn()
+        .is_some_and(|caller| same_role_arns(role, caller)))
+}
+
+fn default_session_name() -> String {
+    let seconds = SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .map_or(0, |duration| duration.as_secs());
+    format!("{DEFAULT_SESSION_NAME_PREFIX}-{seconds}")
+}
+
+pub fn sign_bedrock_post(
+    url: &str,
+    body: &[u8],
+    headers: &BTreeMap<String, String>,
+    region: &str,
+    credentials: &Credentials,
+    signing_time: SystemTime,
+) -> CoreResult<BTreeMap<String, String>> {
+    let identity: Identity = credentials.clone().into();
+    let params = v4::SigningParams::builder()
+        .identity(&identity)
+        .region(region)
+        .name(BEDROCK_SERVICE)
+        .time(signing_time)
+        .settings(SigningSettings::default())
+        .build()
+        .map(SigningParams::from)
+        .map_err(|error| CoreError::Auth(format!("AWS signing parameters failed: {error}")))?;
+    let header_refs = headers
+        .iter()
+        .map(|(name, value)| (name.as_str(), value.as_str()));
+    let request = SignableRequest::new("POST", url, header_refs, SignableBody::Bytes(body))
+        .map_err(|error| CoreError::Auth(format!("AWS signable request failed: {error}")))?;
+    let (instructions, _) = sign(request, &params)
+        .map_err(|error| CoreError::Auth(format!("AWS request signing failed: {error}")))?
+        .into_parts();
+    Ok(instructions
+        .headers()
+        .map(|(name, value)| {
+            let normalized_name = match name {
+                "authorization" => "Authorization",
+                "x-amz-date" => "X-Amz-Date",
+                "x-amz-security-token" => "X-Amz-Security-Token",
+                _ => name,
+            };
+            (normalized_name.to_string(), value.to_string())
+        })
+        .collect())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn no_env(_: &str) -> Option<String> {
+        None
+    }
+
+    fn parity_inputs() -> (String, Vec<u8>, BTreeMap<String, String>) {
+        (
+            "https://bedrock-runtime.us-east-1.amazonaws.com/model/amazon.titan-text-express-v1/invoke"
+                .to_string(),
+            br#"{"input":"hello"}"#.to_vec(),
+            BTreeMap::from([("Content-Type".to_string(), "application/json".to_string())]),
+        )
+    }
+
+    #[test]
+    fn classification_preserves_python_precedence() {
+        let config = AwsAuthConfig {
+            access_key_id: Some("ak".into()),
+            secret_access_key: Some("sk".into()),
+            session_token: Some("token".into()),
+            region_name: Some("us-east-1".into()),
+            session_name: Some("session".into()),
+            profile_name: Some("profile".into()),
+            role_name: Some("role".into()),
+            web_identity_token: Some("oidc".into()),
+            ..Default::default()
+        };
+        assert!(matches!(
+            classify_auth(config, &no_env),
+            AwsAuthFlow::WebIdentity { .. }
+        ));
+    }
+
+    #[test]
+    fn classification_covers_fallthroughs() {
+        let env = |key: &str| match key {
+            AWS_PROFILE_NAME => Some("profile".into()),
+            _ => None,
+        };
+        assert!(matches!(
+            classify_auth(AwsAuthConfig::default(), &env),
+            AwsAuthFlow::Profile { .. }
+        ));
+        assert!(matches!(
+            classify_auth(
+                AwsAuthConfig {
+                    access_key_id: Some("ak".into()),
+                    secret_access_key: Some("sk".into()),
+                    session_token: Some("token".into()),
+                    ..Default::default()
+                },
+                &no_env
+            ),
+            AwsAuthFlow::SessionToken { .. }
+        ));
+        assert!(matches!(
+            classify_auth(
+                AwsAuthConfig {
+                    access_key_id: Some("ak".into()),
+                    secret_access_key: Some("sk".into()),
+                    region_name: Some("us-east-1".into()),
+                    ..Default::default()
+                },
+                &no_env
+            ),
+            AwsAuthFlow::StaticKeys { .. }
+        ));
+        assert_eq!(
+            classify_auth(AwsAuthConfig::default(), &no_env),
+            AwsAuthFlow::DefaultChain
+        );
+    }
+
+    #[tokio::test]
+    async fn static_credentials_do_not_use_network() {
+        let credentials = resolve_credentials(
+            AwsAuthConfig {
+                access_key_id: Some("ak".into()),
+                secret_access_key: Some("sk".into()),
+                region_name: Some("us-east-1".into()),
+                ..Default::default()
+            },
+            &no_env,
+        )
+        .await
+        .expect("static credentials");
+        assert_eq!(credentials.access_key_id(), "ak");
+        assert_eq!(credentials.session_token(), None);
+    }
+
+    #[test]
+    fn cache_policy_matches_python_flows() {
+        assert_eq!(
+            credential_cache_ttl(&AwsAuthFlow::StaticKeys {
+                access_key_id: "ak".into(),
+                secret_access_key: "sk".into(),
+                region_name: "us-east-1".into(),
+            }),
+            Some(STATIC_CREDENTIALS_TTL)
+        );
+        assert_eq!(
+            credential_cache_ttl(&AwsAuthFlow::DefaultChain),
+            Some(AMBIENT_CREDENTIALS_TTL)
+        );
+        assert_eq!(
+            credential_cache_ttl(&AwsAuthFlow::SessionToken {
+                access_key_id: "ak".into(),
+                secret_access_key: "sk".into(),
+                session_token: "token".into(),
+            }),
+            None
+        );
+        assert_eq!(
+            credential_cache_ttl(&AwsAuthFlow::Profile {
+                name: "profile".into()
+            }),
+            None
+        );
+        assert_eq!(
+            credential_cache_ttl(&AwsAuthFlow::AssumeRole {
+                role: "arn:aws:iam::123456789012:role/demo".into(),
+                session_name: None,
+            }),
+            None
+        );
+        assert_eq!(
+            credential_cache_ttl(&AwsAuthFlow::WebIdentity {
+                token: "token".into(),
+                role: "arn:aws:iam::123456789012:role/demo".into(),
+                session_name: "session".into(),
+            }),
+            None
+        );
+    }
+
+    #[test]
+    fn cache_round_trip_preserves_credentials() {
+        let key = format!("cache-test-{}", std::process::id());
+        let credentials = Credentials::new("cache-ak", "cache-sk", None, None, "test");
+        set_cached_credentials(key.clone(), credentials.clone(), STATIC_CREDENTIALS_TTL);
+        assert_eq!(
+            get_cached_credentials(&key).map(|value| value.access_key_id().to_string()),
+            Some("cache-ak".to_string())
+        );
+    }
+
+    #[test]
+    fn same_role_comparison_matches_partition_account_and_role() {
+        assert!(same_role_arns(
+            "arn:aws:iam::123456789012:role/path/demo",
+            "arn:aws:sts::123456789012:assumed-role/demo/session"
+        ));
+        assert!(!same_role_arns(
+            "arn:aws:iam::123456789012:role/demo",
+            "arn:aws:iam::999999999999:role/demo"
+        ));
+        assert!(!same_role_arns(
+            "arn:aws:iam::123456789012:role/demo",
+            "arn:aws-cn:iam::123456789012:role/demo"
+        ));
+        assert!(!same_role_arns(
+            "arn:aws:iam::123456789012:user/demo",
+            "arn:aws:iam::123456789012:role/demo"
+        ));
+    }
+
+    #[test]
+    fn signing_matches_botocore_golden_vector() {
+        let (url, body, headers) = parity_inputs();
+        let credentials = Credentials::new(
+            "AKIDEXAMPLE",
+            "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY",
+            Some("session-token".to_string()),
+            None,
+            "test",
+        );
+        let signed = sign_bedrock_post(
+            &url,
+            &body,
+            &headers,
+            "us-east-1",
+            &credentials,
+            UNIX_EPOCH + std::time::Duration::from_secs(1_704_164_645),
+        )
+        .expect("golden signature");
+        assert_eq!(
+            signed.get("X-Amz-Date").map(String::as_str),
+            Some("20240102T030405Z")
+        );
+        assert_eq!(
+            signed.get("X-Amz-Security-Token").map(String::as_str),
+            Some("session-token")
+        );
+        assert_eq!(
+            signed.get("Authorization").map(String::as_str),
+            Some(
+                "AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20240102/us-east-1/bedrock/aws4_request, SignedHeaders=content-type;host;x-amz-date;x-amz-security-token, Signature=55c027ef47527d3ad63f1735f9d099efdbc99f296ff914bd94e727e24ec0e464"
+            )
+        );
+    }
+
+    #[test]
+    fn signing_without_session_token_omits_security_header() {
+        let (url, body, headers) = parity_inputs();
+        let credentials = Credentials::new(
+            "AKIDEXAMPLE",
+            "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY",
+            None,
+            None,
+            "test",
+        );
+        let signed = sign_bedrock_post(
+            &url,
+            &body,
+            &headers,
+            "us-east-1",
+            &credentials,
+            UNIX_EPOCH + std::time::Duration::from_secs(1_704_164_645),
+        )
+        .expect("signature");
+        assert!(!signed.contains_key("X-Amz-Security-Token"));
+    }
+
+    #[ignore]
+    #[tokio::test]
+    async fn live_bedrock_invoke_model_returns_200() -> Result<(), Box<dyn std::error::Error>> {
+        let access_key_id = std::env::var("AWS_BEDROCK_TEST_ACCESS_KEY_ID")?;
+        let secret_access_key = std::env::var("AWS_BEDROCK_TEST_SECRET_ACCESS_KEY")?;
+        let body = br#"{"anthropic_version":"bedrock-2023-05-31","max_tokens":1,"messages":[{"role":"user","content":[{"type":"text","text":"ping"}]}]}"#.to_vec();
+        let headers =
+            BTreeMap::from([("Content-Type".to_string(), "application/json".to_string())]);
+        let credentials = resolve_credentials(
+            AwsAuthConfig {
+                access_key_id: Some(access_key_id),
+                secret_access_key: Some(secret_access_key),
+                region_name: Some("us-west-2".to_string()),
+                ..Default::default()
+            },
+            &no_env,
+        )
+        .await?;
+        let client = reqwest::Client::new();
+        let mut failures = Vec::new();
+
+        for region in ["us-west-2", "us-east-1"] {
+            let url = format!(
+                "https://bedrock-runtime.{region}.amazonaws.com/model/us.anthropic.claude-opus-4-8/invoke"
+            );
+            let signed_headers = sign_bedrock_post(
+                &url,
+                &body,
+                &headers,
+                region,
+                &credentials,
+                SystemTime::now(),
+            )?;
+            let mut request = client.post(&url).body(body.clone());
+            for (name, value) in &headers {
+                request = request.header(name, value);
+            }
+            for (name, value) in signed_headers {
+                request = request.header(name, value);
+            }
+            let response = request.send().await?;
+            let status = response.status();
+            let response_body = response.text().await?;
+            let snippet: String = response_body.chars().take(240).collect();
+            println!("region={region} status={status} response={snippet}");
+            if status == reqwest::StatusCode::OK {
+                return Ok(());
+            }
+            failures.push(format!("{region}: {status} {snippet}"));
+        }
+
+        panic!(
+            "no Bedrock region returned HTTP 200: {}",
+            failures.join("; ")
+        );
+    }
+}
--- a/litellm-rust/crates/core/src/providers/bedrock/constants.rs
+++ b/litellm-rust/crates/core/src/providers/bedrock/constants.rs
@ -0,0 +1,18 @@
+pub const AWS_ACCESS_KEY_ID: &str = "AWS_ACCESS_KEY_ID";
+pub const AWS_SECRET_ACCESS_KEY: &str = "AWS_SECRET_ACCESS_KEY";
+pub const AWS_SESSION_TOKEN: &str = "AWS_SESSION_TOKEN";
+pub const AWS_REGION_NAME: &str = "AWS_REGION_NAME";
+pub const AWS_REGION: &str = "AWS_REGION";
+pub const AWS_SESSION_NAME: &str = "AWS_SESSION_NAME";
+pub const AWS_PROFILE_NAME: &str = "AWS_PROFILE_NAME";
+pub const AWS_ROLE_NAME: &str = "AWS_ROLE_NAME";
+pub const AWS_WEB_IDENTITY_TOKEN: &str = "AWS_WEB_IDENTITY_TOKEN";
+pub const AWS_ROLE_ARN: &str = "AWS_ROLE_ARN";
+pub const AWS_WEB_IDENTITY_TOKEN_FILE: &str = "AWS_WEB_IDENTITY_TOKEN_FILE";
+pub const AWS_STS_ENDPOINT: &str = "AWS_STS_ENDPOINT";
+pub const AWS_EXTERNAL_ID: &str = "AWS_EXTERNAL_ID";
+pub const BEDROCK_SERVICE: &str = "bedrock";
+pub const DEFAULT_SESSION_NAME_PREFIX: &str = "litellm-session";
+pub const DEFAULT_BEDROCK_REGION: &str = "us-west-2";
+pub const BEDROCK_RUNTIME_ENDPOINT_TEMPLATE: &str =
+    "https://bedrock-runtime.{region}.amazonaws.com";
--- a/litellm-rust/crates/core/src/providers/bedrock/mod.rs
+++ b/litellm-rust/crates/core/src/providers/bedrock/mod.rs
@ -0,0 +1,8 @@
+//! User-directed exception: this base provider owns AWS auth I/O for parity
+//! with Python's `BaseAWSLLM`; the broader core purity guidance is reconciled
+//! separately.
+
+#[cfg(feature = "bedrock-auth")]
+pub mod audio_transcription;
+pub mod aws_base;
+mod constants;
--- a/litellm-rust/crates/core/src/providers/mistral/ocr/transformation.rs
+++ b/litellm-rust/crates/core/src/providers/mistral/ocr/transformation.rs
@ -1,4 +1,4 @@
-use crate::error::{json_type_name, CoreError, CoreResult};
+use crate::error::{CoreError, CoreResult, json_type_name};
 use crate::ocr::transformation::OcrProviderConfig;
 use crate::ocr::types::{OcrRequestData, OcrResponseData};
 use serde_json::{Map, Value};
--- a/litellm-rust/crates/core/src/providers/mod.rs
+++ b/litellm-rust/crates/core/src/providers/mod.rs
@ -1,5 +1,7 @@
 pub mod anthropic;
 pub mod azure_ai;
+#[cfg(feature = "bedrock-auth")]
+pub mod bedrock;
 pub mod mistral;
 pub mod openai;
 pub mod reducto;
--- a/litellm-rust/crates/core/src/providers/openai/realtime/transformation.rs
+++ b/litellm-rust/crates/core/src/providers/openai/realtime/transformation.rs
@ -1,6 +1,6 @@
+use crate::CoreResult;
 use crate::realtime::transformation::RealtimeProviderConfig;
 use crate::realtime::types::{RealtimeEvent, RealtimeTransformResult};
-use crate::CoreResult;

 /// Default OpenAI API base, used when the caller does not override `api_base`.
 pub const OPENAI_REALTIME_DEFAULT_API_BASE: &str = "https://api.openai.com";
--- a/litellm-rust/crates/core/src/providers/openai/responses/transformation.rs
+++ b/litellm-rust/crates/core/src/providers/openai/responses/transformation.rs
@ -1,6 +1,6 @@
-use crate::responses::types::{ResponsesWsEvent, ResponsesWsTransformResult};
-use crate::responses::websocket::{enforce_model, ResponsesWebSocketProviderConfig};
 use crate::CoreResult;
+use crate::responses::types::{ResponsesWsEvent, ResponsesWsTransformResult};
+use crate::responses::websocket::{ResponsesWebSocketProviderConfig, enforce_model};

 pub struct OpenAIResponsesWsConfig;

--- a/litellm-rust/crates/core/src/providers/reducto/ocr/transformation.rs
+++ b/litellm-rust/crates/core/src/providers/reducto/ocr/transformation.rs
@ -1,9 +1,9 @@
 use std::collections::BTreeMap;

-use crate::error::{json_type_name, CoreError, CoreResult};
+use crate::error::{CoreError, CoreResult, json_type_name};
 use crate::ocr::transformation::{OcrDocumentPreparation, OcrProviderConfig};
 use crate::ocr::types::{OcrRequestData, OcrResponseData};
-use serde_json::{json, Map, Value};
+use serde_json::{Map, Value, json};

 const REDUCTO_API_BASE: &str = "https://platform.reducto.ai";
 const REDUCTO_API_KEY_ENV: &str = "REDUCTO_API_KEY";
--- a/litellm-rust/crates/core/src/providers/vertex_ai/ocr/transformation.rs
+++ b/litellm-rust/crates/core/src/providers/vertex_ai/ocr/transformation.rs
@ -1,10 +1,10 @@
 use crate::constants::{
    BEARER_SCHEME, GOOGLE_API_KEY_PREFIX, VERTEX_GLOBAL_API_BASE, VERTEX_GLOBAL_LOCATION,
 };
-use crate::error::{json_type_name, CoreError, CoreResult};
+use crate::error::{CoreError, CoreResult, json_type_name};
 use crate::ocr::transformation::{OcrAuth, OcrProviderConfig};
 use crate::ocr::types::{OcrRequestData, OcrResponseData};
-use serde_json::{json, Map, Value};
+use serde_json::{Map, Value, json};

 use crate::providers::mistral::ocr::transformation::MISTRAL_OCR_CONFIG;

@ -207,7 +207,7 @@ fn document_content_item(document: &Value) -> CoreResult<Value> {
        other => {
            return Err(CoreError::InvalidRequest(format!(
                "Unsupported document type: {other}. Expected 'image_url' or 'document_url'"
-            )))
+            )));
        }
    };
    let url = object
--- a/litellm-rust/crates/core/src/realtime/transformation.rs
+++ b/litellm-rust/crates/core/src/realtime/transformation.rs
@ -1,5 +1,5 @@
-use crate::realtime::types::{RealtimeEvent, RealtimeTransformResult};
 use crate::CoreResult;
+use crate::realtime::types::{RealtimeEvent, RealtimeTransformResult};

 pub trait RealtimeProviderConfig {
    /// Build the upstream WebSocket URL (e.g. `wss://api.openai.com/v1/realtime?model=…`).
--- a/litellm-rust/crates/core/src/responses/websocket.rs
+++ b/litellm-rust/crates/core/src/responses/websocket.rs
@ -1,6 +1,6 @@
+use crate::CoreResult;
 use crate::constants::{OPENAI_RESPONSES_DEFAULT_API_BASE, OPENAI_RESPONSES_PATH};
 use crate::responses::types::{ResponsesWsEvent, ResponsesWsEventType, ResponsesWsTransformResult};
-use crate::CoreResult;

 pub trait ResponsesWebSocketProviderConfig: Sync {
    fn supports_native_websocket(&self) -> bool {
--- a/litellm-rust/crates/python-bridge/CLAUDE.md
+++ b/litellm-rust/crates/python-bridge/CLAUDE.md
@ -17,7 +17,13 @@ Python-compatible dictionaries.
 - Provider dispatch belongs in Rust route modules such as
  `litellm_providers::ocr`, not in this PyO3 crate.
 - Python owns rollout state and fallback. Rust should return errors; Python
-  decides whether to raise or fall back.
+  decides whether to raise or fall back. For a rust-only provider/route (no
+  Python reference), the Python side is a thin dispatch that calls Rust and
+  raises when the bridge is unavailable, with no fallback.
+- Keep the Python interface minimal (well under 100 lines per route): it only
+  marshals inputs and calls Rust. Do not add per-route feature flags, and do
+  not put provider dispatch in `litellm/main.py`; it lives in a thin dispatch
+  class under `litellm/llms/<provider>/<route>/`.

 ## Data Handling

--- a/litellm-rust/crates/python-bridge/Cargo.toml
+++ b/litellm-rust/crates/python-bridge/Cargo.toml
@ -11,7 +11,7 @@ name = "_native"
 crate-type = ["cdylib"]

 [dependencies]
-litellm-core.workspace = true
+litellm-core = { workspace = true, features = ["bedrock-auth"] }
 litellm-ai-gateway = { workspace = true, default-features = false }
 pyo3 = { workspace = true, features = ["extension-module"] }
 pyo3-async-runtimes.workspace = true
--- a/litellm-rust/crates/python-bridge/src/lib.rs
+++ b/litellm-rust/crates/python-bridge/src/lib.rs
@ -1,8 +1,11 @@
 use std::collections::HashMap;
 use std::time::Duration;

-use litellm_ai_gateway::io::messages::{messages as run_messages, MessagesRequest};
-use litellm_ai_gateway::io::ocr::{ocr as run_ocr, OcrRequest};
+use litellm_ai_gateway::io::audio_transcription::{
+    AudioTranscriptionRequest, audio_transcription as run_audio_transcription,
+};
+use litellm_ai_gateway::io::messages::{MessagesRequest, messages as run_messages};
+use litellm_ai_gateway::io::ocr::{OcrRequest, ocr as run_ocr};
 use litellm_ai_gateway::io::responses_ws::ResponsesWebSocketConnection as RustResponsesWebSocketConnection;
 use litellm_core::error::CoreError;
 use pyo3::exceptions::{PyRuntimeError, PyValueError};
@ -262,6 +265,93 @@ fn aocr(
    })
 }

+#[pyfunction]
+#[pyo3(signature = (model, audio, api_key=None, api_base=None, custom_llm_provider=None, extra_headers=None, optional_params=None, timeout_seconds=None))]
+#[allow(clippy::too_many_arguments)]
+fn transcription(
+    py: Python<'_>,
+    model: String,
+    audio: Py<PyAny>,
+    api_key: Option<String>,
+    api_base: Option<String>,
+    custom_llm_provider: Option<String>,
+    extra_headers: Option<Py<PyAny>>,
+    optional_params: Option<Py<PyAny>>,
+    timeout_seconds: Option<f64>,
+) -> PyResult<Py<PyAny>> {
+    let audio = py_to_json(py, audio.bind(py))?;
+    let extra_headers = match extra_headers {
+        Some(headers) => Some(optional_object_to_map(py, "extra_headers", Some(headers))?),
+        None => None,
+    };
+    let optional_params = optional_object_to_map(py, "optional_params", optional_params)?;
+    let timeout = optional_timeout(timeout_seconds);
+    let result = gil::release_gil(py, || {
+        pyo3_async_runtimes::tokio::get_runtime().block_on(run_audio_transcription(
+            AudioTranscriptionRequest {
+                model: &model,
+                audio,
+                api_key: api_key.as_deref(),
+                api_base: api_base.as_deref(),
+                custom_llm_provider: custom_llm_provider.as_deref(),
+                extra_headers,
+                optional_params,
+                timeout,
+                callbacks: Vec::new(),
+                guardrails: Vec::new(),
+                request_metadata: Default::default(),
+                litellm_call_id: None,
+            },
+        ))
+    });
+    match result {
+        Ok(value) => json_to_py(py, value),
+        Err(err) => Err(core_error_to_pyerr(err)),
+    }
+}
+
+#[pyfunction]
+#[pyo3(signature = (model, audio, api_key=None, api_base=None, custom_llm_provider=None, extra_headers=None, optional_params=None, timeout_seconds=None))]
+#[allow(clippy::too_many_arguments)]
+fn atranscription(
+    py: Python<'_>,
+    model: String,
+    audio: Py<PyAny>,
+    api_key: Option<String>,
+    api_base: Option<String>,
+    custom_llm_provider: Option<String>,
+    extra_headers: Option<Py<PyAny>>,
+    optional_params: Option<Py<PyAny>>,
+    timeout_seconds: Option<f64>,
+) -> PyResult<Bound<'_, PyAny>> {
+    let audio = py_to_json(py, audio.bind(py))?;
+    let extra_headers = match extra_headers {
+        Some(headers) => Some(optional_object_to_map(py, "extra_headers", Some(headers))?),
+        None => None,
+    };
+    let optional_params = optional_object_to_map(py, "optional_params", optional_params)?;
+    let timeout = optional_timeout(timeout_seconds);
+    pyo3_async_runtimes::tokio::future_into_py(py, async move {
+        let value = run_audio_transcription(AudioTranscriptionRequest {
+            model: &model,
+            audio,
+            api_key: api_key.as_deref(),
+            api_base: api_base.as_deref(),
+            custom_llm_provider: custom_llm_provider.as_deref(),
+            extra_headers,
+            optional_params,
+            timeout,
+            callbacks: Vec::new(),
+            guardrails: Vec::new(),
+            request_metadata: Default::default(),
+            litellm_call_id: None,
+        })
+        .await
+        .map_err(core_error_to_pyerr)?;
+        Python::attach(|py| json_to_py(py, value))
+    })
+}
+
 type MarshaledMessagesInputs = (Value, Option<Map<String, Value>>, Option<Duration>);

 fn marshal_messages_inputs(
@ -359,6 +449,8 @@ fn gil_stats(py: Python<'_>) -> PyResult<Py<PyAny>> {
 fn _native(module: &Bound<'_, PyModule>) -> PyResult<()> {
    module.add_function(wrap_pyfunction!(ocr, module)?)?;
    module.add_function(wrap_pyfunction!(aocr, module)?)?;
+    module.add_function(wrap_pyfunction!(transcription, module)?)?;
+    module.add_function(wrap_pyfunction!(atranscription, module)?)?;
    module.add_function(wrap_pyfunction!(messages, module)?)?;
    module.add_function(wrap_pyfunction!(amessages, module)?)?;
    module.add_class::<ResponsesWebSocketConnection>()?;
--- a/litellm/init.py
+++ b/litellm/init.py
@ -211,6 +211,9 @@ filter_invalid_headers: Optional[bool] = False
 add_user_information_to_llm_headers: Optional[bool] = (
    None  # adds user_id, team_id, token hash (params from StandardLoggingMetadata) to request headers
 )
+overwrite_user_with_key_hash: bool = (
+    False  # force the outgoing `user` param to the hashed api key, so providers see a stable, tamper-proof id
+)
 store_audit_logs = False  # Enterprise feature, allow users to see audit logs
 skip_system_message_in_guardrail: bool = False
 skip_tool_message_in_guardrail: bool = False
@ -427,7 +430,9 @@ default_team_settings: Optional[List] = None
 max_user_budget: Optional[float] = None
 default_max_internal_user_budget: Optional[float] = None
 max_internal_user_budget: Optional[float] = None
-max_ui_session_budget: Optional[float] = 0.25  # $0.25 USD budgets for UI Chat sessions
+max_ui_session_budget: Optional[float] = (
+    1.0  # USD budget for each dashboard login session (playground, test connection)
+)
 internal_user_budget_duration: Optional[str] = None
 tag_budget_config: Optional[Dict[str, "BudgetConfig"]] = None
 max_end_user_budget: Optional[float] = None
--- a/Show more
+++ b/Show more
				`@ -0,0 +1 @@`
				`pub use crate::audio_transcription::{AudioTranscriptionRequest, audio_transcription};`