From 4091cc02777032efc1cc2977a6dc4a8ef160f278 Mon Sep 17 00:00:00 2001 From: Ishaan Jaffer Date: Mon, 26 Jan 2026 08:15:44 -0800 Subject: [PATCH] fix: get_cli_jwt_auth_token --- litellm/proxy/auth/auth_checks.py | 12 ++++++++---- litellm/proxy/client/cli/commands/auth.py | 6 ++++-- litellm/proxy/management_endpoints/ui_sso.py | 2 +- 3 files changed, 13 insertions(+), 7 deletions(-) diff --git a/litellm/proxy/auth/auth_checks.py b/litellm/proxy/auth/auth_checks.py index 5e0a211906e..61d9044f925 100644 --- a/litellm/proxy/auth/auth_checks.py +++ b/litellm/proxy/auth/auth_checks.py @@ -21,6 +21,8 @@ from litellm._logging import verbose_proxy_logger from litellm.caching.caching import DualCache from litellm.caching.dual_cache import LimitedSizeOrderedDict from litellm.constants import ( + CLI_JWT_EXPIRATION_HOURS, + CLI_JWT_TOKEN_NAME, DEFAULT_IN_MEMORY_TTL, DEFAULT_MANAGEMENT_OBJECT_IN_MEMORY_CACHE_TTL, DEFAULT_MAX_RECURSE_DEPTH, @@ -1602,7 +1604,10 @@ class ExperimentalUIJWTToken: user_info: LiteLLM_UserTable, team_id: Optional[str] = None ) -> str: """ - Generate a JWT token for CLI authentication with 24-hour expiration. + Generate a JWT token for CLI authentication with configurable expiration. + + The expiration time can be controlled via the LITELLM_CLI_JWT_EXPIRATION_HOURS + environment variable (defaults to 24 hours). Args: user_info: User information from the database @@ -1613,7 +1618,6 @@ class ExperimentalUIJWTToken: """ from datetime import timedelta - from litellm.constants import CLI_JWT_TOKEN_NAME from litellm.proxy.common_utils.encrypt_decrypt_utils import ( encrypt_value_helper, ) @@ -1621,8 +1625,8 @@ class ExperimentalUIJWTToken: if user_info.user_role is None: raise Exception("User role is required for CLI JWT login") - # Calculate expiration time (24 hours from now - matching old CLI key behavior) - expiration_time = get_utc_datetime() + timedelta(hours=24) + # Calculate expiration time (configurable via LITELLM_CLI_JWT_EXPIRATION_HOURS env var) + expiration_time = get_utc_datetime() + timedelta(hours=CLI_JWT_EXPIRATION_HOURS) # Format the expiration time as ISO 8601 string expires = expiration_time.strftime("%Y-%m-%dT%H:%M:%S.%f")[:-3] + "+00:00" diff --git a/litellm/proxy/client/cli/commands/auth.py b/litellm/proxy/client/cli/commands/auth.py index bdc8d56d1c3..2345b0263e3 100644 --- a/litellm/proxy/client/cli/commands/auth.py +++ b/litellm/proxy/client/cli/commands/auth.py @@ -11,6 +11,8 @@ import requests from rich.console import Console from rich.table import Table +from litellm.constants import CLI_JWT_EXPIRATION_HOURS + # Token storage utilities def get_token_file_path() -> str: @@ -592,8 +594,8 @@ def whoami(): age_hours = (time.time() - timestamp) / 3600 click.echo(f"Token age: {age_hours:.1f} hours") - if age_hours > 24: - click.echo("⚠️ Warning: Token is more than 24 hours old and may have expired.") + if age_hours > CLI_JWT_EXPIRATION_HOURS: + click.echo(f"⚠️ Warning: Token is more than {CLI_JWT_EXPIRATION_HOURS} hours old and may have expired.") # Export functions for use by other CLI commands diff --git a/litellm/proxy/management_endpoints/ui_sso.py b/litellm/proxy/management_endpoints/ui_sso.py index 5adf54c1627..613390c0ec1 100644 --- a/litellm/proxy/management_endpoints/ui_sso.py +++ b/litellm/proxy/management_endpoints/ui_sso.py @@ -1156,7 +1156,7 @@ async def cli_poll_key(key_id: str, team_id: Optional[str] = None): max_budget=litellm.max_ui_session_budget, ) - # Generate CLI JWT on-demand (24hr expiration) + # Generate CLI JWT on-demand (expiration configurable via LITELLM_CLI_JWT_EXPIRATION_HOURS) # Pass selected team_id to ensure JWT has correct team jwt_token = ExperimentalUIJWTToken.get_cli_jwt_auth_token( user_info=user_info, team_id=team_id