From 4bb6fc8f2311a05737839b20920bba75e494fa2b Mon Sep 17 00:00:00 2001
From: wangjifeng <wangjifeng@kkworld.com>
Date: Fri, 24 Apr 2026 20:35:01 +0800
Subject: [PATCH] fix(proxy): downgrade 401/403 auth denials from ERROR to
 WARNING in auth_exception_handler
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Expected permission denials (wrong key, insufficient model access, budget
exceeded) were logged at ERROR level with a full traceback, flooding error
logs with routine access-control events and making real service errors hard
to spot.

Distinguish expected auth failures (HTTP 401/403) from unexpected exceptions:
- ProxyException/HTTPException with code 401 or 403 → logger.warning, no traceback
- All other exceptions → logger.exception (ERROR + traceback, unchanged)

Fixes #26424
---
 litellm/proxy/auth/auth_exception_handler.py | 30 ++++++++++++++++----
 1 file changed, 24 insertions(+), 6 deletions(-)

diff --git a/litellm/proxy/auth/auth_exception_handler.py b/litellm/proxy/auth/auth_exception_handler.py
index 9c306acd2c6..5bb67c22d11 100644
--- a/litellm/proxy/auth/auth_exception_handler.py
+++ b/litellm/proxy/auth/auth_exception_handler.py
@@ -75,13 +75,31 @@ class UserAPIKeyAuthExceptionHandler:
                 request=request,
                 use_x_forwarded_for=general_settings.get("use_x_forwarded_for", False),
             )
-            verbose_proxy_logger.exception(
-                "litellm.proxy.proxy_server.user_api_key_auth(): Exception occured - {}\nRequester IP Address:{}".format(
-                    str(e),
-                    requester_ip,
-                ),
-                extra={"requester_ip": requester_ip},
+            # 401/403 are expected auth denials (wrong key, insufficient permissions,
+            # budget exceeded, etc.) — log at WARNING without traceback to avoid
+            # flooding error logs with routine access-control events.
+            # All other exceptions are unexpected and logged at ERROR with traceback.
+            _is_expected_auth_failure = (
+                isinstance(e, ProxyException) and e.code in (401, 403)
+            ) or (
+                isinstance(e, HTTPException) and e.status_code in (401, 403)
             )
+            if _is_expected_auth_failure:
+                verbose_proxy_logger.warning(
+                    "litellm.proxy.proxy_server.user_api_key_auth(): Auth denied - {}\nRequester IP Address:{}".format(
+                        str(e),
+                        requester_ip,
+                    ),
+                    extra={"requester_ip": requester_ip},
+                )
+            else:
+                verbose_proxy_logger.exception(
+                    "litellm.proxy.proxy_server.user_api_key_auth(): Exception occured - {}\nRequester IP Address:{}".format(
+                        str(e),
+                        requester_ip,
+                    ),
+                    extra={"requester_ip": requester_ip},
+                )
 
             # Log this exception to OTEL, Datadog etc
             user_api_key_dict = UserAPIKeyAuth(