diff --git a/litellm/integrations/langfuse/langfuse_otel.py b/litellm/integrations/langfuse/langfuse_otel.py index 3cb3478eb03..477d64b8e72 100644 --- a/litellm/integrations/langfuse/langfuse_otel.py +++ b/litellm/integrations/langfuse/langfuse_otel.py @@ -318,13 +318,6 @@ class LangfuseOtelLogger(OpenTelemetry): @staticmethod def get_langfuse_otel_endpoint(langfuse_host: str | None) -> str: - """ - The Langfuse OTLP endpoint for langfuse_host, or the US cloud endpoint when - no host is given. - - Shared by the env-resolved config and by per-key/team routing so the two can - never derive a different endpoint from the same host. - """ if not langfuse_host: verbose_logger.debug("Using Langfuse US cloud endpoint: %s", LANGFUSE_CLOUD_US_ENDPOINT) return LANGFUSE_CLOUD_US_ENDPOINT diff --git a/litellm/integrations/otel/plumbing/routing.py b/litellm/integrations/otel/plumbing/routing.py index 41d13b4bff7..e1cbc82719a 100644 --- a/litellm/integrations/otel/plumbing/routing.py +++ b/litellm/integrations/otel/plumbing/routing.py @@ -236,9 +236,8 @@ class TenantTracerCache: service_name: Final = tenant_service_name(auth_metadata) if not credential_headers and not project_headers and service_name is None: return TenantRoute(tracer=default, detached=False) - # A fixed per-integration region endpoint (New Relic us/eu), or the host - # the key or team was configured with, which its own credentials come - # with; never a host off the request. ``None`` keeps the preset's endpoint. + # A fixed per-integration region endpoint (New Relic us/eu) or the host the + # key or team was configured with; ``None`` keeps the preset's endpoint. endpoint: Final = dynamic_otlp_endpoint(self._callback_name, dynamic_params) cache_key: Final = ( tuple(sorted(credential_headers.items())), diff --git a/litellm/integrations/otel/presets/__init__.py b/litellm/integrations/otel/presets/__init__.py index dbd66d890e4..d5cc6c96635 100644 --- a/litellm/integrations/otel/presets/__init__.py +++ b/litellm/integrations/otel/presets/__init__.py @@ -65,12 +65,9 @@ DYNAMIC_HEADERS_BY_CALLBACK: Final[Mapping[str, Callable[[StandardCallbackDynami ) #: Callback name → per-request OTLP endpoint resolver. Only integrations whose -#: destination host varies per tenant appear here; for everyone else the preset's -#: endpoint is authoritative. Two shapes exist: newrelic picks from a fixed region -#: table, and langfuse_otel reads the host the key or team was configured with, -#: which the proxy resolved at auth. Neither takes a URL straight off the request: -#: a client-supplied langfuse_host is rejected unless an admin opts in with -#: general_settings.allow_client_side_credentials. +#: destination host varies per tenant appear here (newrelic's region table, the +#: Langfuse host a key or team was configured with); for everyone else the +#: preset's endpoint is authoritative. DYNAMIC_ENDPOINT_BY_CALLBACK: Final[Mapping[str, Callable[[StandardCallbackDynamicParams], str | None]]] = ( MappingProxyType( { diff --git a/litellm/integrations/otel/presets/langfuse.py b/litellm/integrations/otel/presets/langfuse.py index 043853769fe..de9be282c42 100644 --- a/litellm/integrations/otel/presets/langfuse.py +++ b/litellm/integrations/otel/presets/langfuse.py @@ -49,18 +49,8 @@ def langfuse_dynamic_headers(params: StandardCallbackDynamicParams) -> dict[str, def langfuse_dynamic_endpoint(params: StandardCallbackDynamicParams) -> str | None: - """Per-request Langfuse OTLP endpoint when the key or team pins its own host. - - ``None`` means the request does not move the destination, so the preset's - env-resolved endpoint stands (V1 parity: ``construct_dynamic_otel_config`` - falls back to the env host when the dynamic params carry no ``langfuse_host``). - - A host only counts alongside the key pair it belongs to, which is the same - precondition ``langfuse_dynamic_headers`` applies and the same one V1 applies. - A host on its own would move the endpoint while the headers builder returned - nothing, so the exporter would keep the operator's env-derived Authorization - header and post it to the caller's host. - """ + """A host moves the destination only with its own key pair, so the exporter never + posts the operator's env-derived Authorization header to a tenant's host.""" host: Final = params.get("langfuse_host") if not host or not params.get("langfuse_public_key") or not params.get("langfuse_secret_key"): return None