diff --git a/litellm/integrations/otel/model/metadata.py b/litellm/integrations/otel/model/metadata.py
index 4f76ebc56d2..71a0f6e938f 100644
--- a/litellm/integrations/otel/model/metadata.py
+++ b/litellm/integrations/otel/model/metadata.py
@@ -152,12 +152,7 @@ class RequestIdentity:
             )
             if (value := get(attr))
         )
-        raw_key_meta: Final = as_str_mapping(get("metadata") or get("user_api_key_auth_metadata"))
-        key_meta: Final = (
-            tuple(flatten_metadata({"user_api_key_auth_metadata": raw_key_meta}))
-            if raw_key_meta is not None
-            else ()
-        )
+        key_meta: Final = flatten_metadata({"user_api_key_auth_metadata": get("metadata")})
         request_meta: Final = flatten_metadata(request_metadata) if request_metadata is not None else ()
         metadata: Final = MappingProxyType(dict((*request_meta, *auth_meta, *key_meta)))
         return cls(
diff --git a/tests/unit/integrations/otel/test_otel_v2_sources_of_truth.py b/tests/unit/integrations/otel/test_otel_v2_sources_of_truth.py
index 4ac00ef889a..b3703cf0770 100644
--- a/tests/unit/integrations/otel/test_otel_v2_sources_of_truth.py
+++ b/tests/unit/integrations/otel/test_otel_v2_sources_of_truth.py
@@ -1607,16 +1607,30 @@ def test_request_identity_from_user_api_key_auth():
     assert ident.metadata["user_api_key_end_user_id"] == "eu9"
 
 
-def test_request_identity_from_user_api_key_auth_flattens_key_metadata():
+def test_virtual_key_metadata_reaches_baggage_only_for_allowlisted_sub_keys():
+    from litellm.integrations.otel.model.baggage import DEFAULT_BAGGAGE_METADATA_KEYS, promoted_baggage
     from litellm.integrations.otel.model.payloads import RequestIdentity
+    from litellm.proxy._types import UserAPIKeyAuth
 
-    class _Auth:
-        metadata = {"team": "a", "customtag": "b", "nested": {"k": "v"}}
+    auth: Final = UserAPIKeyAuth(
+        key_alias="cost-key",
+        metadata={"team": "a", "cost": {"center": "cc-42"}, "owner": "not-allowlisted"},
+    )
+    identity: Final = RequestIdentity.from_user_api_key_auth(auth)
 
-    ident = RequestIdentity.from_user_api_key_auth(_Auth())
-    assert ident.metadata["user_api_key_auth_metadata.team"] == "a"
-    assert ident.metadata["user_api_key_auth_metadata.customtag"] == "b"
-    assert ident.metadata["user_api_key_auth_metadata.nested.k"] == "v"
+    allowlisted: Final = promoted_baggage(
+        identity,
+        None,
+        promoted_keys=(),
+        metadata_keys=("user_api_key_auth_metadata.team", "user_api_key_auth_metadata.cost.center"),
+    )
+    default: Final = promoted_baggage(identity, None, promoted_keys=(), metadata_keys=DEFAULT_BAGGAGE_METADATA_KEYS)
+
+    assert allowlisted == {
+        "litellm.metadata.user_api_key_auth_metadata.team": "a",
+        "litellm.metadata.user_api_key_auth_metadata.cost.center": "cc-42",
+    }
+    assert default == {"litellm.metadata.user_api_key_alias": "cost-key"}
 
 
 # --- request-metadata translation layer (RequestContext) -------------------- #