From 7831d8a9915e9171cacdd18038d73070f706f1ef Mon Sep 17 00:00:00 2001
From: nate-berri <nate@berri.ai>
Date: Sat, 10 Oct 2026 12:08:56 -0700
Subject: [PATCH] refactor(types): move is_jwt into
 litellm.types.proxy.auth.user_api_key_auth (#45747)

* refactor(types): move LitellmUserRoles and KeyManagementRoutes into litellm.types.proxy.auth.user_roles

Part of LIT-9423

* refactor(types): move is_jwt into litellm.types.proxy.auth.user_api_key_auth

Part of LIT-9423

* refactor(auth): alias is_jwt import so JWTHandler.is_jwt is not read as recursive
---
 litellm/proxy/_types.py                       | 5 ++---
 litellm/proxy/auth/handle_jwt.py              | 6 ++----
 litellm/types/proxy/auth/user_api_key_auth.py | 8 ++++++++
 3 files changed, 12 insertions(+), 7 deletions(-)
 create mode 100644 litellm/types/proxy/auth/user_api_key_auth.py

diff --git a/litellm/proxy/_types.py b/litellm/proxy/_types.py
index f60f0ddce8d..23f92280513 100644
--- a/litellm/proxy/_types.py
+++ b/litellm/proxy/_types.py
@@ -67,6 +67,7 @@ from litellm.types.proxy.agent_identity import ManagedAgentContext
 from litellm.types.proxy.auth.special_headers import (
     SpecialHeaders as SpecialHeaders,  # noqa: PLC0414  # public re-export
 )
+from litellm.types.proxy.auth.user_api_key_auth import is_jwt
 from litellm.types.proxy.carried_budget_state import (
     OrgBudgetSnapshot,
     TeamBudgetSnapshot,
@@ -3482,9 +3483,7 @@ class UserAPIKeyAuth(LiteLLM_VerificationTokenView):  # the expected response ob
             normalized = normalized[7:]
         if normalized.startswith("sk-"):
             return hash_token(normalized)
-        from litellm.proxy.auth.handle_jwt import JWTHandler
-
-        if JWTHandler.is_jwt(token=normalized):
+        if is_jwt(token=normalized):
             return f"hashed-jwt-{hash_token(token=normalized)}"
         return normalized
 
diff --git a/litellm/proxy/auth/handle_jwt.py b/litellm/proxy/auth/handle_jwt.py
index a57eacdd133..3283a080c14 100644
--- a/litellm/proxy/auth/handle_jwt.py
+++ b/litellm/proxy/auth/handle_jwt.py
@@ -75,6 +75,7 @@ from litellm.repositories.user_repository import UserRepository
 from litellm.types.agents import AgentResponse
 from litellm.types.proxy.agent_identity import AgentIdentityFailure
 from litellm.types.proxy.auth.auth_checks import UserNotFoundError
+from litellm.types.proxy.auth.user_api_key_auth import is_jwt as is_jwt_token
 
 from .auth_checks import (
     TeamNotFoundError,
@@ -276,10 +277,7 @@ class JWTHandler:
 
     @staticmethod
     def is_jwt(token: str | None) -> bool:
-        if token is None:
-            return False
-        parts: Final = token.split(".")
-        return len(parts) == 3
+        return is_jwt_token(token=token)
 
     @staticmethod
     def get_unverified_claims(token: str) -> dict | None:
diff --git a/litellm/types/proxy/auth/user_api_key_auth.py b/litellm/types/proxy/auth/user_api_key_auth.py
new file mode 100644
index 00000000000..3d879fdcc43
--- /dev/null
+++ b/litellm/types/proxy/auth/user_api_key_auth.py
@@ -0,0 +1,8 @@
+from typing import Final
+
+
+def is_jwt(token: str | None) -> bool:
+    if token is None:
+        return False
+    parts: Final = token.split(".")
+    return len(parts) == 3