scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-09-13 23:11:40 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 152

feat(ai-gateway): thread route through KeyAuthenticator + plain-English auth/client docs

Browse source
This commit is contained in:
Ishaan Jaff 2026-06-24 12:46:22 -07:00
parent 391dd3321c
commit a5203ed000
No known key found for this signature in database
1 changed files with 14 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
litellm-rust/crates/ai-gateway/src/auth/client/mod.rs
View file

@ -1,4 +1,13 @@
//! The auth **swap seam**.
//! `auth/client` — turn a raw API key into an authenticated identity.
//!
//! When a request presents a virtual key, the gateway needs to know two things:
//! is the key valid, and who does it belong to. This module is the backend that
//! answers that — given a key string, it returns a [`UserApiKeyAuth`] or rejects
//! it. In v0 the answer comes from the Python control plane over HTTP
//! ([`python::PythonAuthClient`]); the [`KeyAuthenticator`] trait lets that be
//! swapped for a native Rust implementation later without touching callers.
//!
//! ## The swap seam
//!
//! [`KeyAuthenticator`] is the single trait the extractor depends on. v0 ships
//! [`python::PythonAuthClient`], which delegates verification to the Python proxy
@ -24,5 +33,8 @@ pub enum AuthError {
/// backends implement; see the module docs for the swap rationale.
#[axum::async_trait]
pub trait KeyAuthenticator: Send + Sync {
async fn verify(&self, key: &str) -> Result<UserApiKeyAuth, AuthError>;
/// Resolve `key` for the given `route` (the gateway's own request path, e.g.
/// `/v1/realtime`). The route is forwarded so route/model restrictions on the
/// key are evaluated against the route it's actually being used on.
async fn verify(&self, key: &str, route: &str) -> Result<UserApiKeyAuth, AuthError>;
}