scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-09-13 23:11:40 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 152

docs(proxy): document JWT routing_overrides scope and wildcard semantics

Browse source 
Align token_auth and oauth2 docs with scope selector, case-sensitive
wildcards, and scope-only space-delimited claim handling.

Made-with: Cursor
This commit is contained in:
Milan 2026-04-17 16:57:15 +03:00
parent e5a3e9c51c
commit c62721c512
No known key found for this signature in database
2 changed files with 23 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
docs/my-website/docs/proxy/oauth2.md
View file

@ -83,5 +83,7 @@ general_settings:
path: "oauth2"
```
For full `routing_overrides` behavior and list-based selectors, see [`/proxy/token_auth`](./token_auth.md#route-jwt-shaped-machine-tokens-to-oauth2).
Overrides may also include optional `scope` and shell-style wildcards (`*`, `?`) on selectors; wildcard matching is case-sensitive, and space-delimited `scope` strings are handled as documented there.
For full `routing_overrides` behavior, wildcards, `scope`, and list-based selectors, see [`/proxy/token_auth`](./token_auth.md#route-jwt-shaped-machine-tokens-to-oauth2).

24
docs/my-website/docs/proxy/token_auth.md
View file

@ -814,10 +814,26 @@ general_settings:
### Matching behavior
- A rule matches when all configured selectors match token claims
- Supported selectors: `iss` (required), `client_id` (optional), `aud` (optional)
- Selector values support both string and list forms
- If no rule matches, LiteLLM continues with standard JWT validation
- A rule matches when **all** configured selectors match the corresponding token claims (AND semantics).
- Supported selectors: `iss` (required), `client_id` (optional), `scope` (optional), `aud` (optional).
- Selector values can be a single string or a list of strings (the claim must match at least one entry, using the rules below).
- **Wildcards:** selectors may use shell-style `*` and `?`. Matching is **case-sensitive**—use the same casing your IdP emits in JWT claims.
- **`scope` claim as a space-delimited string:** OAuth/OIDC often sends `scope` as one string (e.g. `openid profile App:LiteLLM`). LiteLLM splits that string **only when matching the `scope` selector**, so a configured value like `App:LiteLLM` can match. **`iss`, `aud`, and `client_id` are never split on spaces**; the full claim string is used (routing uses unverified claims only for path selection; final auth still validates the token).
- If no rule matches, LiteLLM continues with standard JWT validation.
### Example: `scope` and wildcard `client_id`
```yaml title="config.yaml"
general_settings:
enable_jwt_auth: true
enable_oauth2_auth: false
litellm_jwtauth:
routing_overrides:
- iss: "machine-issuer.example.com"
scope: "App:LiteLLM"
client_id: "*MID_LITELLM"
path: "oauth2"
```
### List-based override example