From ca84e7a8e8bc417ae4044a48b5c495a20c8e955a Mon Sep 17 00:00:00 2001
From: Krrish Dholakia <krrishdholakia@gmail.com>
Date: Tue, 26 Mar 2024 21:33:03 -0700
Subject: [PATCH] docs(token_auth.md): update jwt auth docs with new info

---
 docs/my-website/docs/proxy/token_auth.md | 99 +++++++++++++++++++-----
 litellm/proxy/_types.py                  |  1 +
 2 files changed, 79 insertions(+), 21 deletions(-)

diff --git a/docs/my-website/docs/proxy/token_auth.md b/docs/my-website/docs/proxy/token_auth.md
index 0fbce04db36..c3a0019c0f8 100644
--- a/docs/my-website/docs/proxy/token_auth.md
+++ b/docs/my-website/docs/proxy/token_auth.md
@@ -96,19 +96,6 @@ curl --location 'http://0.0.0.0:4000/v1/chat/completions' \
 </TabItem>
 </Tabs>
 
-## Advanced - Allowed Routes 
-
-Configure which routes a non-admin JWT can access via the config.
-
-By default, a non-admin JWT can call openai + any `/info` endpoints. 
-
-```yaml
-general_settings:
-  master_key: sk-1234
-  enable_jwt_auth: True
-  allowed_routes: ["/chat/completions", "/embeddings"]
-```
-
 ## Advanced - Set Accepted JWT Scope Names 
 
 Change the string in JWT 'scopes', that litellm evaluates to see if a user has admin access.
@@ -117,18 +104,61 @@ Change the string in JWT 'scopes', that litellm evaluates to see if a user has a
 general_settings:
   master_key: sk-1234
   enable_jwt_auth: True
-  litellm_proxy_roles:
-    proxy_admin: "litellm-proxy-admin"
+  litellm_jwtauth:
+    admin_jwt_scope: "litellm-proxy-admin"
 ```
 
-### Allowed LiteLLM scopes
+## Advanced - Allowed Routes 
 
-```python
-class LiteLLM_JWTAuth(LiteLLMBase):
-    proxy_admin: str = "litellm_proxy_admin"
-    proxy_user: str = "litellm_user" # 👈 Not implemented yet, for JWT-Auth.
+Configure which routes a JWT can access via the config.
+
+By default: 
+
+- Admins: can access only management routes (`/team/*`, `/key/*`, `/user/*`)
+- Teams: can access only openai routes (`/chat/completions`, etc.)+ info routes (`/*/info`)
+
+[**See Code**](https://github.com/BerriAI/litellm/blob/b204f0c01c703317d812a1553363ab0cb989d5b6/litellm/proxy/_types.py#L95)
+
+**Admin Routes**
+```yaml
+general_settings:
+  master_key: sk-1234
+  enable_jwt_auth: True
+  litellm_jwtauth:
+    admin_jwt_scope: "litellm-proxy-admin"
+    admin_allowed_routes: ["/v1/embeddings"]
 ```
 
+**Team Routes**
+```yaml
+general_settings:
+  master_key: sk-1234
+  enable_jwt_auth: True
+  litellm_jwtauth:
+    ...
+    team_jwt_scope: "litellm-team" # 👈 Set JWT Scope string
+    team_allowed_routes: ["/v1/chat/completions"] # 👈 Set accepted routes
+```
+
+## Advanced - Caching Public Keys 
+
+Control how long public keys are cached for (in seconds).
+
+```yaml
+general_settings:
+  master_key: sk-1234
+  enable_jwt_auth: True
+  litellm_jwtauth:
+    admin_jwt_scope: "litellm-proxy-admin"
+    admin_allowed_routes: ["/v1/embeddings"]
+    public_key_ttl: 600 # 👈 KEY CHANGE
+```
+
+### All Params
+
+[**See Code**](https://github.com/BerriAI/litellm/blob/b204f0c01c703317d812a1553363ab0cb989d5b6/litellm/proxy/_types.py#L95)
+
+
 ### JWT Scopes
 
 Here's what scopes on JWT-Auth tokens look like
@@ -141,4 +171,31 @@ scope: ["litellm-proxy-admin",...]
 **Can be a space-separated string**
 ```
 scope: "litellm-proxy-admin ..."
-```
\ No newline at end of file
+```
+
+## Advanced - Block Teams 
+
+To block all requests for a certain team id, use `/team/block`
+
+**Block Team**
+
+```bash
+curl --location 'http://0.0.0.0:4000/team/block' \
+--header 'Authorization: Bearer <admin-token>' \
+--header 'Content-Type: application/json' \
+--data '{
+    "team_id": "litellm-test-client-id-new" # 👈 set team id
+}'
+```
+
+**Unblock Team**
+
+```bash
+curl --location 'http://0.0.0.0:4000/team/unblock' \
+--header 'Authorization: Bearer <admin-token>' \
+--header 'Content-Type: application/json' \
+--data '{
+    "team_id": "litellm-test-client-id-new" # 👈 set team id
+}'
+```
+
diff --git a/litellm/proxy/_types.py b/litellm/proxy/_types.py
index 2cd979b4b80..9704a2f1994 100644
--- a/litellm/proxy/_types.py
+++ b/litellm/proxy/_types.py
@@ -103,6 +103,7 @@ class LiteLLM_JWTAuth(LiteLLMBase):
     - team_id_jwt_field: The field in the JWT token that stores the team ID. Default - `client_id`.
     - team_allowed_routes: list of allowed routes for proxy team roles.
     - end_user_id_jwt_field: Default - `sub`. The field in the JWT token that stores the end-user ID. Turn this off by setting to `None`. Enables end-user cost tracking.
+    - public_key_ttl: Default - 600s. TTL for caching public JWT keys.
 
     See `auth_checks.py` for the specific routes
     """