diff --git a/docs/my-website/docs/proxy/config_settings.md b/docs/my-website/docs/proxy/config_settings.md index 33b6006ac2c..cc9c9de58f5 100644 --- a/docs/my-website/docs/proxy/config_settings.md +++ b/docs/my-website/docs/proxy/config_settings.md @@ -307,7 +307,6 @@ router_settings: | token_rate_limit_type | string | Rate limit counting method: "total", "output", or "input" tokens | | use_redis_transaction_buffer | boolean | If true, buffers database transactions in Redis before writing | | use_shared_health_check | boolean | If true, uses Redis-backed shared health check state across multiple proxy instances | -| enable_redis_auth_cache | boolean | **[Beta]** When `true`, attaches Redis to the virtual-key auth cache (`user_api_key_cache`) so all proxy workers/pods share the same cache instead of each pod resolving keys independently against the database. Requires `litellm_settings.cache: true` with a Redis backend. Significantly reduces database load in multi-worker deployments by eliminating per-pod cache misses on the `combined_view` query. Off by default for a safe phased rollout — enable once your Redis cluster is healthy. Will become the default in a future release. See [Redis Auth Cache](#redis-auth-cache-multi-worker-db-load-reduction). | | user_header_mappings | dict | Map custom request headers to user IDs using lookup rules | | user_header_name | string | HTTP header name to extract user identity from requests | @@ -323,21 +322,22 @@ In multi-worker or multi-pod deployments each worker process keeps its own **in- ### Solution -Setting `enable_redis_auth_cache: true` attaches Redis to `user_api_key_cache` so the resolved key object is stored in a **shared** Redis cache. A cache hit on any worker prevents the DB query entirely. +Setting `enable_redis_auth_cache: true` under `litellm_settings` attaches Redis to `user_api_key_cache` so the resolved key object is stored in a **shared** Redis cache. A cache hit on any worker prevents the DB query entirely. ```yaml # config.yaml litellm_settings: + enable_redis_auth_cache: true # ← share the auth cache across workers cache: true cache_params: type: redis host: os.environ/REDIS_HOST port: os.environ/REDIS_PORT + max_connections: 100 # optional — tune per-worker pool size (default: 50) general_settings: master_key: sk-1234 - enable_redis_auth_cache: true # ← share the auth cache across workers ``` ### Requirements @@ -366,7 +366,7 @@ enable_redis_auth_cache=True: attached Redis to user_api_key_cache — virtual-k If the flag is off you will see: ``` -enable_redis_auth_cache is not set: user_api_key_cache remains in-memory only (per-worker). Set general_settings.enable_redis_auth_cache: true to share the auth cache across workers and reduce DB load. +enable_redis_auth_cache is not set: user_api_key_cache remains in-memory only (per-worker). Set litellm_settings.enable_redis_auth_cache: true to share the auth cache across workers and reduce DB load. ``` --- diff --git a/litellm/proxy/_types.py b/litellm/proxy/_types.py index ee7e7ce9463..b8e0aa0d128 100644 --- a/litellm/proxy/_types.py +++ b/litellm/proxy/_types.py @@ -2383,19 +2383,6 @@ class ConfigGeneralSettings(LiteLLMPydanticObjectBase): None, description="List of MCP server fields that must be filled in for a submission to pass standards checks (e.g. ['description', 'source_url', 'alias']).", ) - enable_redis_auth_cache: Optional[bool] = Field( - None, - description=( - "When True, attaches Redis to user_api_key_cache so virtual-key lookups " - "are shared across all proxy workers/pods instead of being resolved " - "per-process. Requires a Redis cache to be configured under litellm_settings. " - "Reduces DB load significantly in multi-worker deployments by eliminating " - "redundant combined_view SQL queries caused by per-pod cache misses. " - "Off by default for a safe phased rollout — set to True once your Redis " - "cluster is healthy and the CacheCodec serialisation has been validated in " - "your environment. Will be enabled by default in a future release." - ), - ) class ConfigYAML(LiteLLMPydanticObjectBase): diff --git a/litellm/proxy/proxy_server.py b/litellm/proxy/proxy_server.py index 73bc46ba391..8d199d2c092 100644 --- a/litellm/proxy/proxy_server.py +++ b/litellm/proxy/proxy_server.py @@ -2979,6 +2979,7 @@ class ProxyConfig: def _init_cache( self, cache_params: dict, + enable_redis_auth_cache: bool = False, ): global redis_usage_cache, llm_router, general_settings from litellm import Cache @@ -3002,7 +3003,7 @@ class ProxyConfig: ) # Note: PKCE verifier storage uses redis_usage_cache directly (not # user_api_key_cache) to avoid routing all API-key lookups through Redis. - if general_settings.get("enable_redis_auth_cache") is True: + if enable_redis_auth_cache is True: user_api_key_cache.attach_redis_cache( redis_usage_cache, default_redis_ttl=litellm.default_redis_ttl, @@ -3016,7 +3017,7 @@ class ProxyConfig: verbose_proxy_logger.info( "enable_redis_auth_cache is not set: user_api_key_cache " "remains in-memory only (per-worker). Set " - "general_settings.enable_redis_auth_cache: true to share " + "litellm_settings.enable_redis_auth_cache: true to share " "the auth cache across workers and reduce DB load." ) @@ -3337,7 +3338,13 @@ class ProxyConfig: cache_params[key] = get_secret(value) ## to pass a complete url, or set ssl=True, etc. just set it as `os.environ[REDIS_URL] = `, _redis.py checks for REDIS specific environment variables - self._init_cache(cache_params=cache_params) + self._init_cache( + cache_params=cache_params, + enable_redis_auth_cache=litellm_settings.get( + "enable_redis_auth_cache", False + ) + is True, + ) if litellm.cache is not None: verbose_proxy_logger.debug( f"{blue_color_code}Set Cache on LiteLLM Proxy{reset_color_code}"