From e36ab04a1856b072f6403d8b16236cf7cad3d960 Mon Sep 17 00:00:00 2001
From: Ryan Crabbe <ryan@berri.ai>
Date: Fri, 27 Mar 2026 16:26:00 -0700
Subject: [PATCH] fix(auth): guard JWTHandler.is_jwt() against None token

When JWT auth is enabled and a request arrives without an Authorization
header (e.g. health checks, monitoring), api_key is None due to
APIKeyHeader(auto_error=False). The is_jwt() call crashes with
AttributeError: 'NoneType' object has no attribute 'split'.

Return False for None tokens since they are not JWTs.
---
 litellm/proxy/auth/handle_jwt.py | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/litellm/proxy/auth/handle_jwt.py b/litellm/proxy/auth/handle_jwt.py
index bfad9f0c3c7..86f7d614b95 100644
--- a/litellm/proxy/auth/handle_jwt.py
+++ b/litellm/proxy/auth/handle_jwt.py
@@ -89,7 +89,9 @@ class JWTHandler:
         self.leeway = leeway
 
     @staticmethod
-    def is_jwt(token: str):
+    def is_jwt(token: Optional[str]):
+        if token is None:
+            return False
         parts = token.split(".")
         return len(parts) == 3