mirror of
https://github.com/BerriAI/litellm.git
synced 2026-09-09 22:31:41 +00:00
2edfe2dc10
Replaces the ANTHROPIC_AUTH_TOKEN/ANTHROPIC_API_KEY environment-variable read with a short-lived token the proxy mints itself, so the generated command authenticates to /v1/bulk_read and /v1/code_write without depending on the calling client's shell holding either variable. That dependency only ever held for Claude Code; any other client (Cursor, a custom agent) would have sent an empty bearer and 401'd. The token is a sealed grant (litellm/proxy/guardrails/shunt_capability_token.py) built on the proxy's own encrypt_value_helper, the same primitive the gateway's OAuth flow already seals values with. It carries a reference to the caller's key hash rather than the key itself, and a two-minute expiry rather than a single-use guard: an agent retrying a timed-out Bash command must still authenticate, and a single-use claim would turn that ordinary retry into a permanent 401. The worst a replay inside the window can do is spend the caller's own already- budgeted quota on a request they already made. Carried in the generated command's Authorization header, never a URL query string: every other sealed token in this proxy already avoids query strings, since they routinely end up in access logs. /v1/bulk_read and /v1/code_write now authenticate exclusively via this token instead of the normal user_api_key_auth path, since nothing but a shunt-generated command should ever call them. Master-key callers (UserAPIKeyAuth.api_key holds a stable alias rather than a DB-backed hash for that case) carry the real master key in the grant instead, compared directly at the endpoint. |
||
|---|---|---|
| .. | ||
| litellm-dashboard | ||
| Dockerfile | ||
| nginx.conf | ||