docs(anthropic): document workload identity federation - #1000
derhornspieler wants to merge 8 commits into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Documents the feature added in BerriAI/litellm#38013. Please merge alongside it, not before |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 270dfa203d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
0218219 to
7559583
Compare
7559583 to
883de17
Compare
883de17 to
3eb29ef
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3eb29ef247
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
| ### Monitoring | ||
|
|
||
| Token health is emitted through the standard service-logging path, so it lands on both Prometheus and OpenTelemetry with no extra wiring. The services are `anthropic_wif` for the exchange itself and `anthropic_wif_cache` for cache hits and misses, giving you mint counts, mint latency, and failures broken out by cause. Enable them with: |
There was a problem hiding this comment.
When an operator copies this monitoring configuration, it enables only prometheus_system; it does not activate either OpenTelemetry integration, and OTel v2 is explicitly off by default until LITELLM_OTEL_V2=true is set. Consequently, the promised WIF telemetry will not “land on both Prometheus and OpenTelemetry with no extra wiring.” Either describe this as Prometheus-only or include the required OpenTelemetry callback/exporter configuration.
Useful? React with 👍 / 👎.
|
bugbot run |
…ider wizard is gone
|
bugbot run |
…he shared token cache The Admin UI flow moves to a follow-up now that the backend ships first, anthropic_workspace_id becomes anthropic_federation_workspace_id so Bedrock's parameter keeps its meaning, and the refresh section explains the same-host token cache and Anthropic's single-use assertion rule
|
bugbot run |
…pace var is renamed
|
bugbot run |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
✅ Bugbot reviewed your changes and found no new issues!
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit f73c97c. Configure here.
2 participants
Documents the Anthropic workload identity federation support added in BerriAI/litellm#38013, so operators can set it up without reading the source.
Covers the federation identifiers, all four identity sources (token file, oidc/ secret reference, LiteLLM as the issuer, and Keycloak), the inline JWKS registration step that the internal-issuer flow needs, token caching and the two-tier refresh, the LITELLM_ANTHROPIC_WIF_ALLOWED_HOSTS allowlist, and the Prometheus and OTEL services that report token health.
Every field name, accepted value and default in the page was checked against the implementation rather than inferred. Docusaurus build passes locally.
Note
Low Risk
Documentation-only change with no runtime or authentication logic modified in this diff.
Overview
Adds a Workload Identity Federation section to
docs/providers/anthropic.md(inserted before Usage), documenting how operators can use OIDC-to-sk-ant-oat01exchange instead of long-lived API keys for Anthropic via LiteLLM.The new content covers federation rule fields and env overrides, credential precedence (
ANTHROPIC_API_KEY/ANTHROPIC_AUTH_TOKENvs federation), and four identity sources with YAML/shell examples: projected token file,oidc/secret references, LiteLLM internal_issuer (including the proxy-admin JWKS export endpoint), and Keycloak client credentials. It also documents operational behavior: two-tier token refresh and cross-worker disk cache, single-use assertion (jti_reused) constraints for file/env tokens, proxy-admin-only federation edits (includingapi_base),LITELLM_ANTHROPIC_WIF_ALLOWED_HOSTS, andanthropic_wif/anthropic_wif_cachemetrics viaservice_callback. Notes that Admin UI support is not available yet.Reviewed by Cursor Bugbot for commit f73c97c. Bugbot is set up for automated code reviews on this repo. Configure here.