docs: correct Claude subscription and ChatGPT subscription credential behavior

[jesus-berri]

Summary

Both subscription pages described more than LiteLLM does, or left out how credentials and attribution actually behave. Every new claim was checked against litellm main (0e076008e1) with a live proxy, a header-capturing upstream, and real Anthropic and auth.openai.com calls for the rejected-token cases

Claude subscription page (tutorials/claude_code_max_subscription). It now covers Pro, Max, Team, and Enterprise, since LiteLLM treats every sk-ant-oat token the same way. The page also listed forward_client_headers_to_llm_api: true as "Required". add_provider_specific_headers_to_request has forwarded the token to anthropic/ deployments without that setting since v1.81.14 (#19912), and a probe with and without the setting sent identical upstream headers, so the setting is removed from the configs and troubleshooting. New sections cover four areas. Routes: the token is used on /v1/messages and /v1/chat/completions, never on Bedrock or Vertex (v1.99.0), not on count_tokens, and not on the /anthropic pass-through when a key is configured. Credentials: Claude Code stores and refreshes the login, LiteLLM keeps nothing (0 token hits in --detailed_debug logs and SpendLogs), and 20 concurrent two-user requests had 0 token mismatches. Revocation: a revoked token returns 401 OAuth access token is invalid., LiteLLM cannot revoke a Claude login, and blocking the virtual key is the gateway-side cutoff. Attribution: cost is charged at API list price against key/user/team budgets, and the used_client_oauth_token flag is covered by the existing "Seeing Which Requests Were Billed to a Seat" section from #1703, which this PR now links to and generalizes from Max to any subscription seat (plus a note that /anthropic pass-through rows don't carry the flag). It also documents LIT-5116: one user's 401 cools down the deployment, so the next users get 429 No deployments available. A rerun with router_settings.disable_cooldowns: true returned 200 for them

ChatGPT page (providers/chatgpt). "ChatGPT Pro/Max" is replaced with the Codex plan list (ChatGPT has no Max plan), and the page now says device-code login must be enabled in ChatGPT security settings or by a workspace admin. New sections cover four points. There is one auth.json per proxy process, so every key shares one ChatGPT account and ChatGPT-Account-Id; a client-supplied ChatGPT token was ignored upstream. Recorded spend is $0, so max_budget does nothing. Refresh happens only on expiry, so a 401 on an unexpired token is not retried. A rejected refresh token returns HTTP 400 device-code login needs a human. LiteLLM has no logout or revoke for this provider

Link to Devin session: https://app.devin.ai/sessions/bd9cd9d16c90458aa8efc32ab8421f46
Open in Devin Desktop: https://app.devin.ai/desktop/session/bd9cd9d16c90458aa8efc32ab8421f46?variant=devin
Requested by: @jesus-berri

---

Note

Low Risk
Markdown documentation only; no application or proxy logic changes.

Overview
Documentation-only update that aligns subscription guides with verified proxy behavior (no runtime code changes).

Claude Code tutorial (claude_code_max_subscription.md) is retitled and reframed for Pro, Max, Team, and Enterprise, not Max-only. It drops forward_client_headers_to_llm_api: true as required (v1.81.14+ forwards sk-ant-oat OAuth on anthropic/ automatically) and adds guidance on deployment api_key fallback, env vars that override subscription login, which routes forward the token (and which do not), per-user credential handling, deployment cooldown after one user's 401 (router_settings.disable_cooldowns: true), attribution/cost at API list prices, and refreshed troubleshooting.

ChatGPT provider doc (chatgpt.md) replaces incorrect Pro/Max wording with Codex-inclusive subscription plans, notes device-code login must be enabled in account/workspace settings, and adds sections on one shared auth.json per proxy (no per-client ChatGPT tokens), $0 recorded spend / max_budget ineffectiveness, and refresh vs mid-session 401 / revocation behavior.

^{Reviewed by Cursor Bugbot for commit 2a4af9d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
litellm	Ready	Preview	Oct 10, 2026 3:42am UTC

[mateo-berri]

#1703 merged a "Seeing Which Requests Were Billed to a Seat" section here that repeats your used_client_oauth_token paragraph. Want to fold them into one?

[devin-ai-integration]

Folded in 2421d05. #1703's "Seeing Which Requests Were Billed to a Seat" section is now the only place that describes used_client_oauth_token. "Attribution and cost" and the credential storage paragraph link to it instead of repeating it. In that section I also changed "Max seat" to "subscription seat" and added that /anthropic pass-through rows don't carry the field (LIT-8607)

Written by Devin

[mateo-berri]

The token already forwards without the setting on v1.81.14 (#19912 shipped there, checked live). Could the three v1.82.3 mentions say v1.81.14?

[devin-ai-integration]

Agreed, changed all three to v1.81.14 in 2a4af9d. I checked the tag: v1.81.14-stable is the first stable tag that contains #19912 (8d50956051), and v1.81.12-stable doesn't have it. On that tag, add_provider_specific_headers_to_request scopes the sk-ant-oat Authorization header into provider_specific_header with no forward_client_headers_to_llm_api check. The "never sent to Bedrock or Vertex AI (since v1.99.0)" line stays as it is, because on v1.81.14 the scope still listed anthropic,bedrock,vertex_ai

Written by Devin

[mateo-berri]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 2a4af9d. Configure here.}

[mateo-berri]

LGTM. Thanks!