Skip to content

docs(auth): add scope and wildcard support for JWT routing overrides - #31

Merged
mubashir1osmani merged 1 commit into
BerriAI:mainfrom
milan-berri:litellm_jwt_override_scope_wildcard_docs
May 21, 2026
Merged

docs(auth): add scope and wildcard support for JWT routing overrides#31
mubashir1osmani merged 1 commit into
BerriAI:mainfrom
milan-berri:litellm_jwt_override_scope_wildcard_docs

Conversation

@milan-berri

@milan-berri milan-berri commented Apr 28, 2026

Copy link
Copy Markdown
Contributor

Summary

Backfills this docs site with the documentation that originally shipped under docs/my-website/ in BerriAI/litellm#25939 / #26325. After the docs source was migrated out of the litellm repo, those doc edits could no longer be carried in the code PR and were dropped on rebase — this PR brings them over.

Changes

  • docs/proxy/token_auth.md — expand the "Matching behavior" section under routing_overrides:
    • AND semantics across configured selectors
    • new optional scope selector
    • list/string selector forms
    • shell-style wildcards (*, ?), case-sensitive
    • scope-only space-split rule (iss, aud, client_id are never split on spaces)
    • new worked example combining scope with a wildcard client_id
  • docs/proxy/oauth2.md — short cross-reference to the new wildcard/scope behavior, pointing readers at token_auth.md.

No content changes outside these two files.

Related

Test plan

  • Render docs/proxy/token_auth.md locally and confirm the new "Matching behavior" bullets and the Example: scope and wildcard client_id YAML block are formatted correctly.
  • Render docs/proxy/oauth2.md locally and confirm the cross-reference link to token_auth.md#route-jwt-shaped-machine-tokens-to-oauth2 resolves.

Made with Cursor

@milan-berri
milan-berri requested a review from a team April 28, 2026 08:51
@vercel

vercel Bot commented Apr 28, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
litellm Ready Ready Preview, Comment Apr 28, 2026 8:56am

Request Review

@milan-berri
docs(auth): document scope and wildcard support for JWT routing overr…
8cb6e1b 
…ides

Backfills the `BerriAI/litellm-docs` site with the changes that originally
shipped under `docs/my-website/` in BerriAI/litellm#25939 / #26325. After
the docs source was migrated to this repo, those edits could no longer
be carried in the code PR and were dropped on rebase.

- proxy/token_auth.md: expand "Matching behavior" with AND semantics,
  the new optional `scope` selector, list/string forms, shell-style
  wildcards (`*`, `?`, case-sensitive), and the scope-only space-split
  rule (iss/aud/client_id are never split on spaces). Adds a worked
  example combining `scope` with a wildcard `client_id`.
- proxy/oauth2.md: cross-reference the new wildcard/scope behavior and
  point readers to token_auth.md for full details.

Code change is in BerriAI/litellm#26325 (litellm_internal_staging).
@milan-berri
milan-berri force-pushed the litellm_jwt_override_scope_wildcard_docs branch from 97c2edf to 8cb6e1b Compare April 28, 2026 08:55
@mubashir1osmani
mubashir1osmani merged commit 644a2b5 into BerriAI:main May 21, 2026
2 checks passed
mubashir1osmani added a commit that referenced this pull request May 21, 2026
@ishaan-berri @Chesars
@harish-berri @milan-berri @mubashir1osmani @michelligabriele
docs: LLM-as-a-Judge guardrail (#17)
2ca2023 
* docs: add LLM-as-a-Judge guardrail guide with screenshots

New guardrail type that uses an LLM to score responses against
weighted criteria. Includes UI walkthrough, YAML config examples,
blocked/passed response examples, and configuration reference.

* docs(llm-judge): replace placeholder screenshots with real spend logs UI screenshots

* docs(llm-judge): use real spend logs UI screenshots for blocked/passed guardrail views

* docs(blog): make /blog responsive (#51)

* docs(blog): make /blog responsive

- Add mobile styles to swizzled BlogListPage (hero, marquee, posts, pagination).
- Fix horizontal overflow caused by the marquee's white-space: nowrap propagating
  width up the flex chain. Break it with min-width: 0 on .page and #__docusaurus > *,
  plus defensive overflow-x: clip.
- Respect prefers-reduced-motion (stop marquee animation).

* Remove global overflow prevention styles

Removed global styles to prevent horizontal overflow on mobile.

* docs(proxy): add Grafana Cloud Pyroscope user and API token configuration options (#52)

* docs(auth): document scope and wildcard support for JWT routing overrides (#31)

Backfills the `BerriAI/litellm-docs` site with the changes that originally
shipped under `docs/my-website/` in BerriAI/litellm#25939 / #26325. After
the docs source was migrated to this repo, those edits could no longer
be carried in the code PR and were dropped on rebase.

- proxy/token_auth.md: expand "Matching behavior" with AND semantics,
  the new optional `scope` selector, list/string forms, shell-style
  wildcards (`*`, `?`, case-sensitive), and the scope-only space-split
  rule (iss/aud/client_id are never split on spaces). Adds a worked
  example combining `scope` with a wildcard `client_id`.
- proxy/oauth2.md: cross-reference the new wildcard/scope behavior and
  point readers to token_auth.md for full details.

Code change is in BerriAI/litellm#26325 (litellm_internal_staging).

* docs(mcp,a2a): code-verified auth reference fixes + overview page (#156) (#184)

* docs(mcp,a2a): code-verified auth reference fixes + overview page (#156)

* docs(mcp): complete auth_type table, OAuth config reference, RBAC intersection model, hub-vs-public-internet distinction

* docs(a2a): document x-litellm-api-key, trace-id enforcement, sub-agent propagation, agent access groups and full intersection model

* docs(bedrock_agentcore): add LiteLLM A2A Gateway section — fixes broken anchor from a2a.md, documents dual JWT/SigV4 auth modes and full credential chain

* docs: add AuthN/AuthZ overview page side-by-siding MCP and A2A gateways

* docs(fixup): corrections from code-review pass — verified against current LiteLLM source

* make changes

---------

Co-authored-by: michelligabriele <gabriele.michelli@icloud.com>

---------

Co-authored-by: Cesar Garcia <128240629+Chesars@users.noreply.github.com>
Co-authored-by: harish-berri <harish@berri.ai>
Co-authored-by: milan-berri <milan@berri.ai>
Co-authored-by: mubashir1osmani <mubashir.osmani777@gmail.com>
Co-authored-by: michelligabriele <gabriele.michelli@icloud.com>
@mubashir1osmani mubashir1osmani mentioned this pull request May 21, 2026
Open
mubashir1osmani added a commit that referenced this pull request May 21, 2026
@mateo-berri @Chesars
@harish-berri @milan-berri @mubashir1osmani @michelligabriele @agent-shin litellm-compat-matrix-bot @Sameerlite @cursoragent @yuneng-berri
docs: replace slow Inkeep search with offline local search (#192)
727ad0a 
* docs(blog): make /blog responsive (#51)

* docs(blog): make /blog responsive

- Add mobile styles to swizzled BlogListPage (hero, marquee, posts, pagination).
- Fix horizontal overflow caused by the marquee's white-space: nowrap propagating
  width up the flex chain. Break it with min-width: 0 on .page and #__docusaurus > *,
  plus defensive overflow-x: clip.
- Respect prefers-reduced-motion (stop marquee animation).

* Remove global overflow prevention styles

Removed global styles to prevent horizontal overflow on mobile.

* docs(proxy): add Grafana Cloud Pyroscope user and API token configuration options (#52)

* docs(auth): document scope and wildcard support for JWT routing overrides (#31)

Backfills the `BerriAI/litellm-docs` site with the changes that originally
shipped under `docs/my-website/` in BerriAI/litellm#25939 / #26325. After
the docs source was migrated to this repo, those edits could no longer
be carried in the code PR and were dropped on rebase.

- proxy/token_auth.md: expand "Matching behavior" with AND semantics,
  the new optional `scope` selector, list/string forms, shell-style
  wildcards (`*`, `?`, case-sensitive), and the scope-only space-split
  rule (iss/aud/client_id are never split on spaces). Adds a worked
  example combining `scope` with a wildcard `client_id`.
- proxy/oauth2.md: cross-reference the new wildcard/scope behavior and
  point readers to token_auth.md for full details.

Code change is in BerriAI/litellm#26325 (litellm_internal_staging).

* docs(mcp,a2a): code-verified auth reference fixes + overview page (#156) (#184)

* docs(mcp,a2a): code-verified auth reference fixes + overview page (#156)

* docs(mcp): complete auth_type table, OAuth config reference, RBAC intersection model, hub-vs-public-internet distinction

* docs(a2a): document x-litellm-api-key, trace-id enforcement, sub-agent propagation, agent access groups and full intersection model

* docs(bedrock_agentcore): add LiteLLM A2A Gateway section — fixes broken anchor from a2a.md, documents dual JWT/SigV4 auth modes and full credential chain

* docs: add AuthN/AuthZ overview page side-by-siding MCP and A2A gateways

* docs(fixup): corrections from code-review pass — verified against current LiteLLM source

* make changes

---------

Co-authored-by: michelligabriele <gabriele.michelli@icloud.com>

* Update Claude Code compatibility matrix (#175)

litellm_version: v1.83.14-stable
claude_code_version: 2.1.126
generated_at: 2026-05-20T06:09:45Z

Co-authored-by: litellm-compat-matrix-bot <litellm-bot@berri.ai>

* docs(mcp): pass guardrails via extra_body in OpenAI SDK example (#188)

The OpenAI Python SDK rejects guardrails as a top-level argument; use extra_body to send LiteLLM-specific params to the proxy.

Co-authored-by: Cursor <cursoragent@cursor.com>

* docs(release_notes): add v1.84.1 and v1.85.1 patch release notes (#191)

Patch releases on top of v1.84.0 and v1.85.0, each shipping the same
three PRs: Gemini 3.5 Flash day-0 support (#28268), a Vertex AI
tool-calling fix for Gemini 3.5+ HTTP 400 errors (#28324), and a
cross-pod spend-counter seeding fix (#27854).

Adds release_notes/v1.84.1/ and release_notes/v1.85.1/ pages and
updates the release_notes overview (Latest Release block + table).

* docs: replace slow Inkeep search with offline @easyops-cn/docusaurus-search-local

Inkeep search was reported as slow and exhibited focus / Cmd+K bugs
(cursor in the wrong place, page preventing repeated searches). Swap
the navbar SearchBar over to @easyops-cn/docusaurus-search-local, which
builds a static lunr index at build time and renders results instantly
on the client.

- Add @easyops-cn/docusaurus-search-local theme with both docs and
  release_notes routes indexed.
- Keep stop words and stems (technical docs frequently search short
  tokens) and enable highlight-on-target-page.
- Drop the SearchBar config from @inkeep/cxkit-docusaurus so it only
  provides the floating Ask AI chat button (still useful for AI Q&A).

Co-authored-by: Mateo Wang <mateo-berri@users.noreply.github.com>

---------

Co-authored-by: Cesar Garcia <128240629+Chesars@users.noreply.github.com>
Co-authored-by: harish-berri <harish@berri.ai>
Co-authored-by: milan-berri <milan@berri.ai>
Co-authored-by: mubashir1osmani <mubashir.osmani777@gmail.com>
Co-authored-by: michelligabriele <gabriele.michelli@icloud.com>
Co-authored-by: agent-shin <279878236+agent-shin@users.noreply.github.com>
Co-authored-by: litellm-compat-matrix-bot <litellm-bot@berri.ai>
Co-authored-by: Sameer Kankute <sameer@berri.ai>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: yuneng-jiang <yuneng@berri.ai>
Co-authored-by: Mateo Wang <mateo-berri@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mubashir1osmani mubashir1osmani mubashir1osmani approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@milan-berri @mubashir1osmani