fix: populate identity fields in proxy admin JWT early-return path

[ishaan-jaff]

Summary

• When is_proxy_admin is True during JWT auth, the UserAPIKeyAuth early-return now includes user_id, team_id, team_alias, team_metadata, org_id, and end_user_id resolved from the JWT
• Previously only user_role and parent_otel_span were set, causing blank Team Name and Internal User in the Request Logs UI for JWT-authenticated proxy admins

Test plan

• Added test_proxy_admin_jwt_auth_includes_identity_fields — verifies all identity fields are populated
• Added test_proxy_admin_jwt_auth_handles_no_team_object — verifies None team_object is handled correctly
• All existing tests pass (make test-unit)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
litellm	Error		Feb 14, 2026 1:04am

[greptile-apps]

Greptile Overview

Greptile Summary

This PR fixes a bug where JWT-authenticated proxy admin users had blank Team Name and Internal User fields in the Request Logs UI. The root cause was that the is_proxy_admin early-return path in _user_api_key_auth_builder only populated user_role and parent_otel_span, discarding all identity fields (user_id, team_id, team_alias, team_metadata, org_id, end_user_id) that had already been resolved from the JWT.

• The fix adds the missing identity fields to the UserAPIKeyAuth constructor in the admin early-return path at litellm/proxy/auth/user_api_key_auth.py:586-603, mirroring the field assignments in the non-admin path.
• Two unit tests were added, though they test UserAPIKeyAuth constructor behavior directly rather than the actual auth flow.
• The admin path intentionally continues to skip common_checks (budget validation, model access checks) and rate-limiting fields (team_tpm_limit, team_rpm_limit, team_models), which is reasonable since proxy admins have unrestricted access.

Confidence Score: 4/5

• This PR is safe to merge — it adds missing field assignments to an existing early-return path with no behavioral side effects.
• The code change is small, well-scoped, and mirrors an established pattern from the non-admin path. All added fields are Optional with safe None defaults. The only concern is test coverage: the tests validate UserAPIKeyAuth construction rather than the actual auth code path, providing weaker regression guarantees than an integration-style mock test would.
• tests/test_litellm/proxy/auth/test_user_api_key_auth.py — tests could be strengthened to exercise the actual auth builder flow.

Important Files Changed

Filename	Overview
litellm/proxy/auth/user_api_key_auth.py	Populates identity fields (user_id, team_id, team_alias, team_metadata, org_id, end_user_id) in the proxy admin JWT early-return path. The fix correctly mirrors the non-admin path for identity fields but intentionally omits rate-limiting fields (team_tpm_limit, team_rpm_limit, team_models) since admin users skip budget checks.
tests/test_litellm/proxy/auth/test_user_api_key_auth.py	Adds two unit tests for proxy admin JWT auth identity fields. Tests validate UserAPIKeyAuth constructor behavior but don't test the actual auth flow (they don't invoke _user_api_key_auth_builder), reducing confidence that the production code path is exercised.

Flowchart

flowchart TD
    A[JWT Token Received] --> B[JWTAuthManager.auth_builder]
    B --> C{is_proxy_admin?}
    C -->|Yes| D[Return UserAPIKeyAuth<br/>with identity fields<br/>- user_id, team_id, team_alias<br/>- team_metadata, org_id, end_user_id<br/>- user_role=PROXY_ADMIN]
    C -->|No| E[Build valid_token with<br/>full team limits & models]
    E --> F[Run common_checks<br/>budget, model access, etc.]
    F --> G[Return UserAPIKeyAuth]
    D --> H[Skip common_checks<br/>and rate limit fields]

    style D fill:#90EE90
    style H fill:#FFCC80

Loading

_{Last reviewed commit: 96db536}

[greptile-apps]

_{2 files reviewed, 2 comments}

_{Edit Code Review Agent Settings | Greptile}

[greptile-apps]

Tests don't exercise the actual auth code path

Both new tests construct a UserAPIKeyAuth object directly rather than invoking _user_api_key_auth_builder with a mocked JWT flow. This means they validate that UserAPIKeyAuth accepts the fields (which is trivially true since these are existing Pydantic fields), but don't verify that the production code in user_api_key_auth.py:586-603 actually passes those values correctly.

Consider adding a test that mocks the JWT auth flow (similar to test_proxy_admin_expired_key_from_cache at line 243) and asserts that the returned UserAPIKeyAuth has identity fields populated when is_proxy_admin=True.

[greptile-apps]

Inconsistent parenthesization with team_alias

The team_metadata ternary expression lacks the explicit parentheses that team_alias (line 592-596) uses. While this works correctly due to operator precedence, the inconsistent style reduces readability within the same block.

Suggested change

	team_metadata=team_object.metadata
	if team_object is not None
	else None,
	team_metadata=(
	team_object.metadata
	if team_object is not None
	else None
	),

_{Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!}