fix(proxy): point /metrics 401 at the opt-out flag

[yuneng-berri]

Summary

• Operators upgrading past 35bbca60b0 (which made /metrics auth default-on) hit 401 "Malformed API Key passed in. Ensure Key has 'Bearer ' prefix." from any Prometheus scraper that doesn't send credentials, with no hint that the legacy public behavior is one YAML line away.
• Append litellm_settings.require_auth_for_metrics_endpoint: false discovery hint to the existing 401 body in prometheus_auth_middleware.py. No behavior change — auth still runs, still rejects bad/missing credentials, the legacy opt-out flag still bypasses cleanly. Just a clear migration path in the response operators actually see.

Post-fix body:

"Unauthorized access to metrics endpoint: <inner error>. To allow unauthenticated access, set 'litellm_settings.require_auth_for_metrics_endpoint: false' in your proxy_config.yaml."

Test plan

• uv run pytest tests/test_litellm/proxy/middleware/test_prometheus_auth_middleware.py tests/test_litellm/proxy/middleware/test_prometheus_auth_middleware_asgi.py -v — 11 passed (including new test_invalid_auth_metrics_includes_optout_hint)
• Live proxy: GET /metrics with no auth → 401 body now contains the opt-out hint
• Live proxy: GET /metrics with valid Bearer sk-1234 → auth still passes
• Live proxy: GET /metrics with invalid Bearer → 401 (auth still rejects), body now contains the opt-out hint
• Live proxy: GET /metrics with require_auth_for_metrics_endpoint: false → auth bypass still works
• Live proxy: GET /health/liveliness (unrelated public endpoint) → still 200

[greptile-apps]

Greptile Summary

This PR improves the /metrics 401 error message to include a discovery hint for the litellm_settings.require_auth_for_metrics_endpoint: false opt-out flag, so operators whose Prometheus scrapers break after the auth-default-on change can immediately see the migration path rather than just a generic "Malformed API Key" error.

• prometheus_auth_middleware.py: Single string change in the except block — appends the opt-out YAML snippet to the existing 401 body; auth logic and status code are unchanged.
• test_prometheus_auth_middleware.py: New mock-only test verifying the 401 body contains both require_auth_for_metrics_endpoint and false; existing tests continue to pass with no assertion changes.

Confidence Score: 5/5

Safe to merge — the only change is a string appended to an existing error message with no effect on auth logic or behavior.

The change touches exactly one string literal in the error path and adds a targeted mock test that confirms the hint text is present. Auth still runs, the 401 status code is unchanged, and the opt-out bypass path is untouched. No regressions in any of the existing tests, and no new code paths are introduced.

No files require special attention.

Important Files Changed

Filename	Overview
litellm/proxy/middleware/prometheus_auth_middleware.py	Appends opt-out hint to the 401 body on auth failure; no logic or behavior change
tests/test_litellm/proxy/middleware/test_prometheus_auth_middleware.py	Adds test_invalid_auth_metrics_includes_optout_hint to assert the new hint text appears in the 401 body; uses mocks only, no network calls

_{Reviews (1): Last reviewed commit: "fix(proxy): point /metrics 401 at the op..." | Re-trigger Greptile}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!