[internal copy of #28269] Codex cli jwt team alias

[mateo-berri]

Automated copy of #28269 into litellm_internal_staging for pr-babysitter.

Original head: boarder7395/litellm:codex-cli-jwt-team-alias @ cb19add560fa

---

Note

Low Risk
Low risk: adds an optional team_alias field to the CLI JWT payload and threads it through the SSO polling flow without changing authorization checks or token expiration logic.

Overview
Adds support for embedding the selected team’s human-readable alias in CLI SSO JWTs.

ExperimentalUIJWTToken.get_cli_jwt_auth_token() now accepts team_alias and includes it in the serialized UserAPIKeyAuth payload, while the CLI SSO poll endpoint derives the alias from session_data["team_details"] and passes it through when minting the JWT. Tests are updated to assert team_alias propagation end-to-end.

^{Reviewed by Cursor Bugbot for commit f78fe4f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[CLAassistant]

All committers have signed the CLA.

[greptile-apps]

Greptile Summary

This PR adds an optional team_alias field to the CLI SSO JWT flow, embedding the human-readable team name alongside the existing team_id in the encrypted UserAPIKeyAuth payload. No authorization checks, token expiry logic, or existing fields are modified.

• get_cli_jwt_auth_token() gains an optional team_alias parameter that is passed directly to UserAPIKeyAuth, which already declares the field as Optional[str] = None.
• In cli_poll_key, the alias is resolved by scanning the cached team_details list for the matching team_id; it gracefully falls back to None when details are unavailable.
• Tests are added end-to-end to verify both the JWT serialization and the SSO polling path.

Confidence Score: 5/5

Safe to merge — adds read-only metadata to the CLI JWT without touching auth checks or token expiry.

The change is additive and optional: team_alias defaults to None, the field already exists on UserAPIKeyAuth, and the lookup in the SSO poll endpoint handles all edge cases (absent details, unmatched team). Authorization logic is untouched.

No files require special attention.

Important Files Changed

Filename	Overview
litellm/proxy/auth/auth_checks.py	Adds optional team_alias parameter to get_cli_jwt_auth_token() and threads it into the UserAPIKeyAuth payload; no logic changes to auth or expiry.
litellm/proxy/management_endpoints/ui_sso.py	Derives team_alias from cached team_details by matching team_id, then passes it to JWT generation; gracefully falls back to None when details are absent.
tests/test_litellm/proxy/auth/test_auth_checks.py	New unit test confirms team_alias is serialized into the encrypted JWT payload correctly.
tests/test_litellm/proxy/management_endpoints/test_ui_sso.py	Extends TestCLIKeyRegenerationFlow fixture with team_details and asserts team_alias is passed through to the JWT generation call; test coverage is adequate.

_{Reviews (2): Last reviewed commit: "Include team alias in CLI JWT token" | Re-trigger Greptile}

[mateo-berri]

@greptileai

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[Sameerlite]

LGTM