fix: 400 on Anthropic context overflow; seed identity on failed auth

[yassin-berriai]

Relevant issues

Two small, independent error-handling bugs in adjacent code paths.

1. Anthropic context-window overflow can surface as a 500 instead of a 400. The Anthropic branch of exception_type only special-cased "prompt is too long" / "prompt: length" for ContextWindowExceededError; everything else relied on the status-code path. When the upstream exception reached the mapper without a status_code, "input length and max_tokens exceed context limit: A + B > C" fell through to APIConnectionError (500). Even with a status code, the same phrasing was classified as a plain BadRequestError, missing the ContextWindowExceededError type that drives context_window_fallbacks. The fix detects both phrasings through ExceptionCheckers.is_error_str_context_window_exceeded before the status-code gate.

2. When user_api_key_auth failed after the key/team/user identity had been resolved (an expired key whose team and user are already known, a budget/access check on a real key, etc.), the failure handler built a fresh empty UserAPIKeyAuth and passed it to proxy_logging_obj.post_call_failure_hook. OTEL V2 only calls seed_request_identity on success, so failed traces carried no litellm.team.id, litellm.team.alias, litellm.api_key.hash, or gen_ai.request.model. The fix threads the resolved identity into the handler and seeds it onto the request's server span before rejecting the request, so the failed trace is labeled with what auth already looked up. seed_request_identity now also falls back to the anchored request root span when it runs inside the live auth phase span (where get_current_span() is the phase span, not the server span).

Linear ticket

Resolves LIT-3624; Resolves LIT-3627

Pre-Submission checklist

• I have added meaningful tests
• My PR passes all unit tests on make test-unit
• My PR's scope is as isolated as possible; it only solves 1 specific problem (two adjacent error-handling bugs, one commit each)
• I have requested a Greptile review

CI (LiteLLM team)

• Branch creation CI run
  Link:
• CI run for the last commit
  Link:
• Merge / cherry-pick CI run
  Links:

Screenshots / Proof of Fix

Both bugs reproduced end-to-end against a live local proxy (python3 litellm/proxy/proxy_cli.py --config otel_repro_config.yaml --port 4000) with OTEL V2 + console span exporter; the upstream Anthropic endpoint is a tiny FastAPI shim that returns the exact 400 body Anthropic emits for the context-overflow case (no real API key in this environment, so a stub stands in for the upstream; the path under test is the proxy's error-handling and identity-seeding, not the wire call).

Bug 1: Anthropic context-window overflow

$ curl -s -X POST http://127.0.0.1:4000/v1/chat/completions \
    -H "Authorization: Bearer sk-1234" -H "Content-Type: application/json" \
    -d '{"model":"fake-anthropic","messages":[{"role":"user","content":"big prompt"}],"max_tokens":8000}' \
    -w "\nHTTP_STATUS=%{http_code}\n"

Before (baseline branch checked out, same curl):

{"error":{"message":"litellm.BadRequestError: AnthropicException - input length and max_tokens exceed context limit: 200000 + 8000 > 200000, decrease input length or max_tokens and try again ... ","type":null,"param":null,"code":"400"}}
HTTP_STATUS=400

After:

{"error":{"message":"litellm.ContextWindowExceededError: litellm.BadRequestError: AnthropicError - input length and max_tokens exceed context limit: 200000 + 8000 > 200000 ... \nmodel=fake-anthropic. context_window_fallbacks=None. fallbacks=None.\n\nSet 'context_window_fallback' - https://docs.litellm.ai/docs/routing#fallbacks. ...","type":null,"param":null,"code":"400"}}
HTTP_STATUS=400

Note: on the live /v1/chat/completions path the upstream HTTP 400 preserves status_code, so the HTTP code is 400 in both runs; what changes is the exception type (BadRequestError -> ContextWindowExceededError), which is what enables context_window_fallbacks. The 500-instead-of-400 manifestation occurs on paths that strip status_code before the mapper runs (e.g. certain streaming / adapter paths), reproduced directly against the mapper:

>>> from litellm import exception_type
>>> exception_type(model="claude-sonnet-4-5",
...                custom_llm_provider="anthropic",
...                original_exception=Exception(
...                    "AnthropicException - input length and max_tokens exceed context limit: 200000 + 8000 > 200000"))

Before: raises APIConnectionError (500). After: raises ContextWindowExceededError (400).

Bug 2: failed-auth identity in OTEL trace

$ curl -s -X POST http://127.0.0.1:4000/team/new -H "Authorization: Bearer sk-1234" \
    -H "Content-Type: application/json" \
    -d '{"team_alias":"acme-team","metadata":{"department":"research","cost_center":"cc-42"}}'
$ curl -s -X POST http://127.0.0.1:4000/key/generate -H "Authorization: Bearer sk-1234" \
    -H "Content-Type: application/json" \
    -d '{"team_id":"<from above>","duration":"4s","metadata":{"owner":"alice"},"models":["fake-anthropic"]}'
$ sleep 7  # key has now expired
$ curl -s -X POST http://127.0.0.1:4000/v1/chat/completions \
    -H "Authorization: Bearer <expired key>" -H "Content-Type: application/json" \
    -d '{"model":"fake-anthropic","messages":[{"role":"user","content":"hi"}]}'
# -> 401 expired_key

SERVER span emitted to the OTEL console exporter, before the fix:

{
    "name": "POST /v1/chat/completions",
    "kind": "SpanKind.SERVER",
    "attributes": {
        "http.scheme": "http", "http.method": "POST",
        "http.target": "/v1/chat/completions",
        "http.route": "/v1/chat/completions",
        "http.status_code": 401
    }
}

After the fix the same span carries the identity auth already resolved:

{
    "name": "POST /v1/chat/completions",
    "kind": "SpanKind.SERVER",
    "attributes": {
        "http.scheme": "http", "http.method": "POST",
        "http.target": "/v1/chat/completions",
        "http.route": "/v1/chat/completions",
        "litellm.team.id": "994e569b-0f2f-42c7-82bf-61d2007ec0c4",
        "litellm.team.alias": "acme-team",
        "litellm.api_key.hash": "e56f6fb0fca5bef5631fa6878842932f621506f594c9fd889043016bf28e01d1",
        "gen_ai.request.model": "fake-anthropic",
        "http.status_code": 401
    }
}

Type

Bug Fix

Changes

litellm/litellm_core_utils/exception_mapping_utils.py: Anthropic branch detects context-window overflow via ExceptionCheckers.is_error_str_context_window_exceeded before the status-code gate, so both "prompt is too long" / "prompt: length" and "exceed context limit" map to ContextWindowExceededError (400) regardless of whether the upstream exception carried a status_code.

litellm/proxy/auth/auth_exception_handler.py, litellm/proxy/auth/user_api_key_auth.py: thread the resolved identity (valid_token / user_api_key_auth_obj) into UserAPIKeyAuthExceptionHandler._handle_authentication_error. The handler now reuses that identity for the failure logging hook and stamps it onto the request's server span via seed_request_identity before rejecting the request, so failed traces show the team/key/user that auth had already looked up.

litellm/integrations/otel/logger.py: seed_request_identity falls back to the anchored request root span when called from inside the live auth phase span (where get_current_span() is the phase span, not the server span).

Tests in tests/test_litellm/litellm_core_utils/test_exception_mapping_utils.py and tests/test_litellm/proxy/auth/test_auth_exception_handler.py are regression tests that each fail against the pre-fix code on the specific bug and pass after.

---

Generated by Claude Code

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[greptile-apps]

Greptile Summary

Two independent error-handling bug fixes: Anthropic context-window overflow now correctly maps to ContextWindowExceededError instead of falling through to BadRequestError or APIConnectionError, and failed-auth traces are now stamped with the identity (team, key hash, model) that had already been resolved before the failure occurred.

• Exception mapping (exception_mapping_utils.py): adds ExceptionCheckers.is_error_str_context_window_exceeded to the Anthropic branch before the status-code gate, covering the "exceed context limit" phrasing that previously fell through. Consistent with how all other providers already use the same checker.
• Auth failure identity (auth_exception_handler.py, user_api_key_auth.py): threads the resolved UserAPIKeyAuth into _handle_authentication_error and seeds it onto the server span eagerly so failed traces carry litellm.team.id, litellm.team.alias, and gen_ai.request.model.
• OTEL span targeting (logger.py): seed_request_identity prefers the contextvar-anchored root span over get_current_span(), so identity lands on the server span even when called from inside the live auth phase span.

Confidence Score: 4/5

Safe to merge; changes are tightly scoped to error-handling paths and the only mutation concern is mitigated by the existing cache-copy layer.

Both fixes are narrowly targeted with clear regression tests. The auth exception handler mutates the passed-in resolved_identity object in-place — harmless today because the cache strips those transient fields before storing and both callers re-raise immediately — but the hidden side-effect is fragile if the function gains new callers that still hold a reference to the identity object.

litellm/proxy/auth/auth_exception_handler.py — the in-place mutation of resolved_identity is worth a second look before future extensions of _handle_authentication_error.

Important Files Changed

Filename	Overview
litellm/proxy/auth/auth_exception_handler.py	Threads resolved auth identity into the failure handler; seeds it onto the server span before rejecting the request. One design concern: the handler aliases and mutates the caller's resolved_identity object in-place rather than making a copy.
litellm/litellm_core_utils/exception_mapping_utils.py	Adds ExceptionCheckers.is_error_str_context_window_exceeded to the Anthropic branch before the status-code gate, so "exceed context limit" phrasing maps to ContextWindowExceededError regardless of whether the upstream exception carries a status_code. Consistent with how other providers already use the same checker.
litellm/integrations/otel/logger.py	Changes get_current_span() to request_root_span() or get_current_span() so identity is stamped on the server span even when seed_request_identity is called from inside the auth phase span. Guarded by is_recordable_span and falls back correctly when no root span is anchored.
litellm/proxy/auth/user_api_key_auth.py	Threads valid_token / user_api_key_auth_obj as resolved_identity into _handle_authentication_error at both call sites; minimal, targeted change.
tests/test_litellm/litellm_core_utils/test_exception_mapping_utils.py	Adds a parametrized regression test covering both Anthropic context-overflow phrasings ("prompt is too long" and "exceed context limit"), asserting ContextWindowExceededError with status 400. No real network calls.
tests/test_litellm/proxy/auth/test_auth_exception_handler.py	Adds two unit tests: one asserting the resolved identity (team/user/metadata) reaches the failure hook and seed_request_identity, and one asserting a graceful fallback when no identity is resolved. All mocked, no network calls.

_{Reviews (1): Last reviewed commit: "fix(auth): seed resolved identity onto t..." | Re-trigger Greptile}

[greptile-apps]

Silent in-place mutation of resolved_identity

user_api_key_dict = resolved_identity or UserAPIKeyAuth() aliases the caller's object, so the three subsequent field assignments mutate the original resolved_identity (e.g. valid_token in _user_api_key_auth_builder). This is currently safe because both callers sit inside except blocks where the handler always re-raises, and _copy_user_api_key_auth_for_cache strips parent_otel_span / request_route before caching. However, the side-effect is invisible from the signature and fragile for future callers. Using model_copy() makes the boundary explicit and eliminates the dependency on the cache layer's cleanup behaviour.

Suggested change

	user_api_key_dict = resolved_identity or UserAPIKeyAuth()
	user_api_key_dict.parent_otel_span = parent_otel_span
	user_api_key_dict.request_route = route
	user_api_key_dict.api_key = user_api_key_dict.api_key or api_key
	user_api_key_dict = (
	resolved_identity.model_copy() if resolved_identity is not None else UserAPIKeyAuth()
	)
	user_api_key_dict.parent_otel_span = parent_otel_span
	user_api_key_dict.request_route = route
	user_api_key_dict.api_key = user_api_key_dict.api_key or api_key

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

[veria-ai]

PR overview

All previously flagged issues have been addressed. No open security concerns remain on this pull request.

Security review

No open security issues remain on this pull request.

Fixed/addressed: 1 · PR risk: 0/10

[yassin-berriai]

verified 401 case with expired key