fix(proxy): add realtime WebRTC HTTP sub-routes to openai_routes to unblock non-admin keys

[VANDRANKI]

Description

Fixes #29923

The realtime WebRTC HTTP routes /realtime/client_secrets and /realtime/calls (and their /v1/ and /openai/v1/ prefixed variants) are registered in realtime_endpoints/endpoints.py but were absent from LiteLLMRoutes.openai_routes in _types.py.

As a result, is_llm_api_route() returned False for these paths, and any non-admin virtual key (e.g. role=internal_user_viewer) was blocked with 401 instead of being treated as a standard LLM API call:

401 Only proxy admin can be used to generate, delete, update info for new keys/users/teams.
Route=/v1/realtime/client_secrets. Your role=internal_user_viewer

Fix

Add the six missing paths to LiteLLMRoutes.openai_routes, mirroring how the WebSocket /realtime paths were added via PR #27323:

"/realtime/client_secrets",
"/v1/realtime/client_secrets",
"/openai/v1/realtime/client_secrets",
"/realtime/calls",
"/v1/realtime/calls",
"/openai/v1/realtime/calls",

File changed

• litellm/proxy/_types.py — 6 routes added to LiteLLMRoutes.openai_routes

Type of change

• Bug fix (non-breaking change that fixes an issue)

Checklist

• All three URL prefix variants added for each route (/, /v1/, /openai/v1/)
• Routes match exactly what is registered in realtime_endpoints/endpoints.py

[codspeed-hq]

Merging this PR will not alter performance

✅ 16 untouched benchmarks

---

_{Comparing VANDRANKI:fix/add-realtime-webrtc-routes-to-openai-routes (f8f6494) with main (9608dd5)}

[greptile-apps]

Greptile Summary

Registers the six WebRTC HTTP sub-routes (/realtime/client_secrets and /realtime/calls, plus their /v1/ and /openai/v1/ prefixed variants) in LiteLLMRoutes.openai_routes so that is_llm_api_route() returns True for them, unblocking non-admin virtual keys that were receiving a 401.

• Adds /realtime/client_secrets, /v1/realtime/client_secrets, /openai/v1/realtime/client_secrets to mirror how the existing WebSocket /realtime paths were registered.
• Adds the same three prefix variants for /realtime/calls, which uses its own ephemeral-token auth (no Depends(user_api_key_auth)) and was therefore missing from the standard route list for the same reason.

Confidence Score: 4/5

Safe to merge; the change is a targeted list addition with no logic changes and the routes correctly mirror the endpoint registrations in endpoints.py

The fix is minimal and correct — the six strings added match exactly what is registered in realtime_endpoints/endpoints.py, and the auth model for each endpoint is unchanged. The only gap is that no test verifies these routes appear in openai_routes, so a future accidental removal would not be caught automatically.

litellm/proxy/_types.py is the only changed file; a corresponding test in tests/test_litellm/proxy/auth/test_route_checks.py would be worth adding

Important Files Changed

Filename	Overview
litellm/proxy/_types.py	Adds 6 missing WebRTC HTTP sub-routes to LiteLLMRoutes.openai_routes, unblocking non-admin virtual keys from accessing /realtime/client_secrets and /realtime/calls

_{Reviews (1): Last reviewed commit: "fix(proxy): add realtime WebRTC HTTP sub..." | Re-trigger Greptile}

[greptile-apps]

No test coverage for route registration fix

The PR adds these routes to fix a 401 regression, but there are no tests asserting that is_llm_api_route() (or equivalently, that these paths appear in LiteLLMRoutes.openai_routes) returns True for the new paths. tests/test_litellm/proxy/auth/test_route_checks.py exists and would be the natural home for parameterized assertions like assert RouteChecks.is_llm_api_route("/v1/realtime/client_secrets") is True. Without such a test the regression can silently revert if a future refactor inadvertently removes these entries.

Rule Used: What: Ensure that any PR claiming to fix an issue ... (source)

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[krrish-berri-2]

@VANDRANKI — could you add a screenshot or short video showing that this change works as expected (e.g. a non-admin key successfully hitting /v1/realtime/client_secrets after this fix vs. the 401 before)? It really helps reviewers verify the fix quickly. Thanks!