fix(auth): scope the JWT enterprise gate to actual JWTs

[mubashir1osmani]

Relevant issues

Linear ticket

Pre-Submission checklist

Please complete all items before asking a LiteLLM maintainer to review your PR

• I have added meaningful tests
• My PR passes all CI/CD checks (e.g., lint, format, unit tests)
• My PR's scope is as isolated as possible; it only solves 1 specific problem
• I have received a Greptile Confidence Score of at least 4/5 before requesting a maintainer review (Greptile reviews automatically once the PR is opened; only comment @greptileai to re-request a review after pushing changes)

Screenshots / Proof of Fix

Config for all runs (the failing setup a customer hits): general_settings.enable_jwt_auth: True with no LITELLM_LICENSE, so premium_user resolves to False. The CLI session token below is the exact blob lite login stores (minted server-side with ExperimentalUIJWTToken.get_cli_jwt_auth_token, since the browser SSO step is not scriptable); it is not a JWT, it is an encrypted UserAPIKeyAuth session token.

Before the fix (working tree at the pre-fix state, same as litellm_internal_staging for these lines). The JWT enterprise gate fires for every credential, so even the master key 401s and the token is never decoded:

$ curl -s -X POST http://localhost:4000/team/new -H "Authorization: Bearer sk-1234" -d '{"team_alias":"x"}'
{"error":{"message":"Authentication Error, JWT Auth is an enterprise only feature. You must be a LiteLLM Enterprise user to use this feature...","type":"auth_error","code":"401"}}

After the fix (commit a3d8de40b3). Non-JWT credentials authenticate; a real JWT is still rejected:

# master key
$ curl -s -o /dev/null -w "%{http_code}\n" http://localhost:4000/models -H "Authorization: Bearer sk-1234"
200

# lite login session token -> real Anthropic call
$ curl -s -w "\nHTTP %{http_code}\n" -X POST http://localhost:4000/chat/completions \
    -H "Authorization: Bearer <cli-session-token>" -H "Content-Type: application/json" \
    -d '{"model":"claude-haiku-4-5","messages":[{"role":"user","content":"say ok"}]}'
{ ... "usage":{"completion_tokens":24,"prompt_tokens":8,"total_tokens":32}, ... }
HTTP 200

# an actual JWT (header.payload.sig) is STILL gated -> enterprise feature unchanged
$ curl -s -w "\nHTTP %{http_code}\n" -X POST http://localhost:4000/chat/completions \
    -H "Authorization: Bearer eyJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJ1c2VyMSJ9.sig" -H "Content-Type: application/json" \
    -d '{"model":"claude-haiku-4-5","messages":[{"role":"user","content":"hi"}]}'
{"error":{"message":"...JWT Auth is an enterprise only feature...","type":"auth_error","code":"401"}}
HTTP 401

The non-admin (internal_user) session token was verified the same way and also returns 200 with a real Anthropic response, with spend attributed to its user_id / team_id.

Type

🐛 Bug Fix

Changes

enable_jwt_auth is an enterprise feature, so when it is on and the deployment is not licensed (premium_user is False), the builder raised "JWT Auth is an enterprise only feature" for the request. The check ran before the token type was known, so it rejected every credential, including the proxy master key, sk- virtual keys, and the encrypted CLI/UI SSO session token that lite login issues. The token was never decoded, and lite login plus lite claude (whose pre-launch /v1/models probe hits the same path) failed with a 401 on any deployment that turned JWT auth on without a license.

The fix moves the premium check inside the is_jwt branch in _user_api_key_auth_builder, so it gates only actual JWTs. Non-JWT credentials fall through to their existing auth paths (master key, virtual-key lookup, session-token decrypt) regardless of license, while a real JWT under a non-premium deployment is still rejected, so the enterprise gate is unchanged for the feature it protects. is_jwt is a pure structural check (len(token.split(".")) == 3), so the encrypted session blob never enters the JWT path.

Regression coverage in test_user_api_key_auth.py: test_cli_session_token_authenticates_when_jwt_auth_enabled_without_license fails on the old ordering and passes now, and test_real_jwt_still_requires_license_when_jwt_auth_enabled locks in that a genuine JWT is still gated.

Final Attestation

• The tests check the right things, including the edge cases, and regressions in the respective real-world customer use-cases are not possible after this PR

[greptile-apps]

Greptile Summary

This PR fixes a scoping bug in the JWT enterprise gate: the premium_user check was running for every credential (including master key, virtual keys, and CLI session tokens) whenever enable_jwt_auth was set, causing all non-licensed deployments to 401 on every request regardless of token type. The fix moves the check inside the is_jwt branch so it only fires for tokens that structurally resemble a JWT (header.payload.signature).

• user_api_key_auth.py: three lines reordered — is_jwt = jwt_handler.is_jwt(token=api_key) is evaluated first, and the premium_user check is now nested inside if is_jwt:, leaving non-JWT credentials to fall through to their existing auth paths unchanged.
• test_user_api_key_auth.py: two new pure-mock regression tests added — one that fails on the old ordering (CLI session token should authenticate with enable_jwt_auth=True and no license) and one that confirms a structurally valid JWT is still gated by the enterprise check.

Confidence Score: 5/5

Safe to merge — the change is a two-line reorder in the auth builder, the enterprise gate for real JWTs is preserved, and the existing non-JWT auth paths are unaffected.

The diff is minimal and surgical: only the relative ordering of the is_jwt classification and the premium_user guard changes. The is_jwt heuristic was already in use at line 1164 for OAuth2 routing decisions before this PR, so no new trust is placed in it. Both new tests are pure-mock, match the patching conventions used throughout the file, and directly exercise the before/after behavior described in the PR description.

No files require special attention.

Important Files Changed

Filename	Overview
litellm/proxy/auth/user_api_key_auth.py	Moves the premium_user enterprise gate inside the is_jwt branch so non-JWT credentials (master key, virtual keys, CLI session tokens) are no longer rejected when enable_jwt_auth is enabled without a license. Change is minimal and correct.
tests/test_litellm/proxy/auth/test_user_api_key_auth.py	Adds two new mock-only tests: one verifying a CLI session token (non-JWT) bypasses the JWT enterprise gate, and one verifying a real JWT is still rejected without a license. Both tests correctly patch proxy_server globals and make no real network calls.

_{Reviews (1): Last reviewed commit: "fix(auth): scope the JWT enterprise gate..." | Re-trigger Greptile}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[codspeed-hq]

Merging this PR will not alter performance

✅ 31 untouched benchmarks

---

_{Comparing litellm_jwt_enterprise_gate_fix (a3d8de4) with litellm_internal_staging (668df94)}

[ryan-crabbe-berri]

lgtm