From a0bba43cea0cd88684902f1cf33b953554bb53a4 Mon Sep 17 00:00:00 2001 From: Ryan Crabbe Date: Fri, 24 Apr 2026 14:31:36 -0700 Subject: [PATCH] fix(jwt-auth): soft-fail unresolvable x-litellm-team-id for admins Previously, an admin JWT sending a stale/typo'd/missing x-litellm-team-id on an LLM API route received a hard 404 from get_team_object, blocking the request. Restore pre-PR admin behavior: if the header can't be resolved, skip team attribution and proceed with admin access, logging a warning with the header value and route so the misconfigured caller is diagnosable. --- litellm/proxy/auth/handle_jwt.py | 29 +++++++++++++++++++++-------- 1 file changed, 21 insertions(+), 8 deletions(-) diff --git a/litellm/proxy/auth/handle_jwt.py b/litellm/proxy/auth/handle_jwt.py index caebbe47e1..28fbe8a7dd 100644 --- a/litellm/proxy/auth/handle_jwt.py +++ b/litellm/proxy/auth/handle_jwt.py @@ -1427,14 +1427,27 @@ class JWTAuthManager: ) if not header_team_id or not RouteChecks.is_llm_api_route(route=route): return - team_object = await get_team_object( - team_id=header_team_id, - prisma_client=prisma_client, - user_api_key_cache=user_api_key_cache, - parent_otel_span=parent_otel_span, - proxy_logging_obj=proxy_logging_obj, - team_id_upsert=jwt_handler.litellm_jwtauth.team_id_upsert, - ) + try: + team_object = await get_team_object( + team_id=header_team_id, + prisma_client=prisma_client, + user_api_key_cache=user_api_key_cache, + parent_otel_span=parent_otel_span, + proxy_logging_obj=proxy_logging_obj, + team_id_upsert=jwt_handler.litellm_jwtauth.team_id_upsert, + ) + except Exception as e: + # Fall back to pre-PR admin behavior: honor the admin's + # authorization but skip team attribution/limits for this + # request. Log so operators can find the misconfigured caller. + verbose_proxy_logger.warning( + "admin x-litellm-team-id=%r on route=%s could not be resolved (%s); " + "proceeding with admin access, team context NOT attached.", + header_team_id, + route, + e, + ) + return admin_result["team_id"] = header_team_id admin_result["team_object"] = team_object