I wanted to hand out different gateway keys to different clients: to see who spent how much, and to revoke access one at a time rather than all at once.
The stock way in LiteLLM is to stand up Postgres for that. A database just for keys on a single laptop looked like overkill, so I went through a custom auth function instead.
I stumbled on something non-obvious: in the pinned version this function replaces the built-in check entirely. There is no fallback to the master key inside it. So if you write it naively, "I check my keys and hand the rest to the gateway", the master key stops working and the admin endpoints fall off. I learned this not from the docs but from the source of that tag.
The fix: my function checks both the client keys and the master key, reading the latter straight from the environment.
The price: I am tied to the behaviour of one specific gateway version, and on every upgrade this is the first thing to re-check.
Top comments (0)