Issue Station
Sign In
Tools hereToolbox

litellm - 💡(How to fix) Fix [Bug]: passthrough endpoints where the registered endpoints work for admin users but not normal users. [1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
BerriAI/litellm#23915•Fetched 2026-04-08 00:53:51
View on GitHub
Comments
0
Participants
1
Timeline
3
Reactions
0
Author
shivamrawat1shivamrawat1
Participants
shivamrawat1shivamrawat1
Timeline (top)
labeled ×3

Error Message

We then the error "error": { "message": "Authentication Error, Only proxy admin can be used to generate, delete, update info for new keys/users/teams. Route=/v1/ocr/company/community/nemoretriever-ocr-v1/v1/infer. Your role=unknown. Your user_id=unknown", "error": { "message": "Authentication Error, Only proxy admin can be used to generate, delete, update info for new keys/users/teams. Route=/v1/ocr/company/community/nemoretriever-ocr-v1/v1/infer. Your role=unknown. Your user_id=unknown", Expected: 200 (or whatever httpbin returns), not the auth error.

Code Example

- path: "/v1/ocr/company/community/nemoretriever-ocr-v1"
  target: "https://HOST_NAME"
  include_subpath: true
  auth: true
  headers:
    authorization: "Bearer os.environ/NVDEV_API_KEY"
    content-type: "application/json"
  forward_headers: true

---

model_list:
  - model_name: gpt-4o
    litellm_params:
      model: openai/gpt-4o
      api_key: os.environ/OPENAI_API_KEY
general_settings:
  master_key: sk-1234
  pass_through_endpoints:
    - path: "/v1/ocr/company/community/nemoretriever-ocr-v1"
      target: "https://httpbin.org/post"
      include_subpath: true
      auth: true
      headers:
        content-type: "application/json"
      forward_headers: true

---

cd /Users/shivamrawat/litellm
poetry run litellm --config repro_config.yaml --port 4000
Wait until /health returns (about 15–20 seconds if migrations run).

---

curl -X POST "http://localhost:4000/user/new" \
  -H "Authorization: Bearer sk-1234" \
  -H "Content-Type: application/json" \
  -d '{"user_id": "test-user-1", "user_email": "[email protected]", "user_role": "internal_user"}'

---

curl -X POST "http://localhost:4000/key/generate" \
  -H "Authorization: Bearer sk-1234" \
  -H "Content-Type: application/json" \
  -d '{"user_id": "test-user-1"}'

---

curl -X POST "http://localhost:4000/v1/ocr/company/community/nemoretriever-ocr-v1/v1/infer" \
  -H "Authorization: Bearer <NON_ADMIN_KEY>" \
  -H "Content-Type: application/json" \
  -d '{"input": [{"type": "image_url", "url": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg=="}]}'
Expected: 401 with:
{
  "error": {
    "message": "Authentication Error, Only proxy admin can be used to generate, delete, update info for new keys/users/teams. Route=/v1/ocr/company/community/nemoretriever-ocr-v1/v1/infer. Your role=unknown. Your user_id=unknown",
    ...
  }
}

---

curl -X POST "http://localhost:4000/v1/ocr/company/community/nemoretriever-ocr-v1/v1/infer" \
  -H "Authorization: Bearer sk-1234" \
  -H "Content-Type: application/json" \
  -d '{"input": [{"type": "image_url", "url": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg=="}]}'

---

na
RAW_BUFFERClick to expand / collapse

Check for existing issues

  • I have searched the existing issues and checked that my issue is not a duplicate.

What happened?

We then the error { "error": { "message": "Authentication Error, Only proxy admin can be used to generate, delete, update info for new keys/users/teams. Route=/v1/ocr/company/community/nemoretriever-ocr-v1/v1/infer. Your role=unknown. Your user_id=unknown", "type": "auth_error", "param": "None", "code": "401" } } when trying to access the below passthrough endpoint with a proxy admin key

- path: "/v1/ocr/company/community/nemoretriever-ocr-v1"
  target: "https://HOST_NAME"
  include_subpath: true
  auth: true
  headers:
    authorization: "Bearer os.environ/NVDEV_API_KEY"
    content-type: "application/json"
  forward_headers: true

``

Steps to Reproduce

  1. Config with passthrough + auth

Create a config file (e.g. repro_config.yaml):

model_list:
  - model_name: gpt-4o
    litellm_params:
      model: openai/gpt-4o
      api_key: os.environ/OPENAI_API_KEY
general_settings:
  master_key: sk-1234
  pass_through_endpoints:
    - path: "/v1/ocr/company/community/nemoretriever-ocr-v1"
      target: "https://httpbin.org/post"
      include_subpath: true
      auth: true
      headers:
        content-type: "application/json"
      forward_headers: true

Important: auth: true is required so the route goes through auth and hits the failing check.

  1. Start the proxy
cd /Users/shivamrawat/litellm
poetry run litellm --config repro_config.yaml --port 4000
Wait until /health returns (about 15–20 seconds if migrations run).
  1. Create a non-admin user and key

Using the master key as admin:

# Create a non-admin user

curl -X POST "http://localhost:4000/user/new" \
  -H "Authorization: Bearer sk-1234" \
  -H "Content-Type: application/json" \
  -d '{"user_id": "test-user-1", "user_email": "[email protected]", "user_role": "internal_user"}'

# Create a key for that user


curl -X POST "http://localhost:4000/key/generate" \
  -H "Authorization: Bearer sk-1234" \
  -H "Content-Type: application/json" \
  -d '{"user_id": "test-user-1"}'

Save the token from the key response (e.g. sk-xxxx).

  1. Reproduce the failure (non-admin key)

# Use the non-admin key from step 3

curl -X POST "http://localhost:4000/v1/ocr/company/community/nemoretriever-ocr-v1/v1/infer" \
  -H "Authorization: Bearer <NON_ADMIN_KEY>" \
  -H "Content-Type: application/json" \
  -d '{"input": [{"type": "image_url", "url": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg=="}]}'
Expected: 401 with:
{
  "error": {
    "message": "Authentication Error, Only proxy admin can be used to generate, delete, update info for new keys/users/teams. Route=/v1/ocr/company/community/nemoretriever-ocr-v1/v1/infer. Your role=unknown. Your user_id=unknown",
    ...
  }
}
  1. Confirm success with master key (admin)
curl -X POST "http://localhost:4000/v1/ocr/company/community/nemoretriever-ocr-v1/v1/infer" \
  -H "Authorization: Bearer sk-1234" \
  -H "Content-Type: application/json" \
  -d '{"input": [{"type": "image_url", "url": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg=="}]}'

Expected: 200 (or whatever httpbin returns), not the auth error.

Relevant log output

na

What part of LiteLLM is this about?

Proxy

What LiteLLM version are you on ?

v1.82.0

Twitter / LinkedIn details

No response

extent analysis

Fix Plan

To resolve the authentication issue, we need to modify the authentication logic to correctly identify and authorize admin users.

Here are the steps to fix the issue:

  • Update the auth logic to check for admin roles.
  • Modify the repro_config.yaml to include the correct admin key.

Code Changes

# Update auth logic to check for admin roles
if user_role == "admin" or user_role == "proxy_admin":
    # Allow access to protected routes
    pass
else:
    # Return 401 error for non-admin users
    return {"error": "Authentication Error, Only proxy admin can be used to generate, delete, update info for new keys/users/teams."}, 401

Configuration Changes

# Update repro_config.yaml to include the correct admin key
general_settings:
  master_key: sk-1234
  pass_through_endpoints:
    - path: "/v1/ocr/company/community/nemoretriever-ocr-v1"
      target: "https://httpbin.org/post"
      include_subpath: true
      auth: true
      headers:
        content-type: "application/json"
        authorization: "Bearer sk-1234"  # Use the master key as the admin key
      forward_headers: true

Verification

To verify the fix, repeat the steps to reproduce the issue and check that:

  • Using a non-admin key returns a 401 error.
  • Using the master key (admin) returns a 200 response.

Extra Tips

  • Ensure that the auth logic is correctly implemented and tested.
  • Review the repro_config.yaml file to ensure that the correct admin key is used.
  • Consider adding additional logging to help diagnose authentication issues.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#api#ssr#installation#tensor shape#autograd error

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING