PR #26690: [Fix] UI - Allow Proxy Admin Viewer to access /api-keys page

• Repository: BerriAI/litellm
• Author: kimsehwan96
• State: open | merged: False
• Link: https://github.com/BerriAI/litellm/pull/26690

Description (problem / solution / changelog)

Relevant issues

Fixes #26689

Linear ticket

<!-- if you are an internal contributor, add the Linear ticket e.g. "Resolves LIT-1234" to magically link the Linear ticket to the GitHub PR -->

Pre-Submission checklist

Please complete all items before asking a LiteLLM maintainer to review your PR

• I have Added testing in the tests/test_litellm/ directory, Adding at least 1 test is a hard requirement - see details
• My PR passes all unit tests on make test-unit
• My PR's scope is as isolated as possible, it only solves 1 specific problem
• I have requested a Greptile review by commenting @greptileai and received a Confidence Score of at least 4/5 before requesting a maintainer review

Delays in PR merge?

If you're seeing a delay in your PR being merged, ping the LiteLLM Team on Slack (#pr-review).

CI (LiteLLM team)

CI status guideline:

• 50-55 passing tests: main is stable with minor issues.
• 45-49 passing tests: acceptable but needs attention
• <= 40 passing tests: unstable; be careful with your merges and assess the risk.

• Branch creation CI run
  Link:

• CI run for the last commit
  Link:

• Merge / cherry-pick CI run
  Links:

Screenshots / Proof of Fix

AS-IS

<img width="1267" height="888" alt="스크린샷 2026-04-28 오후 8 23 16" src="https://github.com/user-attachments/assets/33337057-a525-4e83-8e57-970b5c36f4c9" />

TO-BE

<img width="1267" height="888" alt="스크린샷 2026-04-28 오후 8 09 41" src="https://github.com/user-attachments/assets/791a7d7c-481a-457f-8712-9fd2e5ee7358" />

Type

🐛 Bug Fix

Changes

Remove the entry-level "Access Denied" gate in ui/litellm-dashboard/src/components/user_dashboard.tsx that was hard-blocking proxy_admin_viewer from /ui/?page=api-keys.

The backend (admin_viewer_routes, route_checks, key handler) already allows /key/list and /key/info for this role, and component-level guards (rolesWithWriteAccess in ui/litellm-dashboard/src/utils/roles.ts) already hide Create / Edit / Delete affordances — so the gate was redundant and inconsistent with the role's documented intent.

There's a useEffect that was forcing page to "usage" for Admin Viewer right after JWT decode, so even if you went to /ui?page=api-keys it would silently rewrite the URL.

That was probably a workaround for the Access Denied screen (push viewers somewhere they can actually see something).

Now that the gate is gone, viewers can stay on the keys page in read-only mode, so the redirect isn't needed anymore. also the e2e below would fail without removing it.

Tests

• vitest: UserDashboard renders the keys table for both Admin Viewer and proxy_admin (no Access Denied screen).
• e2e:
  • as proxy_admin_viewer, /ui?page=api-keys shows the keys table, other users' seeded keys are visible (admin scope), and the Create New Key button is hidden
  • clicking into a key detail view works, but Regenerate Key / Delete Key / Edit Settings buttons are hidden.

Changed files

• ui/litellm-dashboard/e2e_tests/tests/proxy-admin-viewer/api-keys-access.spec.ts (added, +45/-0)
• ui/litellm-dashboard/src/app/page.tsx (modified, +0/-3)
• ui/litellm-dashboard/src/components/user_dashboard.test.tsx (modified, +22/-1)
• ui/litellm-dashboard/src/components/user_dashboard.tsx (modified, +0/-10)