litellm - 💡(How to fix) Fix Track when requests use forwarded client auth headers in spend logs [1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
BerriAI/litellm#23755Fetched 2026-04-08 00:49:21
View on GitHub
Comments
0
Participants
1
Timeline
1
Reactions
0
Participants
Timeline (top)
labeled ×1
RAW_BUFFERClick to expand / collapse

Feature Request

Motivation

When using forward_client_headers_to_llm_api with Anthropic OAuth (spend tokens), the cost of the LLM call is billed to the client's Anthropic account, not to the API key configured on the LiteLLM proxy. However, there is currently no way to distinguish these requests in the spend logs or database — they look identical to requests where LiteLLM's own API key was charged.

This makes it impossible to reconcile costs: without this signal, operators can't tell which spend log entries represent real costs against their LiteLLM API key vs. costs that were allocated to an end-user's Anthropic account.

Current Behavior

  • forward_client_headers_to_llm_api forwards x-* and anthropic-beta headers to the LLM provider, but no record of this is stored in spend logs.
  • StandardLoggingMetadata has requester_custom_headers (enterprise, populated for observability integrations), but SpendLogsMetadata does not — so this data never reaches the DB.
  • The Authorization header (which carries the OAuth Bearer token) is not in the forwarded set anyway, so even requester_custom_headers wouldn't capture it.

Desired Behavior

Spend logs should include enough information to determine that a request used client-forwarded auth headers, so operators can identify requests where costs were billed to the client's account rather than the proxy's API key. For example:

  • A flag or field in SpendLogsMetadata indicating that forward_client_headers_to_llm_api was active for the request
  • Or propagating requester_custom_headers into SpendLogsMetadata so it reaches the DB

Use Case

Operator runs LiteLLM proxy with forward_client_headers_to_llm_api enabled for certain model groups. Some users authenticate with their own Anthropic OAuth tokens (spend tokens). The operator needs to filter spend logs to separate:

  1. Requests billed to the proxy's Anthropic API key (real cost to operator)
  2. Requests billed to the end-user's Anthropic account via forwarded auth (no cost to operator)

extent analysis

Fix Plan

To address the issue, we need to modify the SpendLogsMetadata to include a flag indicating whether forward_client_headers_to_llm_api was active for the request. Here are the steps:

  • Add a new field client_auth_forwarded to SpendLogsMetadata:

class SpendLogsMetadata: # existing fields... client_auth_forwarded: bool = False

* Update the logging logic to set `client_auth_forwarded` to `True` when `forward_client_headers_to_llm_api` is enabled:
  ```python
if forward_client_headers_to_llm_api:
    spend_logs_metadata.client_auth_forwarded = True
  • Alternatively, propagate requester_custom_headers into SpendLogsMetadata:

class SpendLogsMetadata: # existing fields... requester_custom_headers: dict = {}

...

spend_logs_metadata.requester_custom_headers = requester_custom_headers

### Verification
To verify the fix, check the spend logs for the new `client_auth_forwarded` field or the presence of `requester_custom_headers`. You can use a test case with `forward_client_headers_to_llm_api` enabled and verify that the corresponding spend log entry contains the expected information.

### Extra Tips
* Make sure to update the database schema to accommodate the new field in `SpendLogsMetadata`.
* Consider adding additional logging or monitoring to track the usage of `forward_client_headers_to_llm_api` and the resulting spend logs.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

litellm - 💡(How to fix) Fix Track when requests use forwarded client auth headers in spend logs [1 participants]