Authentication

Authentication identifies the user or application calling LiteLLM or signing in to the Admin UI.

Configure what that identity can use and manage in Access Management.

Choose a flow

Flow	When to use it	Guides
Virtual Keys	Call the gateway with a LiteLLM credential.	Use a Virtual Key
Single sign-on	Sign in with your organization's identity provider.	OIDC, SAML
Identity mapping	Connect an identity provider's token to a LiteLLM identity.	Users and teams, Virtual Keys
ID-JAG	Let an application act on a signed-in user's behalf across services.	ID-JAG
Custom Auth	Authenticate callers with your own handler.	Custom Auth
Client certificates	Require a client certificate at your ingress, then authorize the request with a LiteLLM key.	Client Authentication with mTLS

Use an Identity-Aware Proxy to check employee or workload identity before traffic reaches LiteLLM. LiteLLM then applies its own authentication and permissions.

Single sign-on

Use OpenID Connect (OIDC), the identity layer built on OAuth 2.0, to sign in to the Admin UI. SAML is an alternative when your organization uses SAML for sign-in.

Identity mapping

Applications can send an identity provider's JWT directly to LiteLLM. LiteLLM verifies the token, then maps its claims to users and teams or an existing Virtual Key.

For machine-to-machine requests, map the claims that identify the application or workload.

Delegated identity

ID-JAG connects applications acting on a signed-in user's behalf. Use it when another application needs to call LiteLLM for that user, or when LiteLLM needs to call an MCP server for them.

The identity provider and the target service's authorization server must support ID-JAG.