Re-add claude-subscription LiteLLM route — confirmed working for the real CLI #13

2026-08-23T16:08:48Z

claude-bot commented

2026-08-23 16:08:48 +00:00

Details in the commit message. Corrects an earlier wrong conclusion in this repo history.

claude-bot added 1 commit 2026-08-23 16:08:48 +00:00

Re-add the claude-subscription LiteLLM route — confirmed working for the real CLI f4f785e0bb

Earlier this session I removed this route after a curl-based test got
rejected by Anthropic and concluded OAuth subscription forwarding doesn't
work through a proxy at all. That conclusion was wrong: the real `claude`
CLI binary, with ANTHROPIC_BASE_URL pointed at litellm, successfully
completed a request billed against the subscription. The earlier curl test
just didn't replicate whatever header/fingerprint Anthropic requires from
genuine Claude Code CLI traffic — LiteLLM relays that fine when the real
CLI is the caller, but a hand-built request from any other client (Hermes
included) still gets rejected the same way curl did.

william merged commit fff021283d into main

2026-08-23 16:09:47 +00:00

claude-bot commented

2026-08-23 16:12:07 +00:00

Both findings check out against the actual diff and repo state. Here's the review:

Correctness bugs

1. forward_client_headers_to_llm_api: true is set globally, affecting unrelated routes (litellm-config.yaml:28)

This flag is under general_settings, so it applies to all model routes, not just the new anthropic-claude one. claude-agent authenticates to litellm with Authorization: Bearer $LITELLM_MASTER_KEY for every call (per docker-compose.yml). Per LiteLLM's docs, this setting forwards the client's incoming Authorization header straight through to the upstream provider. That means the auto and router-classifier routes — both backed by OpenRouter with their own api_key: os.environ/OPENROUTER_API_KEY — will now also have the LiteLLM master key forwarded to OpenRouter as the bearer token. Best case this is ignored; worst case it either breaks those routes (OpenRouter rejects the bogus token) or leaks the master key to a third-party provider on every unrelated request.

Fix: scope header-forwarding to just the anthropic-claude model (litellm supports per-model model_group_settings / header_forward config) rather than setting it globally.

Minor / doc consistency

2. Stale "claude-subscription route" comment in docker-compose.yml:119

Not touched by this PR, but now inconsistent with it: the new route is named anthropic-claude in litellm-config.yaml, not claude-subscription. Worth a one-line fix while you're in this area so future readers aren't hunting for a route name that doesn't exist.

No other issues — the change itself (adding the anthropic-claude model entry) is small and matches the commit message's description of what was tested.

Both findings check out against the actual diff and repo state. Here's the review: ## Correctness bugs **1. `forward_client_headers_to_llm_api: true` is set globally, affecting unrelated routes** (`litellm-config.yaml:28`) This flag is under `general_settings`, so it applies to *all* model routes, not just the new `anthropic-claude` one. `claude-agent` authenticates to litellm with `Authorization: Bearer $LITELLM_MASTER_KEY` for every call (per `docker-compose.yml`). Per LiteLLM's docs, this setting forwards the client's incoming `Authorization` header straight through to the upstream provider. That means the `auto` and `router-classifier` routes — both backed by OpenRouter with their own `api_key: os.environ/OPENROUTER_API_KEY` — will now also have the LiteLLM master key forwarded to OpenRouter as the bearer token. Best case this is ignored; worst case it either breaks those routes (OpenRouter rejects the bogus token) or leaks the master key to a third-party provider on every unrelated request. Fix: scope header-forwarding to just the `anthropic-claude` model (litellm supports per-model `model_group_settings` / `header_forward` config) rather than setting it globally. ## Minor / doc consistency **2. Stale "claude-subscription route" comment in `docker-compose.yml:119`** Not touched by this PR, but now inconsistent with it: the new route is named `anthropic-claude` in `litellm-config.yaml`, not `claude-subscription`. Worth a one-line fix while you're in this area so future readers aren't hunting for a route name that doesn't exist. No other issues — the change itself (adding the `anthropic-claude` model entry) is small and matches the commit message's description of what was tested.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: william/gitops-automation#13