[Feat] Proxy CLI: Create a python method to login using litellm proxy (#14782)

* fix: cli auth with SSO okta

* fix: add LITTELM_CLI_SERVICE_ACCOUNT_NAME

* fix: get_litellm_cli_user_api_key_auth

* use existing_key CLI

* fix: use existing key

* test auth commands

* test_cli_sso_callback_regenerate_vs_create_flow

* feat: add CLI Token Utilities

* fix: get_stored_api_key

* move file

* fix: get_valid_models

* fix config.yaml

* TestCLITokenUtils

* TestGetValidModelsWithCLI

* fix: tie user id to keys created through CLI

* fix: add teams interface to CLI

* add /keys/update to the list client commands

* fix /sso/cli/poll to return the user_id

* fix: working TeamsManagementClient

* fix CLI Login command

* fixes for auth

* Potential fix for code scanning alert no. 3400: Clear-text logging of sensitive information

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

* ruff fix

---------

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Author: ishaan-jaff

cookbook/litellm_proxy_server/cli_token_usage.py

@@ -0,0 +1,62 @@
+#!/usr/bin/env python3
+"""
+Example: Using CLI token with LiteLLM SDK
+
+This example shows how to use the CLI authentication token
+in your Python scripts after running `litellm-proxy login`.
+"""
+
+from textwrap import indent
+import litellm
+LITELLM_BASE_URL = "http://localhost:4000/"
+
+
+def main():
+    """Using CLI token with LiteLLM SDK"""
+    print("🚀 Using CLI Token with LiteLLM SDK")
+    print("=" * 40)
+    #litellm._turn_on_debug()
+    
+    # Get the CLI token
+    api_key = litellm.get_litellm_gateway_api_key()
+    
+    if not api_key:
+        print("❌ No CLI token found. Please run 'litellm-proxy login' first.")
+        return
+    
+    print("✅ Found CLI token.")
+
+    available_models = litellm.get_valid_models(
+        check_provider_endpoint=True,
+        custom_llm_provider="litellm_proxy",
+        api_key=api_key,
+        api_base=LITELLM_BASE_URL
+    )
+    
+    print("✅ Available models:")
+    if available_models:
+        for i, model in enumerate(available_models, 1):
+            print(f"   {i:2d}. {model}")
+    else:
+        print("   No models available")
+    
+    # Use with LiteLLM
+    try:
+        response = litellm.completion(
+            model="litellm_proxy/gemini/gemini-2.5-flash",
+            messages=[{"role": "user", "content": "Hello from CLI token!"}],
+            api_key=api_key,
+            base_url=LITELLM_BASE_URL
+        )
+        print(f"✅ LLM Response: {response.model_dump_json(indent=4)}")
+    except Exception as e:
+        print(f"❌ Error: {e}")
+
+
+if __name__ == "__main__":
+    main()
+    
+    print("\n💡 Tips:")
+    print("1. Run 'litellm-proxy login' to authenticate first")
+    print("2. Replace 'https://your-proxy.com' with your actual proxy URL")
+    print("3. The token is stored locally at ~/.litellm/token.json")

enterprise/litellm_enterprise/integrations/prometheus.py

@@ -2328,7 +2328,6 @@ def get_custom_labels_from_tags(tags: List[str]) -> Dict[str, str]:
         "tag_Service_web_app_v1": "false",
     }
     """
-    import re
 
     from litellm.router_utils.pattern_match_deployments import PatternMatchRouter
     from litellm.types.integrations.prometheus import _sanitize_prometheus_label_name

enterprise/litellm_enterprise/proxy/management_endpoints/internal_user_endpoints.py

@@ -2,7 +2,6 @@
 Enterprise internal user management endpoints
 """
 
-import os
 
 from fastapi import APIRouter, Depends, HTTPException
 

enterprise/litellm_enterprise/proxy/vector_stores/endpoints.py

@@ -11,7 +11,7 @@
 import copy
 from typing import List, Optional
 
-from fastapi import APIRouter, Depends, HTTPException, Request, Response
+from fastapi import APIRouter, Depends, HTTPException
 
 import litellm
 from litellm._logging import verbose_proxy_logger

litellm/__init__.py

@@ -1343,5 +1343,8 @@ def add_known_models():
 )
 global_disable_no_log_param: bool = False
 
+### CLI UTILITIES ###
+from litellm.litellm_core_utils.cli_token_utils import get_litellm_gateway_api_key
+
 ### PASSTHROUGH ###
 from .passthrough import allm_passthrough_route, llm_passthrough_route

litellm/litellm_core_utils/cli_token_utils.py

@@ -0,0 +1,58 @@
+"""
+CLI Token Utilities
+
+SDK-level utilities for reading CLI authentication tokens.
+This module has no dependencies on proxy code and can be safely imported at the SDK level.
+"""
+
+import json
+import os
+from pathlib import Path
+from typing import Optional
+
+
+def get_cli_token_file_path() -> str:
+    """Get the path to the CLI token file"""
+    home_dir = Path.home()
+    config_dir = home_dir / ".litellm"
+    return str(config_dir / "token.json")
+
+
+def load_cli_token() -> Optional[dict]:
+    """Load CLI token data from file"""
+    token_file = get_cli_token_file_path()
+    if not os.path.exists(token_file):
+        return None
+    
+    try:
+        with open(token_file, 'r') as f:
+            return json.load(f)
+    except (json.JSONDecodeError, IOError):
+        return None
+
+
+def get_litellm_gateway_api_key() -> Optional[str]:
+    """
+    Get the stored CLI API key for use with LiteLLM SDK.
+    
+    This function reads the token file created by `litellm-proxy login`
+    and returns the API key for use in Python scripts.
+    
+    Returns:
+        str: The API key if found, None otherwise
+        
+    Example:
+        >>> import litellm
+        >>> api_key = litellm.get_litellm_gateway_api_key()
+        >>> if api_key:
+        >>>     response = litellm.completion(
+        >>>         model="gpt-3.5-turbo",
+        >>>         messages=[{"role": "user", "content": "Hello"}],
+        >>>         api_key=api_key,
+        >>>         base_url="https://your-proxy.com/v1"
+        >>>     )
+    """
+    token_data = load_cli_token()
+    if token_data and 'key' in token_data:
+        return token_data['key']
+    return None