6 views
-/https://github.com/berriai/litellm/issues/28607
GitHub · issue

#28607 [Feature]: Support Anthropic Workload Identity Federation (OIDC JWT-bearer token exchange)

  • State: open
  • Author: @6matt
  • Labels: llm translation, SDK

### Check for existing issues

- [x] I have searched the existing issues and checked that my issue is not a duplicate.

### The Feature

Add support for [Anthropic Workload Identity Federation](https://platform.claude.com/docs/en/manage-claude/workload-identity-federation) as an authentication method for the Anthropic provider, alongside the existing static `ANTHROPIC_API_KEY` flow.

Anthropic recently shipped WIF for the Claude API. Instead of a long-lived `sk-ant-...` key, workloads present an OIDC JWT (from AWS IAM, GCP, Azure, GitHub Actions, Kubernetes, SPIFFE, Okta, etc.) and exchange it for a short-lived `sk-ant-oat01-...` access token. The official Anthropic SDKs (Python, TypeScript, Go, Java, C#, PHP, Ruby) already support this.

Concretely, LiteLLM would need to:

1. **Token exchange.** Implement the RFC 7523 `urn:ietf:params:oauth:grant-type:jwt-bearer` exchange against `POST https://api.anthropic.com/v1/oauth/token`, sending: - `assertion` — JWT read from `ANTHROPIC_IDENTITY_TOKEN_FILE` (re-read on each exchange to pick up rotated projected tokens) - `federation_rule_id` (`fdrl_...`) - `organization_id` - `service_account_id` (`svac_...`) - `workspace_id`…

Open on GitHub

GitHub resolver

Import GitHub neighbors on demand. Results are saved as system ingests.

Refresh page
vote history (3 events)
#0 of 0 · 31d18h43m28s ago — entered · #import:https:::github.com:berriai:litellm post #2158
-/https://github.com/berriai/litellm/issues/28607⭐5:1-/https://github.com/berriai/litellm/issues/31934
The left issue is harder because it introduces a new external authentication and token-lifecycle integration, including secure credential handling, refresh behavior, provider plumbing, compatibility coverage, and broader testing. The right issue is comparatively localized to correcting reset-period date calculations and validating alerting behavior.
#0 of 0 · 31d18h29m17s ago · #import:https:::github.com:berriai:litellm post #2391
-/https://github.com/berriai/litellm/issues/28607⭐5:1-/https://github.com/berriai/litellm/issues/19856
The right-hand change has substantially broader scope: it introduces a new credential-exchange lifecycle, secure token rotation and caching, provider configuration, cross-environment compatibility, and extensive integration testing. The left-hand change is comparatively localized to request routing and authentication state handling.
#0 of 0 · 31d18h19m25s ago — current · #import:https:::github.com:berriai:litellm post #2534
-/https://github.com/berriai/litellm/issues/28607⭐6:1-/https://github.com/berriai/litellm/issues/27294
The right-side change requires a new external authentication flow, secure credential exchange, token lifecycle and refresh handling, provider integration, configuration, compatibility testing, and likely broader SDK/proxy coverage. The left-side change is a localized authorization-pipeline correction with focused regression tests and a narrower risk surface.
discussed in #import:https:::github.com:berriai:litellm

ranked child groups

no voted pairs yet in this scope

cli
src
spread
search