---
title: "Plugin Auth Token"
method: GET
path: "/api/plugins/auth-token"
tags: ["plugins"]
---

# Plugin Auth Token

`GET /api/plugins/auth-token`

Issue a short-lived, audience-scoped plugin session claim.

The claim contains {user_id, user_role, plugin, exp}.  It does NOT
contain the caller's litellm bearer token — a compromised plugin can
only learn the caller's identity, not impersonate them against the proxy.

Encrypted with a key derived from HMAC(LITELLM_SALT_KEY, plugin_name),
so each plugin holds only its own key and cannot forge claims for others.

Requires LITELLM_SALT_KEY to be set; returns 503 otherwise.

## Query parameters

- `plugin_name` string

## Response `200`

Successful Response

- object

## Other responses

- `422` — Validation Error

## Changes

- **2026-09-18** `082b5fabd909` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/flock/apis/litellm-api/changes/api/plugins/auth-token/get.md)

---

[API](https://skmtc.dev/flock/apis/litellm-api.md) · [All operations](https://skmtc.dev/flock/apis/litellm-api/llms.txt) · [OpenAPI document](https://skmtc.dev/flock/apis/litellm-api/revisions/3b2b241e4b0b?raw)