---
title: "Plugin Auth Token"
method: GET
path: "/api/plugins/auth-token"
tags: ["plugins"]
---

# Plugin Auth Token

`GET /api/plugins/auth-token`

## Request

- Base URL: `https://api.sea-lion.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.sea-lion.ai/api/plugins/auth-token`
- Auth: API key in header `x-litellm-api-key`

Issue a short-lived, audience-scoped plugin session claim.

The claim contains {user_id, user_role, plugin, exp}.  It does NOT
contain the caller's litellm bearer token — a compromised plugin can
only learn the caller's identity, not impersonate them against the proxy.

Encrypted with a key derived from HMAC(LITELLM_SALT_KEY, plugin_name),
so each plugin holds only its own key and cannot forge claims for others.

Requires LITELLM_SALT_KEY to be set; returns 503 otherwise.

## Query parameters

- `plugin_name` string

## Response `200`

Successful Response

- object

## Other responses

- `422`: Validation Error

## Changes

- **2026-10-21** `f2fb14eab3f5`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/sea-lion/apis/litellm-api/changes/api/plugins/auth-token/get.md)

---

[API](https://skmtc.dev/sea-lion/apis/litellm-api.md) · [All operations](https://skmtc.dev/sea-lion/apis/litellm-api/llms.txt) · [OpenAPI document](https://skmtc.dev/sea-lion/apis/litellm-api/revisions/1ba9123c189a?raw)