@acarmisc/backstage-plugin-litellm-backend

Backend for the Backstage LiteLLM Governance Plugin (New Backend System). It is the only component that talks to your LiteLLM proxy: it holds the master key, resolves the caller's Backstage identity, and enforces budgets, key limits, team membership, model access and permissions before calling LiteLLM.

Pair it with the frontend, @acarmisc/backstage-plugin-litellm.

Full documentation — adoption guide, configuration reference, permissions, security model and architecture — starts at the project README.

Installation

yarn --cwd packages/backend add @acarmisc/backstage-plugin-litellm-backend

In packages/backend/src/index.ts:

backend.add(import('@acarmisc/backstage-plugin-litellm-backend'));

Minimal configuration

litellm:
  baseUrl: http://litellm-proxy:4000        # internal URL of the LiteLLM proxy
  publicBaseUrl: https://llm.example.com    # optional: shown to users in snippets
  masterKey: ${LITELLM_MASTER_KEY}
  userIdDomain: example.com                 # optional: user:default/jane → [email protected]
  provisioning:
    enabled: true                           # optional: create LiteLLM users on first visit

The configuration schema ships with the package (config.d.ts); see the configuration reference for every key (key ceilings, team management, budget hiding, CLI bridge, OpenCode connect).

What it exposes

Routes are mounted under /api/litellm. A machine-readable OpenAPI 3.1 description is served at /api/litellm/openapi.json; the endpoint table summarises them.

The plugin registers the litellm.* permissions with the permission framework (see Permissions).

License

Apache-2.0