Access Management
Control access to models, MCP servers, and agents in LiteLLM.
Users, teams, and virtual keys
Create users and teams in LiteLLM or sync them from your identity provider (IdP).
A virtual key is a sub-identity under a user or team, with its own permissions, budgets, and rate limits. Authenticate with its static API credential or map JWT claims to the virtual key.
A service account key is a team-owned virtual key for application access.
Access groups
Access groups define which models, MCP servers, and agents a team or virtual key can use. Assign the same group to multiple teams or keys.
To manage membership in your IdP, sync users and groups with SCIM, then assign access groups to the resulting LiteLLM teams.
Roles
Roles and team member permissions define what a user can view and manage in LiteLLM, such as viewing usage, creating keys, or editing team settings. Audit logs record administrative changes.
