@acarmisc/backstage-plugin-litellm-backend
Backend for the Backstage LiteLLM Governance Plugin (New Backend System). It is the only component that talks to your LiteLLM proxy: it holds the master key, resolves the caller's Backstage identity, and enforces budgets, key limits, team membership, model access and permissions before calling LiteLLM.
Pair it with the frontend, @acarmisc/backstage-plugin-litellm.
Full documentation — adoption guide, configuration reference, permissions, security model and architecture — starts at the project README.
Installation
yarn --cwd packages/backend add @acarmisc/backstage-plugin-litellm-backend
In packages/backend/src/index.ts:
backend.add(import('@acarmisc/backstage-plugin-litellm-backend'));
Minimal configuration
litellm:
baseUrl: http://litellm-proxy:4000 # internal URL of the LiteLLM proxy
publicBaseUrl: https://llm.example.com # optional: shown to users in snippets
masterKey: ${LITELLM_MASTER_KEY}
userIdDomain: example.com # optional: user:default/jane → [email protected]
provisioning:
enabled: true # optional: create LiteLLM users on first visit
The configuration schema ships with the package (config.d.ts); see the
configuration reference
for every key (key ceilings, team management, budget hiding, CLI bridge,
OpenCode connect).
What it exposes
Routes are mounted under /api/litellm. A machine-readable OpenAPI 3.1
description is served at /api/litellm/openapi.json; the
endpoint table
summarises them.
The plugin registers the litellm.* permissions with the permission
framework (see Permissions).
License
Apache-2.0