{"version":"2.1.233","anchor":"gateway-upstreams-can-forward-the-signed-in-user-s-identity","canonical_anchor":"gateway-upstreams-can-forward-the-signed-in-user-s-identity","heading":"Gateway upstreams can forward the signed-in user's identity","tier":"use","area":"Gateway","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.233\/e\/gateway-upstreams-can-forward-the-signed-in-user-s-identity","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.233","markdown":"### Gateway upstreams can forward the signed-in user's identity\n\nSelf-hosted gateway upstreams can forward your identity and email, and config refuses it for Anthropic hosts.\n\n**What**\n\nAnthropic upstreams in gateway config accept a new `forward_user_identity` option. With it set, requests carry the signed-in developer's identity-provider subject and email as `x-litellm-end-user-id`, `x-claude-gateway-user-id` and `x-claude-gateway-user-email`, for a proxy you run yourself. Config validation refuses the option when the upstream `base_url` host is anthropic.com, any subdomain of it, or the AWS external-Anthropic pattern, so user emails never reach Anthropic.\n\n**Details**\n\n- When an `oidc` block is present alongside it, a warning names exactly which fields get forwarded.\n- Off unless you add the option to an upstream.\n\n**Evidence**\n\n`forward_user_identity is for identifying users to a proxy you run at base_url; it is refused for `\n\n- Area: Gateway\n- Names: `forward_user_identity`\n- Tier: Use it now\n- Useful: 3\/5\n- Signal: 3\/5"}