Skip to main content
When PipesHub calls models through an AI gateway, every request normally arrives with the same API key, so the gateway cannot tell people apart. Identity forwarding adds the person behind each request (and, if you allow it, their groups) to the request headers. The gateway can then apply per-user or per-group budgets, rate limits and model access. Identity forwarding is available for models from these providers: It is off until you turn it on for a connection.

​
Turn it on for a connection

1

Add the model

Add a model from one of the providers above on the AI models page.
2

Open Identity forwarding

On the model’s row, open the actions menu and choose Identity forwarding. The setting applies to every model in that connection.
3

Choose what to send

Turn on Forward user identity, then choose a Format:
  • LiteLLM headers sends LiteLLM’s own identity headers (listed below).
  • Header template sends the headers of a Gateway preset: Portkey, Helicone, Cloudflare AI Gateway or Azure API Management. Choose Custom headers to write your own. The default preset, LiteLLM, sends no template headers, so pick a gateway preset or Custom headers.
4

Set a key for background work (optional)

Indexing and extraction have no signed-in person. In Key for background work, you can give them their own gateway key, so their spend is budgeted apart from people’s.
5

Check and save

Click Preview to see what would be sent for you, then click Save.

​
What is sent

​
LiteLLM headers

When a Key for background work is set, background calls use it as their Authorization: Bearer key.
In this format anyone who holds the gateway key can claim any identity. Limit the key’s routes and network access on the gateway side.

​
Gateway presets

​
Custom headers

With Custom headers, enter one header per line in Header templates, as Header-Name: value. A value can use these placeholders: {{SUBJECT}}, {{EMAIL}}, {{GROUP_IDS}}, {{ORG_ID}}, {{WORKLOAD}}, {{REQUEST_ID}}, {{CONVERSATION_ID}}, {{AGENT_ID}}. You can set up to 16 headers, each value up to 512 characters. For example:

​
Identity policy

The identity policy decides what PipesHub may tell any gateway about the person asking. It applies to every connection that forwards identity. Open it with the Identity policy button on the For LLMs tab of the AI models page. Only chat, agent, search, search-query embedding and speech calls carry a person. Indexing, extraction, parsing and other background work, health checks and model discovery are sent as a service identity, such as svc:pipeshub:indexing.