docs(proxy): fix JWT key mapping guide to match shipped endpoints

[devin-ai-integration]

Summary

The JWT key mapping guide documented /jwt_client/new and /jwt_client/update routes plus request/response shapes that never shipped. Those endpoints (a unified "create key + mapping" call, an issuer-scoped mapping, JWT-bound key lockdown to llm_api_routes) live only on an unmerged branch (litellm_ishaan_march31, commit de23b3ec); the guide was written the same day describing that branch's planned API rather than what merged. What actually shipped is the /jwt/key/mapping/* set backed by jwt_key_mapping_endpoints.py, and every mapping op keys off the mapping id, not the claim name/value.

This rewrites the guide to match the code:

• config field jwt_client_id_field -> virtual_key_claim_field (old name still accepted as a deprecated alias, noted in the doc)
• the single "creates key + mapping atomically" call is replaced with the real two-step flow: POST /key/generate to mint the virtual key, then POST /jwt/key/mapping/new with {jwt_claim_name, jwt_claim_value, key} where key is the key token (not virtual_key_id)
• manage-by-id: info/list are GET with ?id=/pagination, update and delete are POST taking {"id": ...} (the doc previously used DELETE + claim body and a nonexistent /jwt_client/update); info returns the mapping record, not the linked key's budget/spend
• Security section rewritten to what's enforced (admin-only writes, admin-viewer reads, auto_register mints an unrestricted key); dropped the unimplemented llm_api_routes / /key/update 403 claims
• Multi-IdP issuer section removed: the mapping is unique on (jwt_claim_name, jwt_claim_value) with no issuer dimension, so it's replaced with guidance to map on a globally-unique claim

Linear ticket

Link to Devin session: https://app.devin.ai/sessions/c75c6079168c4facb87631fb316a28bc
Requested by: @krrish-berri-2

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
litellm	Ready	Preview, Comment	Jul 6, 2026 5:29pm