Agentgateway v1.5.0 introduces breaking changes to LLM token counts and JWT claims

The agentgateway project has released version 1.5.0, as detailed in its GitHub release notes. This update includes several new features and breaking changes. Among the highlights are expanded support for LLM traffic, deeper integrations with Agent Substrate, SPIFFE Workload API identities, and dynamic proxy enhancements. Notably, the release modifies LLM token count semantics, requiring operators to review token-based rate limits and dashboards. LLM input tokens now include prompt-cache tokens, and normalized token counts are reflected in access logs, spans, metrics, and rate limits. A temporary compatibility setting, AGENTGATEWAY_LEGACY_LLM_USAGE_TOKEN_SEMANTICS, can restore previous behavior but will be removed in a future release.

Additionally, JWT authentication now mandates issuer (iss) and audience (aud) claims, with stricter validation rules. Tokens missing these claims or relying on previously disabled requirements may fail authentication. Operators should audit JWTs issued to clients before upgrading to ensure compliance with the new requirements.

Other breaking changes include field-by-field merging of backend and attached LLM policies, requiring updates for configurations that relied on full policy replacement. Cross-namespace route delegation now requires a ReferenceGrant, and standalone API key metadata has shifted to a new prefix format, impacting integrations that read or write these fields. Legacy Istio identity TLV support has been removed, requiring deployments to use native mTLS for workload identity.

Operators should carefully evaluate their systems for dependencies on the previous LLM token semantics, JWT claim configurations, and policy merging behavior. These changes could disrupt existing workflows, especially for systems relying on cached tokens or JWTs with incomplete claims.