Skip to content

Conversation

@yk0007
Copy link

@yk0007 yk0007 commented Feb 10, 2026

Fixes #1133

What

Adds _validate_api_key() to LiteLLMProvider.__init__() to reject malformed API keys at initialization instead of failing later at runtime with unclear auth errors.

Validation checks

  1. Empty or whitespace-only keys
  2. Keys containing ASCII control characters (0x00–0x1F, 0x7F)
    • covered examples: newline, carriage return, tab, NUL, DEL
  3. Accidentally quoted keys, including whitespace-padded quotes

Impact

Applies to all providers that use LiteLLMProvider (OpenAI, Anthropic, Gemini, DeepSeek, Mistral, etc.).

Tests

Added 3 tests under TestLiteLLMProviderInit:

  • test_init_with_malformed_key_whitespace
  • test_init_with_malformed_key_control_chars
  • test_init_with_malformed_key_quotes

Validation run:

  • make check
  • make test ✅ (686 passed, 71 skipped)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug]: LiteLLMProvider accepts malformed API keys, causing runtime failures across all providers

1 participant