Allow specifying `token` parameter (SHA256 of key) to `/key/generate` API #10601

msabramo · 2025-05-06T21:45:37Z

This could be useful if you have multiple LiteLLM proxy instances or you are migrating from one to another and want to reuse existing key hashes. For example in the example below, John already has a key on some LiteLLM proxy that has a SHA256 hash of 60980d9c682a44cecdb4462f512b57e48fc63288680725962e87b9f764eae47a and we want to enable that same key to work in a new LiteLLM proxy. We can do that by generating a key but specifying the token parameter to equal that existing hash:

litellm-proxy keys generate \
  --user-id=john \
  --team-id=team123 \
  --key-alias=john-key-1 \
  --key-name="Unknown key with hash 60980d9c682a44cecdb4462f512b57e48fc63288680725962e87b9f764eae47a" \
  --token=60980d9c682a44cecdb4462f512b57e48fc63288680725962e87b9f764eae47a```

The output of the above is:

{
  "key_alias": "john-key-1",
  ...
  "user_id": "john",
  "team_id": "team123",
  ...
  "key": "(Unknown)",
  "token": "60980d9c682a44cecdb4462f512b57e48fc63288680725962e87b9f764eae47a",
  "key_name": "Unknown key with hash 60980d9c682a44cecdb4462f512b57e48fc63288680725962e87b9f764eae47a",
  ...
  "token_id": "60980d9c682a44cecdb4462f512b57e48fc63288680725962e87b9f764eae47a",
  ...
  "created_at": "2025-05-07T00:26:42.890000Z",
  "updated_at": "2025-05-07T00:26:42.890000Z"
}

Relevant issues

Pre-Submission checklist

Please complete all items before asking a LiteLLM maintainer to review your PR

I have Added testing in the tests/litellm/ directory, Adding at least 1 test is a hard requirement - see details
I have added a screenshot of my new test passing locally
My PR passes all unit tests on make test-unit
My PR's scope is as isolated as possible, it only solves 1 specific problem

Type

🆕 New Feature

Changes

This allows one to set the key hash to some known existing key hash in order to import keys from one LiteLLM proxy instance to another. ```shell $ litellm-proxy http request POST /key/generate --json '{"token": "692b37538c7685a2c0529572d7b8eae87f990e572216a00f79baaf2db8895e08"}' { ... "key": "(Unknown)", "token": "692b37538c7685a2c0529572d7b8eae87f990e572216a00f79baaf2db8895e08", ... "token_id": "692b37538c7685a2c0529572d7b8eae87f990e572216a00f79baaf2db8895e08", ... } ```

vercel · 2025-05-06T21:45:42Z

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
litellm	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	May 13, 2025 10:22pm

```shell $ litellm-proxy keys generate \ --key-alias=my-key \ [email protected] \ --token=2d7fd3dcfa6fb7a5142fcf234fc3e2e9dc983ad34ba435824929e8bb5ab28ebc \ --key-name=some_key { "key_alias": "my-key", ... "user_id": "[email protected]", ... "key": "(Unknown)", "token": "2d7fd3dcfa6fb7a5142fcf234fc3e2e9dc983ad34ba435824929e8bb5ab28ebc", "key_name": "some_key", ... } ```

ishaan-jaff

reviewed

ishaan-jaff · 2025-05-07T03:54:52Z

litellm/proxy/_types.py

-                "api_key"
-            ).startswith("sk-"):
-                values.update({"api_key": hash_token(values.get("api_key"))})
+        api_key = values.get("api_key")


can you use _hash_token_if_needed in prox/utils.py here ?

Hmmm, just tried that and it resulted in a circular import between utils.py and _types.py, so it's not a trivial change.

Well I think I can move hash_token and _hash_token_if_needed to litellm.proxy._type and then utils.py can have:

from litellm.proxy._types import ( hash_token, _hash_token_if_needed, ... )

However, in order to test this with make test-unit, I will need #10662 to be merged...

Well, I'll just commit and push the change (3b2587a) and see if CI passes...

ishaan-jaff · 2025-05-07T03:55:25Z

litellm/proxy/client/cli/commands/keys.py

@@ -88,6 +88,8 @@ def list(
 @click.option("--spend", type=float, help="Maximum spend limit for this key")
 @click.option("--duration", type=str, help="Duration for which the key is valid (e.g. '24h', '7d')")
 @click.option("--key-alias", type=str, help="Alias/name for the key")
+@click.option("--key-name", type=str, help="Display/abbreviation name for the key (separate from key_alias)")


can you add an example of this in your description eg. sk-12.....2oA

Yep, check out 7eb128b.

ishaan-jaff · 2025-05-07T03:56:52Z

litellm/proxy/management_endpoints/key_management_endpoints.py

+        elif "key" in data_json and data_json["key"] is not None:
+            data_json["token"] = hash_token(data_json["key"])
+        else:
+            data_json["token"] = f"sk-{secrets.token_urlsafe(LENGTH_OF_LITELLM_GENERATED_KEY)}"


it's not clear to me, why do we need this. I believe the code already generates the token if not provided

You're right! All of this crap can be removed! 00e96f7

ishaan-jaff · 2025-05-07T03:57:19Z

litellm/proxy/management_endpoints/key_management_endpoints.py

+        # --- TOKEN HANDLING LOGIC ---
+        if "token" in data_json and data_json["token"] is not None:
+            data_json["token"] = data_json["token"]
+        elif "key" in data_json and data_json["key"] is not None:


I believe our existing code already does this. I don't think this is necessary.

You're right! All of this crap can be removed! 00e96f7

krrishdholakia · 2025-05-10T15:53:35Z

Is this ready for review post-initial feedback?

@ishaan-jaff

so that I can use `_hash_token_if_needed` in `UserAPIKeyAuth.check_api_key` in `_types.py`. addresses [comment](BerriAI#10601 (comment)) from @ishaan-jaff

@ishaan-jaff

addresses [comment](BerriAI#10601 (comment)) from @ishaan-jaff

@ishaan-jaff

addresses [comment](BerriAI#10601 (comment)) from @ishaan-jaff

msabramo · 2025-05-13T23:01:28Z

Is this ready for review post-initial feedback?

This is ready now, as I addressed @ishaan-jaff's comments. Note the LiteLLM Mock Tests seem to be timing out after 8 minutes. I think merging #10484 will fix this.

msabramo · 2025-05-19T03:28:28Z

Ready for review @ishaan-jaff

msabramo added 3 commits May 6, 2025 12:49

Allow setting key_name

2cfb5af

Add key generate tests

1d5954e

vercel bot deployed to Preview May 6, 2025 21:46 View deployment

vercel bot deployed to Preview May 6, 2025 22:04 View deployment

Update README.md files

4f65c42

vercel bot deployed to Preview May 6, 2025 22:29 View deployment

msabramo changed the title ~~Allow specifying key hash to key generate api~~ Allow specifying token parameter (SHA256 of key) to key generate api May 7, 2025

msabramo changed the title ~~Allow specifying token parameter (SHA256 of key) to key generate api~~ Allow specifying token parameter (SHA256 of key) to /key/generate API May 7, 2025

ishaan-jaff requested changes May 7, 2025

View reviewed changes

msabramo added 2 commits May 13, 2025 14:13

Move hash_token and _hash_token_if_needed to _types.py

3b2587a

so that I can use `_hash_token_if_needed` in `UserAPIKeyAuth.check_api_key` in `_types.py`. addresses [comment](BerriAI#10601 (comment)) from @ishaan-jaff

Enhance keys generate docs with examples

7eb128b

addresses [comment](BerriAI#10601 (comment)) from @ishaan-jaff

vercel bot deployed to Preview May 13, 2025 21:16 View deployment

Remove unnecessary code

00e96f7

addresses [comment](BerriAI#10601 (comment)) from @ishaan-jaff

vercel bot deployed to Preview May 13, 2025 21:21 View deployment

Merge branch 'main' into allow-specifying-key-hash-to-key-generate-api

d67f4a4

vercel bot deployed to Preview May 13, 2025 21:25 View deployment

Fix lint errors

9b50a2f

vercel bot deployed to Preview May 13, 2025 21:32 View deployment

Fix more lint errors

b5be502

vercel bot deployed to Preview May 13, 2025 21:36 View deployment

More lint fixes

25845e3

vercel bot deployed to Preview May 13, 2025 21:45 View deployment

Fix more lint errors

46e62d7

vercel bot deployed to Preview May 13, 2025 22:05 View deployment

Try to fix lint again for hash_token method

80da255

vercel bot deployed to Preview May 13, 2025 22:22 View deployment

msabramo requested a review from ishaan-jaff May 13, 2025 23:01

msabramo marked this pull request as draft May 21, 2025 05:46

msabramo marked this pull request as ready for review May 21, 2025 05:46

msabramo closed this May 21, 2025

msabramo reopened this May 21, 2025

msabramo closed this May 21, 2025

msabramo reopened this May 21, 2025

Uh oh!

Allow specifying token parameter (SHA256 of key) to /key/generate API #10601

Are you sure you want to change the base?

Allow specifying token parameter (SHA256 of key) to /key/generate API #10601

Uh oh!

Conversation

msabramo commented May 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Relevant issues

Pre-Submission checklist

Type

Changes

Uh oh!

vercel bot commented May 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ishaan-jaff left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

msabramo May 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

krrishdholakia commented May 10, 2025

Uh oh!

msabramo commented May 13, 2025

Uh oh!

msabramo commented May 19, 2025

Uh oh!

Uh oh!

Allow specifying `token` parameter (SHA256 of key) to `/key/generate` API #10601

Allow specifying `token` parameter (SHA256 of key) to `/key/generate` API #10601

msabramo commented May 6, 2025 •

edited

Loading

vercel bot commented May 6, 2025 •

edited

Loading

msabramo May 13, 2025 •

edited

Loading