BerriAI/litellm · error · Exception

DD_API_KEY is not set, set 'DD_API_KEY=<>

Error message

DD_API_KEY is not set, set 'DD_API_KEY=<>

What it means

DataDogLogger resolves its API key as dd_api_key if passed, otherwise DD_API_KEY from the environment — and only when allow_env_credentials is True. If both are absent the constructor raises a generic Exception immediately, so the logger cannot even be instantiated. It is a bootstrap/config error for the Datadog logging integration.

Source

Thrown at litellm/integrations/datadog/datadog.py:236

        dd_site: str | None = None,
        allow_env_credentials: bool = True,
    ) -> None:
        """
        Configure direct DataDog API connection

        Args:
            dd_api_key: Datadog API key. Falls back to DD_API_KEY env var when allow_env_credentials is True.
            dd_site: Datadog site. Falls back to DD_SITE env var.
            allow_env_credentials: When False, never read the API key from DD_API_KEY env var.

        Raises:
            Exception: If required credentials are not provided via args or env vars
        """
        resolved_api_key: Final = dd_api_key or (os.getenv("DD_API_KEY") if allow_env_credentials else None)
        resolved_site: Final = dd_site or os.getenv("DD_SITE")

        if resolved_api_key is None:
            raise Exception("DD_API_KEY is not set, set 'DD_API_KEY=<>")
        if resolved_site is None:
            raise Exception("DD_SITE is not set in .env, set 'DD_SITE=<>")

        self.DD_API_KEY = resolved_api_key
        self.intake_url = f"https://http-intake.logs.{resolved_site}/api/v2/logs"

    async def async_log_success_event(self, kwargs, response_obj, start_time, end_time):
        """
        Async Log success events to Datadog

        - Creates a Datadog payload
        - Adds the Payload to the in memory logs queue
        - Payload is flushed every 10 seconds or when batch size is greater than 100


        Raises:
            Raises a NON Blocking verbose_logger.exception if an error occurs
        """

View on GitHub (pinned to 6c2dcb801b)

Solutions

  1. Export DD_API_KEY in the process running litellm (docker-compose environment:, k8s secret env, .env for local dev)
  2. Or pass dd_api_key explicitly when constructing DataDogLogger
  3. If allow_env_credentials=False is intentional, supply the key via the dd_api_key argument every time

Example fix

# before
litellm.callbacks = ["datadog"]  # DD_API_KEY unset

# after
# docker-compose.yml
services:
  litellm:
    environment:
      - DD_API_KEY=${DD_API_KEY}
      - DD_SITE=us5.datadoghq.com
Defensive patterns

Strategy: validation

Validate before calling

import os

def datadog_logger_ready() -> bool:
    return bool(os.getenv("DD_API_KEY"))

if "datadog" in callbacks and not datadog_logger_ready():
    raise SystemExit("Set DD_API_KEY before enabling the datadog callback")

Try / catch

try:
    DataDogLogger()
except Exception as e:
    if "DD_API_KEY" in str(e):
        fail_fast_on_missing_secret("DD_API_KEY")
    raise

Prevention

When it happens

Trigger: Adding DataDogLogger to litellm_settings callbacks (or litellm.callbacks = [...]) in an environment where DD_API_KEY is unset and no dd_api_key argument was supplied; or allow_env_credentials=False with no explicit key, which always disables the env fallback.

Common situations: Env vars set in one shell but the proxy runs under systemd/docker without them; .env file not loaded by the deployment; allow_env_credentials flipped to False for secret-hygiene reasons without providing the key explicitly.

Related errors

AI-assisted analysis of BerriAI/litellm@6c2dcb801b (2026-08-15). Data as JSON: /api/errors/b7ce294badff5b7d. Report an issue: GitHub.