BerriAI/litellm · error · ValueError

Invalid secret_name {secret_name!r}

Error message

Invalid secret_name {secret_name!r}

What it means

Generic sentinel from the secret-name sanitizer raise_if_unsafe_secret_name: the name matched the unsafe pattern (a '..' path segment or a control character), so the secret manager refuses to resolve it. This is a path-traversal/invalid-input guard, not a provider error; the offending value is the secret_name argument itself.

Source

Thrown at litellm/secret_managers/base_secret_manager.py:21

from typing import Any, Final

import httpx

from litellm import verbose_logger

_UNSAFE_SECRET_NAME_PATTERN: Final = re.compile(r"(^|/)\.\.(/|$)|[\x00-\x1f\x7f-\x9f…

]")


def raise_if_unsafe_secret_name(secret_name: str) -> None:
    """
    Validate a secret name before it is used by a secret manager integration.

    Rejects ".." only as a path segment (bounded by "/" or the start/end of the
    string, e.g. "../x", "x/..", or exactly ".."), not as a plain substring, so
    names like "release-1.0..2" are not rejected.
    """
    if _UNSAFE_SECRET_NAME_PATTERN.search(secret_name):
        raise ValueError(f"Invalid secret_name {secret_name!r}")


class BaseSecretManager(ABC):
    """
    Abstract base class for secret management implementations.
    """

    @abstractmethod
    async def async_read_secret(
        self,
        secret_name: str,
        optional_params: dict | None = None,
        timeout: float | httpx.Timeout | None = None,
    ) -> str | None:
        """
        Asynchronously read a secret from the secret manager.

        Args:

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Pass a valid secret name: non-empty string matching the backend's naming rules (no illegal characters).
2. Trim whitespace and validate secret_name against the expected pattern before calling.

When it happens

Trigger: Thrown at litellm/secret_managers/base_secret_manager.py:21 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/00844353019b4d0b. Report an issue: GitHub.