BerriAI/litellm · error · HTTPException

New key must start with 'sk-'. This is to distinguish a key

Error message

New key must start with 'sk-'. This is to distinguish a key hash (used by litellm for logging / internal logic) from the actual key.

What it means

Error "New key must start with 'sk-'. This is to distinguish a key hash (used by litellm for logging / internal logic) from the actual key." thrown in BerriAI/litellm.

Source

Thrown at litellm/proxy/management_endpoints/key_management_endpoints.py:4607

    from litellm.proxy.proxy_server import prisma_client

    _require_proxy_admin(user_api_key_dict)
    if prisma_client is None:
        raise HTTPException(
            status_code=500,
            detail={"error": CommonProxyErrors.db_not_connected_error.value},
        )

    report: Final = await check_encryption(prisma_client=prisma_client)
    return {"status": "success", "report": report.as_dict()}


async def get_new_token(data: RegenerateKeyRequest | None) -> str:
    if data and data.new_key is not None:
        # Reject custom key values if disabled by admin
        await _check_custom_key_allowed(data.new_key)
        if not data.new_key.startswith("sk-"):
            raise HTTPException(
                status_code=status.HTTP_400_BAD_REQUEST,
                detail={
                    "error": "New key must start with 'sk-'. This is to distinguish a key hash (used by litellm for logging / internal logic) from the actual key."
                },
            )
        if len(data.new_key) < MINIMUM_CUSTOM_KEY_LENGTH:
            raise HTTPException(
                status_code=status.HTTP_400_BAD_REQUEST,
                detail={"error": f"New key must be at least {MINIMUM_CUSTOM_KEY_LENGTH} characters long."},
            )
        new_token = data.new_key
    else:
        new_token = f"sk-{secrets.token_urlsafe(LENGTH_OF_LITELLM_GENERATED_KEY)}"
    return new_token


async def _insert_deprecated_key(
    prisma_client: "PrismaClient",

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Provide a new key value that starts with the 'sk-' prefix.
2. Omit the custom key to let the proxy auto-generate a properly formatted key.

When it happens

Trigger: Thrown at litellm/proxy/management_endpoints/key_management_endpoints.py:4607 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/c06e24a712575182. Report an issue: GitHub.