{"record":{"id":"4bee4a340cd44a30","repo":"BerriAI/litellm","slug":"crowdstrike-aidr-api-key-not-found-set-cs-aidr-to","errorCode":null,"errorMessage":"CrowdStrike AIDR API Key not found. Set CS_AIDR_TOKEN environment variable or pass it in litellm_params.","messagePattern":"CrowdStrike AIDR API Key not found\\. Set CS_AIDR_TOKEN environment variable or pass it in litellm_params\\.","errorType":"exception","errorClass":"CrowdStrikeAIDRGuardrailMissingSecrets","httpStatus":null,"severity":"error","filePath":"litellm/proxy/guardrails/guardrail_hooks/crowdstrike_aidr/crowdstrike_aidr.py","lineNumber":257,"sourceCode":"        guardrail_name: str,\n        api_key: str | None = None,\n        api_base: str | None = None,\n        **kwargs,\n    ) -> None:\n        \"\"\"\n        Initializes the CrowdStrikeAIDRHandler.\n\n        Args:\n            guardrail_name (str): The name of the guardrail instance.\n            api_key (str | None): The CrowdStrike AIDR API key. Reads from CS_AIDR_TOKEN env var if None.\n            api_base (str | None): The CrowdStrike AIDR API base URL. Reads from CS_AIDR_BASE_URL env var if None.\n            **kwargs: Additional arguments passed to the CustomGuardrail base class.\n        \"\"\"\n        self.async_handler = get_async_httpx_client(llm_provider=httpxSpecialProvider.GuardrailCallback)\n\n        self.api_key = api_key or os.environ.get(\"CS_AIDR_TOKEN\")\n        if not self.api_key:\n            raise CrowdStrikeAIDRGuardrailMissingSecrets(\n                \"CrowdStrike AIDR API Key not found. Set CS_AIDR_TOKEN environment variable or pass it in litellm_params.\"\n            )\n\n        self.api_base = api_base or os.environ.get(\"CS_AIDR_BASE_URL\")\n        if not self.api_base:\n            raise CrowdStrikeAIDRGuardrailMissingSecrets(\n                \"CrowdStrike AIDR API base URL is required. Set CS_AIDR_BASE_URL environment variable or pass it in litellm_params.\"\n            )\n\n        kwargs.setdefault(\"supported_event_hooks\", list(self.get_supported_event_hooks()))\n        # Pass relevant kwargs to the parent class\n        super().__init__(guardrail_name=guardrail_name, **kwargs)\n        verbose_proxy_logger.debug(\n            \"Initialized CrowdStrike AIDR Guardrail: name=%s, api_base=%s\", guardrail_name, self.api_base\n        )\n\n    async def _call_crowdstrike_aidr_guard(\n        self, payload: dict[str, Any], hook_name: str","sourceCodeStart":239,"sourceCodeEnd":275,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/guardrails/guardrail_hooks/crowdstrike_aidr/crowdstrike_aidr.py#L239-L275","documentation":"Raised by CrowdStrikeAIDRHandler.__init__ while the LiteLLM proxy instantiates the CrowdStrike AI Detection & Response guardrail: no API key was found either as the api_key constructor argument (wired from litellm_params) or in the CS_AIDR_TOKEN environment variable. LiteLLM fails fast at config-load/startup because the guardrail cannot authenticate guard API calls without the key.","triggerScenarios":"Adding a guardrails entry in config.yaml whose litellm_params selects a crowdstrike-aidr hook (e.g. mode: guardrail_runs_before_llm_call) without an api_key, while CS_AIDR_TOKEN is unset in the proxy process; starting the proxy under docker/k8s/systemd where the env var was never injected into the service.","commonSituations":"Env var exported in an interactive shell but missing in the deployed service; typo in the variable name (e.g. CS_AIDR_API_KEY); an empty-string override (CS_AIDR_TOKEN='') masking a real value; assuming the key is read from the LiteLLM DB or master key instead of the process environment.","solutions":["Set CS_AIDR_TOKEN in the exact environment the proxy runs in (export CS_AIDR_TOKEN=..., docker -e, k8s secret, systemd Environment=) and restart the proxy","Or pass the key explicitly in config.yaml under the guardrail's litellm_params: api_key: os.environ/CS_AIDR_TOKEN","Verify visibility from inside the service context: printenv CS_AIDR_TOKEN in the same container/pod","Check for typos and empty-string overrides of the variable name"],"exampleFix":"# before\nguardrails:\n  - guardrail_id: crowdstrike-aidr\n    litellm_params:\n      mode: guardrail_runs_before_llm_call\n\n# after (env var preferred, or inline reference)\n# export CS_AIDR_TOKEN=your-token\nguardrails:\n  - guardrail_id: crowdstrike-aidr\n    litellm_params:\n      mode: guardrail_runs_before_llm_call\n      api_key: os.environ/CS_AIDR_TOKEN\n        api_base: os.environ/CS_AIDR_BASE_URL","handlingStrategy":"validation","validationCode":"import os\n\nmissing = [v for v in ('CS_AIDR_TOKEN', 'CS_AIDR_BASE_URL') if not os.environ.get(v)]\nif missing:\n    raise RuntimeError(f'CrowdStrike AIDR guardrail disabled - unset env vars: {missing}')\n# proceed to start the proxy only when the list is empty","typeGuard":null,"tryCatchPattern":"from litellm.proxy.guardrails.guardrail_hooks.crowdstrike_aidr.crowdstrike_aidr import (\n    CrowdStrikeAIDRGuardrailMissingSecrets,\n)\ntry:\n    handler = CrowdStrikeAIDRHandler(guardrail_name='cs-aidr')\nexcept CrowdStrikeAIDRGuardrailMissingSecrets as e:\n    raise SystemExit(f'guardrail config incomplete: {e}') from e  # fail the deploy, not requests","preventionTips":["Declare CS_AIDR_TOKEN and CS_AIDR_BASE_URL in the deployment manifest next to the image so ad-hoc shells cannot drift","Add a preflight deploy check asserting all guardrail env vars are non-empty strings","Dry-run load config.yaml (or call the /guardrails endpoints on a staging instance) before promoting"],"tags":["crowdstrike","guardrails","api-key","environment-variables","litellm-proxy","startup-config"],"backgroundTag":"missing-api-key-env-var","analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}