{"record":{"id":"6fdd6b9f44fc532d","repo":"BerriAI/litellm","slug":"deepkeep-api-key-is-required-set-the-deepkeep-ap","errorCode":null,"errorMessage":"DeepKeep API key is required. Set the `DEEPKEEP_API_KEY` environment variable or pass `api_key` in the guardrail config.","messagePattern":"DeepKeep API key is required\\. Set the `DEEPKEEP_API_KEY` environment variable or pass `api_key` in the guardrail config\\.","errorType":"exception","errorClass":"DeepKeepGuardrailMissingSecrets","httpStatus":null,"severity":"error","filePath":"litellm/proxy/guardrails/guardrail_hooks/deepkeep/deepkeep.py","lineNumber":80,"sourceCode":"              api_base: https://your-deepkeep-instance.example.com\n              deepkeep_firewall_id: your-firewall-id\n    \"\"\"\n\n    def __init__(\n        self,\n        api_key: str | None = None,\n        api_base: str | None = None,\n        firewall_id: str | None = None,\n        unreachable_fallback: Literal[\"fail_closed\", \"fail_open\"] = \"fail_closed\",\n        extra_headers: Mapping[str, str] | list[str] | None = None,\n        **kwargs: Any,\n    ):\n        self.async_handler = get_async_httpx_client(llm_provider=httpxSpecialProvider.GuardrailCallback)\n\n        # API key\n        deepkeep_api_key: Final = api_key or os.environ.get(\"DEEPKEEP_API_KEY\")\n        if not deepkeep_api_key:\n            raise DeepKeepGuardrailMissingSecrets(\n                \"DeepKeep API key is required. Set the `DEEPKEEP_API_KEY` environment \"\n                \"variable or pass `api_key` in the guardrail config.\"\n            )\n        self.deepkeep_api_key: str = deepkeep_api_key\n\n        # Firewall ID\n        self.firewall_id = firewall_id or os.environ.get(\"DEEPKEEP_FIREWALL_ID\")\n        if not self.firewall_id:\n            raise DeepKeepGuardrailMissingSecrets(\n                \"DeepKeep firewall_id is required. Set the `DEEPKEEP_FIREWALL_ID` environment \"\n                \"variable or pass `deepkeep_firewall_id` in the guardrail config.\"\n            )\n\n        # API base URL\n        base_url = api_base or os.environ.get(\"DEEPKEEP_API_BASE\")\n        if not base_url:\n            raise DeepKeepGuardrailMissingSecrets(\n                \"DeepKeep API base URL is required. Set the `DEEPKEEP_API_BASE` environment \"","sourceCodeStart":62,"sourceCodeEnd":98,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/guardrails/guardrail_hooks/deepkeep/deepkeep.py#L62-L98","documentation":"DeepKeepGuardrailMissingSecrets raised by DeepKeepGuardrail.__init__ when the DeepKeep guardrail is instantiated without an API key: neither the api_key constructor argument (from litellm_params) nor the DEEPKEEP_API_KEY environment variable is set. LiteLLM fails fast at guardrail registration because the DeepKeep firewall API cannot be called unauthenticated.","triggerScenarios":"Adding a deepkeep guardrails entry in config.yaml with a mode hook (e.g. guardrail_runs_before_llm_call) but no api_key in litellm_params, while DEEPKEEP_API_KEY is unset in the proxy process environment.","commonSituations":"Key present in the developer shell but absent in the container/service; typo in the env var name; .env file not loaded by the deployment; key rotated in the console but never updated in the secret store.","solutions":["Set DEEPKEEP_API_KEY in the environment the proxy actually runs in (docker -e, k8s secret, systemd Environment=) and restart","Or pass api_key: os.environ/DEEPKEEP_API_KEY under litellm_params in the guardrails entry","Verify with printenv DEEPKEEP_API_KEY inside the same service context","Check for typos and empty-string overrides of the variable name"],"exampleFix":"# before\nguardrails:\n  - guardrail_id: deepkeep\n    litellm_params:\n      mode: guardrail_runs_before_llm_call\n      deepkeep_firewall_id: os.environ/DEEPKEEP_FIREWALL_ID\n\n# after\n# export DEEPKEEP_API_KEY=your-key\nguardrails:\n  - guardrail_id: deepkeep\n    litellm_params:\n      mode: guardrail_runs_before_llm_call\n      api_key: os.environ/DEEPKEEP_API_KEY\n      deepkeep_firewall_id: os.environ/DEEPKEEP_FIREWALL_ID","handlingStrategy":"validation","validationCode":"import os\n\nrequired = ('DEEPKEEP_API_KEY', 'DEEPKEEP_FIREWALL_ID', 'DEEPKEEP_API_BASE')\nmissing = [v for v in required if not os.environ.get(v)]\nif missing:\n    raise RuntimeError(f'DeepKeep guardrail disabled - unset env vars: {missing}')","typeGuard":null,"tryCatchPattern":"from litellm.proxy.guardrails.guardrail_hooks.deepkeep.deepkeep import DeepKeepGuardrailMissingSecrets\ntry:\n    guardrail = DeepKeepGuardrail(guardrail_name='deepkeep')\nexcept DeepKeepGuardrailMissingSecrets as e:\n    raise SystemExit(f'guardrail config incomplete: {e}') from e","preventionTips":["Store all three DeepKeep values (key, firewall id, base URL) as one secret-store entry so they cannot skew","Assert non-empty values in the deploy preflight - empty strings fail the same check","After rotation in the DeepKeep console, update the secret and restart the proxy in the same change"],"tags":["deepkeep","guardrails","api-key","environment-variables","litellm-proxy","startup-config"],"backgroundTag":"missing-api-key-env-var","analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}