{"record":{"id":"ecd841f4b9463ca5","repo":"BerriAI/litellm","slug":"missing-api-key-a-call-is-being-made-to-llm-prov","errorCode":null,"errorMessage":"Missing API Key - A call is being made to LLM Provider but no key is set either in the environment variables ({LLM_PROVIDER}_API_KEY) or via params","messagePattern":"Missing API Key - A call is being made to LLM Provider but no key is set either in the environment variables \\((.+?)_API_KEY\\) or via params","errorType":"exception","errorClass":"DatabricksException","httpStatus":400,"severity":"error","filePath":"litellm/llms/databricks/common_utils.py","lineNumber":351,"sourceCode":"\n        # Check for OAuth M2M credentials (recommended for production)\n        client_id: Final = os.getenv(\"DATABRICKS_CLIENT_ID\")\n        client_secret: Final = os.getenv(\"DATABRICKS_CLIENT_SECRET\")\n\n        # Determine api_base first\n        if api_base is None:\n            api_base = os.getenv(\"DATABRICKS_API_BASE\")\n\n        if client_id and client_secret and api_base:\n            # Use OAuth M2M flow (preferred for production)\n            verbose_logger.debug(\"Using OAuth M2M authentication for Databricks\")\n            access_token: Final = self._get_oauth_m2m_token(api_base, client_id, client_secret)\n            headers = headers or {}\n            headers[\"Authorization\"] = f\"Bearer {access_token}\"\n            headers[\"Content-Type\"] = \"application/json\"\n        elif api_key is None and not headers:\n            if custom_endpoint is True:\n                raise DatabricksException(\n                    status_code=400,\n                    message=\"Missing API Key - A call is being made to LLM Provider but no key is set either in the environment variables ({LLM_PROVIDER}_API_KEY) or via params\",\n                )\n            else:\n                # Fallback to Databricks SDK (registers partner telemetry)\n                verbose_logger.debug(\"Using Databricks SDK for authentication\")\n                api_base, headers = self._get_databricks_credentials(\n                    api_base=api_base, api_key=api_key, headers=headers\n                )\n\n        if api_base is None:\n            if custom_endpoint:\n                raise DatabricksException(\n                    status_code=400,\n                    message=\"Missing API Base - A call is being made to LLM Provider but no api base is set either in the environment variables ({LLM_PROVIDER}_API_KEY) or via params\",\n                )\n            else:\n                api_base, headers = self._get_databricks_credentials(","sourceCodeStart":333,"sourceCodeEnd":369,"githubUrl":"https://github.com/BerriAI/litellm/blob/6c2dcb801bf2b75c18f1bb24140e7cf57465cc4d/litellm/llms/databricks/common_utils.py#L333-L369","documentation":"Raised when a Databricks call is configured as a custom endpoint (custom_endpoint=True), no OAuth client credentials are present, no api_key is given, and no headers were supplied — so no authentication material exists at all. LiteLLM refuses the call with a 400 rather than sending an unauthenticated request.","triggerScenarios":"Using a custom/ai-gateway Databricks endpoint (custom endpoint flag set) while DATABRICKS_API_KEY and api_key are both absent and no Authorization header is passed manually.","commonSituations":"Pointing Databricks models at an internal AI gateway that requires its own key, but the key env var was never wired in; migrating config where api_base was updated but api_key was dropped.","solutions":["Set DATABRICKS_API_KEY (or the provider-prefixed variant) in the environment","Or pass api_key directly in the call / litellm_params","If the gateway uses a custom header, pass explicit headers with the Authorization entry","Verify the env var name matches the provider prefix LiteLLM expects"],"exampleFix":"# before\nresponse = litellm.completion(model=\"databricks/custom-model\", messages=msgs, api_base=GW_URL)\n\n# after\nresponse = litellm.completion(model=\"databricks/custom-model\", messages=msgs, api_base=GW_URL, api_key=os.environ[\"DATABRICKS_API_KEY\"])","handlingStrategy":"validation","validationCode":"if custom_endpoint and not (api_key or headers or os.getenv(\"DATABRICKS_API_KEY\")):\n    raise RuntimeError(\"Custom Databricks endpoint requires an API key or explicit auth headers\")","typeGuard":null,"tryCatchPattern":"try:\n    resp = litellm.completion(model=m, messages=msgs, api_base=gw_url)\nexcept Exception as e:\n    if \"Missing API Key\" in str(e):\n        raise ConfigError(\"Provide the gateway/API key for the custom endpoint\") from e\n    raise","preventionTips":["When routing Databricks models through a gateway, store the gateway key in litellm_params, not ambient env","Add a preflight check that every custom-endpoint model declares an auth source"],"tags":["databricks","authentication","config","custom-endpoint"],"backgroundTag":null,"analyzedSha":"6c2dcb801bf2b75c18f1bb24140e7cf57465cc4d","analyzedAt":"2026-08-15T07:12:03.035Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}