{"record":{"id":"fe3a6fdea63f3996","repo":"BerriAI/litellm","slug":"no-api-key-passed-in","errorCode":null,"errorMessage":"No api key passed in.","messagePattern":"No api key passed in\\.","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"litellm/proxy/auth/user_api_key_auth.py","lineNumber":1489,"sourceCode":"            )\n            if isinstance(response, str):\n                api_key = response\n            elif isinstance(response, UserAPIKeyAuth):\n                return response\n        if master_key is None:\n            if isinstance(api_key, str):\n                return UserAPIKeyAuth(\n                    api_key=api_key,\n                    user_role=LitellmUserRoles.INTERNAL_USER,\n                    parent_otel_span=parent_otel_span,\n                )\n            else:\n                return UserAPIKeyAuth(\n                    user_role=LitellmUserRoles.INTERNAL_USER,\n                    parent_otel_span=parent_otel_span,\n                )\n        elif api_key is None:  # only require api key if master key is set\n            raise Exception(\"No api key passed in.\")\n        elif api_key == \"\":\n            # missing 'Bearer ' prefix\n            raise Exception(\"Malformed API Key passed in. Ensure Key has `Bearer ` prefix.\")\n\n        if route == \"/user/auth\":\n            if general_settings.get(\"allow_user_auth\", False) is True:\n                return UserAPIKeyAuth()\n            else:\n                raise HTTPException(\n                    status_code=status.HTTP_403_FORBIDDEN,\n                    detail=\"'allow_user_auth' not set or set to False\",\n                )\n\n        ## Check END-USER OBJECT\n        _end_user_object = None\n        end_user_params: Final = {}\n\n        raw_end_user_id: Final = get_end_user_id_from_request_body(request_data, _safe_get_request_headers(request))","sourceCodeStart":1471,"sourceCodeEnd":1507,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/auth/user_api_key_auth.py#L1471-L1507","documentation":"Raised when the proxy has a master key configured (making authentication mandatory) but the request contained no API key at all — no usable `Authorization: Bearer` header, no `x-litellm-api-key` header, and no key elsewhere. It is a plain `Exception`, so the response status depends on the proxy's exception wrapping (usually surfaced as an auth failure / 500-shaped error, not a clean 401).","triggerScenarios":"`master_key` is set and a client calls any protected route with no Authorization header at all, e.g. `curl http://proxy:4000/v1/chat/completions -d '{...}'`, or an OpenAI SDK client built with an unset `api_key` so no header is attached.","commonSituations":"Scripts that worked before a master key was added; env var holding the key never exported so the client silently sends nothing; health checks or monitoring probes hitting protected endpoints; Kubernetes readiness probes not sending credentials.","solutions":["Send the key: `Authorization: Bearer <key>` or `x-litellm-api-key: <key>` where key is the master key or a virtual key","Verify the client actually attaches the key — e.g. `OpenAI(base_url=..., api_key=os.environ['PROXY_KEY'])` with the var truly set","For probes, point them at an unauthenticated health route instead of removing auth on business routes"],"exampleFix":"# before\nclient = OpenAI(base_url=\"http://proxy:4000\", api_key=os.getenv(\"PROXY_KEY\"))  # var unset -> no header\n\n# after\nkey = os.environ[\"PROXY_KEY\"]  # KeyError at startup, not 500 per request\nclient = OpenAI(base_url=\"http://proxy:4000\", api_key=key)","handlingStrategy":"validation","validationCode":"key = os.environ.get(\"PROXY_KEY\")\nif key is None:\n    raise RuntimeError(\"PROXY_KEY not set — refusing to call proxy without credentials\")\nclient = OpenAI(base_url=PROXY, api_key=key)","typeGuard":"def has_api_key(client) -> bool:\n    return bool(getattr(client, \"api_key\", None))","tryCatchPattern":"try:\n    client.chat.completions.create(...)\nexcept Exception as e:\n    if \"No api key passed in\" in str(e):\n        raise RuntimeError(\"missing Authorization header — check client credentials\") from e\n    raise","preventionTips":["Construct clients with os.environ[KEY] (KeyError at startup) instead of os.getenv (silent None)","Add a pre-flight authenticated call (/health/liveliness or /models) at service boot to fail fast","Let orchestrators inject credentials via secrets rather than baking optional env lookups into code"],"tags":["auth","api-key","missing-credentials","litellm"],"backgroundTag":"missing-api-key","analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}