From 15a6664171f2ba2b559db1ea333db44996a9a7df Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Sun, 9 Aug 2026 02:17:44 +0000
Subject: [PATCH] fix(search): keep signed auth headers out of logging
 callbacks

Log the pre-signing headers in the search pre_call hook so SigV4 and bearer Authorization values are never handed to user-configured logger callbacks, and tighten sign_request's annotations.

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
---
 litellm/llms/base_llm/search/transformation.py | 8 ++++----
 litellm/llms/bedrock/search/transformation.py  | 8 ++++----
 litellm/llms/custom_httpx/llm_http_handler.py  | 4 ++--
 3 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/litellm/llms/base_llm/search/transformation.py b/litellm/llms/base_llm/search/transformation.py
index fad4be538c7..59039d68ede 100644
--- a/litellm/llms/base_llm/search/transformation.py
+++ b/litellm/llms/base_llm/search/transformation.py
@@ -180,12 +180,12 @@ class BaseSearchConfig:
 
     def sign_request(
         self,
-        headers: dict,  # mutable-ok: matches the request header dict every other hook on this base takes
-        optional_params: dict,  # mutable-ok: matches the optional params dict every other hook on this base takes
-        request_data: dict | list[dict],  # mutable-ok: matches transform_search_request's JSON body return type
+        headers: dict[str, str],  # mutable-ok: matches the request header dict every other hook on this base takes
+        optional_params: dict[str, object],  # mutable-ok: matches every other hook on this base
+        request_data: dict[str, object] | list[dict[str, object]],  # mutable-ok: transform_search_request's body
         api_base: str,
         api_key: str | None = None,
-    ) -> tuple[dict, bytes | None]:  # mutable-ok: the handler passes these headers straight to httpx
+    ) -> tuple[dict[str, str], bytes | None]:  # mutable-ok: the handler passes these headers straight to httpx
         """
         OPTIONAL
 
diff --git a/litellm/llms/bedrock/search/transformation.py b/litellm/llms/bedrock/search/transformation.py
index f6d852ffb0a..ca9759ed151 100644
--- a/litellm/llms/bedrock/search/transformation.py
+++ b/litellm/llms/bedrock/search/transformation.py
@@ -221,12 +221,12 @@ class AgentCoreSearchConfig(BaseSearchConfig, BaseAWSLLM):
 
     def sign_request(
         self,
-        headers: dict,  # mutable-ok: BaseSearchConfig hands providers the mutable request header dict
-        optional_params: dict,  # mutable-ok: BaseSearchConfig passes optional params as a dict
-        request_data: dict | list[dict],  # mutable-ok: BaseSearchConfig request bodies are JSON dicts
+        headers: dict[str, str],  # mutable-ok: BaseSearchConfig hands providers the mutable request header dict
+        optional_params: dict[str, object],  # mutable-ok: BaseSearchConfig passes optional params as a dict
+        request_data: dict[str, object] | list[dict[str, object]],  # mutable-ok: request bodies are JSON dicts
         api_base: str,
         api_key: str | None = None,
-    ) -> tuple[dict, bytes | None]:  # mutable-ok: BaseSearchConfig.sign_request returns httpx headers
+    ) -> tuple[dict[str, str], bytes | None]:  # mutable-ok: BaseSearchConfig.sign_request returns httpx headers
         """
         Authenticate the MCP request.
 
diff --git a/litellm/llms/custom_httpx/llm_http_handler.py b/litellm/llms/custom_httpx/llm_http_handler.py
index 3ee79241d30..b2f8c21d83c 100644
--- a/litellm/llms/custom_httpx/llm_http_handler.py
+++ b/litellm/llms/custom_httpx/llm_http_handler.py
@@ -1755,7 +1755,7 @@ class BaseLLMHTTPHandler:
             additional_args={
                 "complete_input_dict": data,
                 "api_base": complete_url,
-                "headers": signed_headers,
+                "headers": headers,
             },
         )
 
@@ -1848,7 +1848,7 @@ class BaseLLMHTTPHandler:
             additional_args={
                 "complete_input_dict": data,
                 "api_base": complete_url,
-                "headers": signed_headers,
+                "headers": headers,
             },
         )