From 4c7bd5bf17f83f01930d1950bb9497954ab0d62e Mon Sep 17 00:00:00 2001 From: Ishaan Jaff Date: Wed, 24 Jun 2026 13:27:13 -0700 Subject: [PATCH] fix(proxy): restore verify_key body mangled by suggestion merge; propagate 5xx instead of masking as 401 --- litellm/proxy/auth/internal_auth_endpoints.py | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/litellm/proxy/auth/internal_auth_endpoints.py b/litellm/proxy/auth/internal_auth_endpoints.py index 058671df47a..a96edc911ad 100644 --- a/litellm/proxy/auth/internal_auth_endpoints.py +++ b/litellm/proxy/auth/internal_auth_endpoints.py @@ -133,17 +133,17 @@ async def verify_key(body: VerifyKeyRequest) -> dict[str, Any]: ) synthetic_request = _synthetic_request( route=body.route, api_key=bearer_key, model=body.model + ) + try: + auth = await user_api_key_auth(request=synthetic_request, api_key=bearer_key) except (ProxyException, HTTPException) as exc: # Expected auth failures (invalid / expired / over-budget / blocked) → 401 # with a minimal body so internals aren't leaked. Unexpected errors (e.g. a - # DB outage, misconfigured master key) are deliberately NOT caught here: - # they surface as 500 rather than masquerading as "invalid key". The data - # plane still fails closed — it rejects any non-200 from this endpoint. + # DB outage, misconfigured master key) surface as 5xx rather than + # masquerading as "invalid key" — the data plane still fails closed (it + # rejects any non-200 from this endpoint). if isinstance(exc, HTTPException) and exc.status_code >= 500: - raise # let 5xx propagate so operators can see the real error - raise HTTPException(status_code=401, detail="invalid api key") - # than masquerading as "invalid key". The data plane still fails closed — - # it rejects any non-200 from this endpoint. + raise # let 5xx propagate so operators see the real error raise HTTPException(status_code=401, detail="invalid api key") return auth.model_dump(exclude_none=True, mode="json")