diff --git a/litellm/managed_agents/masking.py b/litellm/managed_agents/masking.py
new file mode 100644
index 00000000000..b19e431a387
--- /dev/null
+++ b/litellm/managed_agents/masking.py
@@ -0,0 +1,19 @@
+"""Masking helpers for managed agents.
+
+The agent's `litellm_api_key` is stored encrypted-at-rest by the proxy and
+returned masked on every read — `sk-abc123def456` → `sk-a****`.
+"""
+
+
+def mask_litellm_api_key(key: str) -> str:
+    """Return a masked form of a LiteLLM API key.
+
+    Pattern: keep the first 4 characters of the key (including any
+    `sk-`-style prefix), then append `****`. For very short keys, mask
+    everything to avoid leaking too much.
+    """
+    if not key:
+        return ""
+    if len(key) <= 4:
+        return "****"
+    return f"{key[:4]}****"