From 6a618c51d3c236d8b2cfe72dbb841a0d5d3a99a4 Mon Sep 17 00:00:00 2001 From: Ishaan Jaffer Date: Thu, 7 May 2026 10:06:55 -0700 Subject: [PATCH] feat(v2 managed agents): add litellm_api_key masking helper --- litellm/managed_agents/masking.py | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 litellm/managed_agents/masking.py diff --git a/litellm/managed_agents/masking.py b/litellm/managed_agents/masking.py new file mode 100644 index 00000000000..b19e431a387 --- /dev/null +++ b/litellm/managed_agents/masking.py @@ -0,0 +1,19 @@ +"""Masking helpers for managed agents. + +The agent's `litellm_api_key` is stored encrypted-at-rest by the proxy and +returned masked on every read — `sk-abc123def456` → `sk-a****`. +""" + + +def mask_litellm_api_key(key: str) -> str: + """Return a masked form of a LiteLLM API key. + + Pattern: keep the first 4 characters of the key (including any + `sk-`-style prefix), then append `****`. For very short keys, mask + everything to avoid leaking too much. + """ + if not key: + return "" + if len(key) <= 4: + return "****" + return f"{key[:4]}****"