diff --git a/basedpyright-code-budget.json b/basedpyright-code-budget.json
index 5607a170e33..a7ec31f2ffd 100644
--- a/basedpyright-code-budget.json
+++ b/basedpyright-code-budget.json
@@ -57,7 +57,7 @@
     "limit": 5681
   },
   "reportMissingTypeArgument": {
-    "limit": 15608
+    "limit": 15605
   },
   "reportMissingTypeStubs": {
     "limit": 40
@@ -108,7 +108,7 @@
     "limit": 39154
   },
   "reportUnknownParameterType": {
-    "limit": 19947
+    "limit": 19944
   },
   "reportUnknownVariableType": {
     "limit": 30772
@@ -132,7 +132,7 @@
     "limit": 27
   },
   "reportUnusedClass": {
-    "limit": 23
+    "limit": 21
   },
   "reportUnusedFunction": {
     "limit": 139
diff --git a/enterprise/pyproject.toml b/enterprise/pyproject.toml
index 7a8031216e0..bb580c82760 100644
--- a/enterprise/pyproject.toml
+++ b/enterprise/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "litellm-enterprise"
-version = "0.1.56"
+version = "0.1.57"
 description = "Package for LiteLLM Enterprise features"
 readme = "README.md"
 requires-python = ">=3.9"
@@ -26,7 +26,7 @@ required-version = ">=0.10.9"
 module-root = ""
 
 [tool.commitizen]
-version = "0.1.56"
+version = "0.1.57"
 version_files = [
     "pyproject.toml:^version",
     "../pyproject.toml:litellm-enterprise==",
diff --git a/litellm-proxy-extras/pyproject.toml b/litellm-proxy-extras/pyproject.toml
index e39f0dcf55a..e1d62b70c29 100644
--- a/litellm-proxy-extras/pyproject.toml
+++ b/litellm-proxy-extras/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "litellm-proxy-extras"
-version = "0.4.86"
+version = "0.4.87"
 description = "Additional files for the LiteLLM Proxy. Reduces the size of the main litellm package."
 readme = "README.md"
 requires-python = ">=3.9"
@@ -26,7 +26,7 @@ required-version = ">=0.10.9"
 module-root = ""
 
 [tool.commitizen]
-version = "0.4.86"
+version = "0.4.87"
 version_files = [
     "pyproject.toml:^version",
     "../pyproject.toml:litellm-proxy-extras==",
diff --git a/litellm/_logging.py b/litellm/_logging.py
index 6add9d79a5b..7d3a30c6d1a 100644
--- a/litellm/_logging.py
+++ b/litellm/_logging.py
@@ -10,7 +10,7 @@ from typing import Any, Final
 import litellm
 from litellm.litellm_core_utils.safe_json_dumps import safe_dumps
 from litellm.litellm_core_utils.safe_json_loads import safe_json_loads
-from litellm.litellm_core_utils.secret_redaction import redact_string
+from litellm.litellm_core_utils.secret_redaction import redact_string, redact_structured_value
 
 set_verbose = False
 
@@ -59,6 +59,12 @@ def _redact_string(value: str) -> str:
     return redact_string(value)
 
 
+def _redact_structured_value(key: str | None, value: str) -> str:
+    if not _ENABLE_SECRET_REDACTION:
+        return value
+    return redact_structured_value(key, value)
+
+
 def redact_secrets(value: str) -> str:
     """Public API: redact known secret/credential patterns from an arbitrary string.
 
@@ -265,7 +271,7 @@ class JsonFormatter(Formatter):
         if record.exc_info:
             json_record["stacktrace"] = record.exc_text or self.formatException(record.exc_info)
 
-        return safe_dumps(json_record)
+        return safe_dumps(json_record, value_transform=_redact_structured_value)
 
 
 class CorrelationPlainFormatter(logging.Formatter):
@@ -276,7 +282,7 @@ class CorrelationPlainFormatter(logging.Formatter):
     """
 
     def format(self, record: logging.LogRecord) -> str:
-        formatted: Final = super().format(record)
+        formatted: Final = _redact_string(super().format(record))
         trace_id: Final = getattr(record, "trace_id", None)
         session_id: Final = getattr(record, "session_id", None)
         if not trace_id and not session_id:
diff --git a/litellm/integrations/opentelemetry.py b/litellm/integrations/opentelemetry.py
index 9363db12385..f2bd18cd046 100644
--- a/litellm/integrations/opentelemetry.py
+++ b/litellm/integrations/opentelemetry.py
@@ -20,6 +20,7 @@ from litellm.integrations.opentelemetry_utils.gen_ai_semconv import (
     OTELSemconvCategory,
     parse_semconv_opt_in,
 )
+from litellm.integrations.otel.model.db_endpoint import db_span_attributes
 from litellm.integrations.otel.model.semconv import Metric
 from litellm.litellm_core_utils.safe_json_dumps import safe_dumps
 from litellm.litellm_core_utils.secret_redaction import redact_string
@@ -718,6 +719,28 @@ class OpenTelemetry(OTELGenAISemconvMixin, CustomLogger):
     async def async_log_failure_event(self, kwargs, response_obj, start_time, end_time):
         self._handle_failure(kwargs, response_obj, start_time, end_time)
 
+    def _start_service_span(self, payload: ServiceLoggerPayload, parent_otel_span: Span, start_time_ns: int) -> Span:
+        """Open a service span, named and classified by what the service is.
+
+        A datastore call is an outbound CLIENT span carrying ``db.*`` semconv.
+        Without those a Postgres span says only ``service=postgres``, so the
+        backend falls back to the transport peer, which for Prisma is the local
+        query engine on loopback. Everything else stays an INTERNAL span.
+        """
+        from opentelemetry import trace
+        from opentelemetry.trace import SpanKind
+
+        attributes: Final = db_span_attributes(payload.service.value, payload.call_type)
+        span: Final = self.tracer.start_span(
+            name=payload.service,
+            context=trace.set_span_in_context(parent_otel_span),
+            start_time=start_time_ns,
+            kind=SpanKind.CLIENT if attributes else SpanKind.INTERNAL,
+        )
+        for key, value in attributes.items():
+            self.safe_set_attribute(span=span, key=key, value=value)
+        return span
+
     async def async_service_success_hook(
         self,
         payload: ServiceLoggerPayload,
@@ -726,7 +749,6 @@ class OpenTelemetry(OTELGenAISemconvMixin, CustomLogger):
         end_time: datetime | float | None = None,
         event_metadata: dict | None = None,
     ):
-        from opentelemetry import trace
         from opentelemetry.trace import Status, StatusCode
 
         _start_time_ns = 0
@@ -743,12 +765,7 @@ class OpenTelemetry(OTELGenAISemconvMixin, CustomLogger):
             _end_time_ns = self._to_ns(end_time)
 
         if parent_otel_span is not None:
-            _span_name: Final = payload.service
-            service_logging_span: Final = self.tracer.start_span(
-                name=_span_name,
-                context=trace.set_span_in_context(parent_otel_span),
-                start_time=_start_time_ns,
-            )
+            service_logging_span: Final = self._start_service_span(payload, parent_otel_span, _start_time_ns)
             self.safe_set_attribute(
                 span=service_logging_span,
                 key="call_type",
@@ -786,7 +803,6 @@ class OpenTelemetry(OTELGenAISemconvMixin, CustomLogger):
         end_time: float | datetime | None = None,
         event_metadata: dict | None = None,
     ):
-        from opentelemetry import trace
         from opentelemetry.trace import Status, StatusCode
 
         _start_time_ns = 0
@@ -803,12 +819,7 @@ class OpenTelemetry(OTELGenAISemconvMixin, CustomLogger):
             _end_time_ns = self._to_ns(end_time)
 
         if parent_otel_span is not None:
-            _span_name: Final = payload.service
-            service_logging_span: Final = self.tracer.start_span(
-                name=_span_name,
-                context=trace.set_span_in_context(parent_otel_span),
-                start_time=_start_time_ns,
-            )
+            service_logging_span: Final = self._start_service_span(payload, parent_otel_span, _start_time_ns)
             self.safe_set_attribute(
                 span=service_logging_span,
                 key="call_type",
diff --git a/litellm/integrations/otel/mappers/genai.py b/litellm/integrations/otel/mappers/genai.py
index 032441535e0..79487e69ac4 100644
--- a/litellm/integrations/otel/mappers/genai.py
+++ b/litellm/integrations/otel/mappers/genai.py
@@ -18,6 +18,7 @@ from litellm.integrations.otel.mappers.utils import (
     serialize_messages,
     tool_definition_attrs,
 )
+from litellm.integrations.otel.model.db_endpoint import db_span_attributes
 from litellm.integrations.otel.model.payloads import (
     GuardrailSpanData,
     LLMCallSpanData,
@@ -27,7 +28,6 @@ from litellm.integrations.otel.model.payloads import (
     ToolDefinition,
 )
 from litellm.integrations.otel.model.semconv import (
-    DB,
     MCP,
     Error,
     GenAI,
@@ -36,7 +36,6 @@ from litellm.integrations.otel.model.semconv import (
     RpcSystem,
     Server,
 )
-from litellm.integrations.otel.model.spans import db_system
 
 
 class GenAIMapper:
@@ -182,12 +181,8 @@ class GenAIMapper:
     def _service(cls, data: ServiceSpanData) -> AttributeMap:
         attrs: Final = collect(cls._SERVICE_ATTRS, data)
         # An outbound datastore call (DB_CALL / CLIENT span) also carries db.*
-        # semconv. Internal services (router, budget jobs, …) have no db.system,
-        # so they get only the litellm.service.* keys above.
-        system: Final = db_system(data.service_name)
-        if system is not None:
-            attrs[DB.SYSTEM_NAME] = system
-            if data.call_type:
-                attrs[DB.OPERATION_NAME] = data.call_type
+        # semconv naming the server it reached. Internal services (router, budget
+        # jobs, …) have no db.system, so they get only the litellm.service.* keys.
+        attrs.update(db_span_attributes(data.service_name, data.call_type))
         attrs.update({f"{LiteLLM.METADATA_PREFIX}{key}": value for key, value in data.event_metadata.items()})
         return attrs
diff --git a/litellm/integrations/otel/model/db_endpoint.py b/litellm/integrations/otel/model/db_endpoint.py
new file mode 100644
index 00000000000..562162a8f31
--- /dev/null
+++ b/litellm/integrations/otel/model/db_endpoint.py
@@ -0,0 +1,164 @@
+"""OTel ``db.*`` / ``server.*`` attributes naming the database litellm talks to.
+
+Prisma reaches PostgreSQL through a query engine listening on loopback, so
+transport-level instrumentation attributes the work to ``localhost`` and an
+operator cannot tell it is a PostgreSQL call or correlate it with the database's
+own metrics. These attributes name the real server on litellm's DB spans.
+
+Only the host, port, database and schema of the DSN are read, so no credential
+can reach an exporter.
+"""
+
+from __future__ import annotations
+
+import os
+from collections.abc import Mapping, Sequence
+from dataclasses import dataclass
+from types import MappingProxyType
+from typing import Final
+from urllib.parse import ParseResult, parse_qs, unquote, urlparse
+
+from litellm.integrations.otel.model.semconv import DB, Server
+from litellm.integrations.otel.model.spans import POSTGRESQL, db_system
+
+_DATABASE_URL_ENV: Final = "DATABASE_URL"
+_READ_REPLICA_ENV: Final = "DATABASE_URL_READ_REPLICA"
+_DEFAULT_POSTGRES_PORT: Final = 5432
+_DEFAULT_POSTGRES_SCHEMA: Final = "public"
+_POSTGRES_SCHEMES: Final = frozenset({"postgres", "postgresql"})
+_EMPTY_ATTRIBUTES: Final[Mapping[str, str | int]] = MappingProxyType({})
+
+
+@dataclass(frozen=True, slots=True)
+class DatabaseEndpoint:
+    """The non-sensitive identity of a PostgreSQL server, parsed from a DSN."""
+
+    address: str | None
+    port: int | None
+    namespace: str | None
+
+
+def parse_database_endpoint(url: str | None) -> DatabaseEndpoint | None:
+    """Parse a PostgreSQL DSN into its exportable endpoint identity.
+
+    Returns ``None`` for an absent, malformed or non-PostgreSQL URL rather than
+    raising: an unparseable DSN must degrade to a span without endpoint
+    attributes, never break the request that emitted it.
+    """
+    if not url:
+        return None
+    try:
+        parsed: Final = urlparse(url)
+        if parsed.scheme not in _POSTGRES_SCHEMES:
+            return None
+        query: Final = parse_qs(parsed.query)
+        raw_database: Final = (parsed.path or "").lstrip("/")
+        if _is_misparsed_authority(parsed, url, raw_database):
+            return None
+        # ``host=`` beats the netloc: it is how libpq names a Unix socket
+        # directory and how the Cloud SQL connector sits behind a localhost
+        # netloc, where the netloc is the very answer this module replaces.
+        address: Final = _first(query.get("host")) or parsed.hostname
+        # ``port=`` accompanies ``host=`` in a libpq URI, so honour it the same way.
+        port: Final = _port(_first(query.get("port")), parsed.port) if address else None
+        namespace: Final = _namespace(unquote(raw_database), _first(query.get("schema")))
+    except ValueError:
+        return None
+    if address is None and namespace is None:
+        return None
+    return DatabaseEndpoint(address=address, port=port, namespace=namespace)
+
+
+def _is_misparsed_authority(parsed: ParseResult, url: str, raw_database: str) -> bool:
+    """Whether the URL authority may have been truncated by an unencoded character.
+
+    ``/``, ``#`` or ``?`` in a password ends the netloc early, so urlparse hands
+    back the username as the host, the leading digits of the password as the
+    port, and the rest of the credential as the path, query or fragment. The
+    stranded userinfo ``@`` is the only surviving evidence.
+
+    A database name cannot hold an unencoded slash either, so a second path
+    segment is the same evidence.
+
+    A DSN that carries the at-sign in a query parameter instead, such as
+    ``?application_name=svc@prod``, is indistinguishable from a mis-split by any
+    property of the parse: both leave no userinfo, a host, a port and a path.
+    Since guessing wrong publishes a credential fragment to a tracing backend,
+    that ambiguity resolves to refusing the endpoint. Such a DSN loses
+    ``server.address`` and ``db.namespace`` and keeps the rest of the span,
+    which is the cheaper error of the two. Percent-encode the at-sign to keep
+    them.
+    """
+    if "/" in raw_database:
+        return True
+    return "@" in url and "@" not in parsed.netloc
+
+
+def _first(values: Sequence[str] | None) -> str:
+    return values[0] if values else ""
+
+
+def _port(from_query: str, from_netloc: int | None) -> int:
+    return int(from_query) if from_query.isdigit() else (from_netloc or _DEFAULT_POSTGRES_PORT)
+
+
+def _namespace(database: str, schema: str) -> str | None:
+    """``{database}|{schema}`` per the PostgreSQL semconv, dropping absent halves.
+
+    Only Prisma's literal default schema stays implicit. The match is
+    case-sensitive because Prisma quotes the name, so ``?schema=PUBLIC`` builds
+    a second schema alongside ``public`` and the two must not collapse to one
+    namespace.
+    """
+    qualifier: Final = "" if schema == _DEFAULT_POSTGRES_SCHEMA else schema
+    return "|".join(part for part in (database, qualifier) if part) or None
+
+
+def postgres_endpoint() -> DatabaseEndpoint | None:
+    """The PostgreSQL endpoint the process is currently connected to.
+
+    Read from ``os.environ`` on every span, deliberately, on both counts.
+
+    The environment is what Prisma itself connects with, so the span cannot
+    disagree with the connection; ``get_secret_str`` would consult a configured
+    secret manager first and could name a different server than the one serving
+    the query. And the value is not static: the RDS IAM refresh rebuilds the URL
+    from ``DATABASE_HOST``/``PORT``/``NAME``/``SCHEMA`` every rotation, the
+    reconnect path re-reads ``DATABASE_URL``, and the DB-backed
+    ``environment_variables`` config overlay can rewrite any of them after
+    startup, so a value cached for the process lifetime goes stale against a
+    connection that has genuinely moved. Nothing is memoized either: a cache
+    keyed on the URL would hold a rotated credential past its rotation, and the
+    parse is a single ``urlparse`` on a short string.
+
+    A configured read replica yields ``None``: ``RoutingPrismaWrapper`` picks
+    reader or writer per Prisma call, underneath the span, so naming the writer
+    would attribute replica reads to the primary.
+    """
+    if os.environ.get(_READ_REPLICA_ENV):
+        return None
+    return parse_database_endpoint(os.environ.get(_DATABASE_URL_ENV, ""))
+
+
+def db_span_attributes(service_name: str, call_type: str | None = None) -> Mapping[str, str | int]:
+    """The ``db.*``/``server.*`` attributes for a datastore service call.
+
+    Empty for services that are not outbound datastore calls. Endpoint
+    attributes are PostgreSQL-only: ``DATABASE_URL`` says nothing about where
+    the redis-backed services point. ``db.system`` rides alongside the current
+    ``db.system.name`` because Datadog's OTLP intake still types a database span
+    from the older key.
+    """
+    system: Final = db_system(service_name)
+    if system is None:
+        return _EMPTY_ATTRIBUTES
+    endpoint: Final = postgres_endpoint() if system == POSTGRESQL else None
+    pairs: Final[tuple[tuple[str, str | int | None], ...]] = (
+        (DB.SYSTEM_NAME, system),
+        (DB.SYSTEM_LEGACY, system),
+        (DB.OPERATION_NAME, call_type),
+        (Server.ADDRESS, endpoint.address if endpoint is not None else None),
+        (Server.PORT, endpoint.port if endpoint is not None else None),
+        (DB.NAMESPACE, endpoint.namespace if endpoint is not None else None),
+    )
+    return MappingProxyType({key: value for key, value in pairs if value})
diff --git a/litellm/integrations/otel/model/semconv.py b/litellm/integrations/otel/model/semconv.py
index 3d585c36b67..ada2822ba66 100644
--- a/litellm/integrations/otel/model/semconv.py
+++ b/litellm/integrations/otel/model/semconv.py
@@ -238,7 +238,11 @@ class DB:
     """
 
     SYSTEM_NAME: Final = "db.system.name"
+    # Superseded by SYSTEM_NAME, dual-emitted because Datadog's OTLP intake
+    # still infers a span's database type from this key.
+    SYSTEM_LEGACY: Final = "db.system"
     OPERATION_NAME: Final = "db.operation.name"
+    NAMESPACE: Final = "db.namespace"
 
 
 class HTTP:
diff --git a/litellm/integrations/otel/model/spans.py b/litellm/integrations/otel/model/spans.py
index 0f67f0e7a7c..08318f78b7c 100644
--- a/litellm/integrations/otel/model/spans.py
+++ b/litellm/integrations/otel/model/spans.py
@@ -115,10 +115,12 @@ SPAN_REGISTRY: Final[dict[SpanRole, SpanSpec]] = {
 # redis-backed spend queues. Any service not mapped here is litellm-internal work
 # and stays an INTERNAL ``SERVICE`` span. This table is the single source of
 # datastore knowledge — both the role classifier and the mapper read it.
+POSTGRESQL: Final = "postgresql"
+
 _DB_SYSTEM_BY_SERVICE: Final[dict[str, str]] = {
     "redis": "redis",
-    "postgres": "postgresql",
-    "batch_write_to_db": "postgresql",
+    "postgres": POSTGRESQL,
+    "batch_write_to_db": POSTGRESQL,
 }
 
 
diff --git a/litellm/litellm_core_utils/litellm_logging.py b/litellm/litellm_core_utils/litellm_logging.py
index 58300d87a5a..b20c75bbc2a 100644
--- a/litellm/litellm_core_utils/litellm_logging.py
+++ b/litellm/litellm_core_utils/litellm_logging.py
@@ -1094,10 +1094,10 @@ class Logging(LiteLLMLoggingBaseClass):
                             data=additional_args.get("complete_input_dict", {}),
                         )
 
-                        _metadata["raw_request"] = str(curl_command)
+                        _metadata["raw_request"] = _redact_string(str(curl_command))
                         # split up, so it's easier to parse in the UI
                         self.model_call_details["raw_request_typed_dict"] = RawRequestTypedDict(
-                            raw_request_api_base=str(additional_args.get("api_base") or ""),
+                            raw_request_api_base=self._get_masked_api_base(str(additional_args.get("api_base") or "")),
                             raw_request_body=self._get_raw_request_body(additional_args.get("complete_input_dict", {})),
                             # NOTE: setting ignore_sensitive_headers to True will cause
                             # the Authorization header to be leaked when calls to the health
@@ -1111,8 +1111,10 @@ class Logging(LiteLLMLoggingBaseClass):
                     self.model_call_details["raw_request_typed_dict"] = RawRequestTypedDict(
                         error=str(e),
                     )
-                    _metadata["raw_request"] = f"Unable to Log \
+                    _metadata["raw_request"] = _redact_string(
+                        f"Unable to Log \
                         raw request: {e}"
+                    )
             if getattr(self, "logger_fn", None) and callable(self.logger_fn):
                 try:
                     self.logger_fn(
@@ -1206,15 +1208,16 @@ class Logging(LiteLLMLoggingBaseClass):
         if _is_debugging_on() or self.litellm_request_debug:
             if json_logs:
                 masked_headers: Final = self._get_masked_headers(headers)
+                masked_api_base: Final = self._get_masked_api_base(str(api_base or ""))
                 if self.litellm_request_debug:
                     verbose_logger.warning(  # .warning ensures this shows up in all environments
                         "POST Request Sent from LiteLLM",
-                        extra={"api_base": {api_base}, **masked_headers},
+                        extra={"api_base": {masked_api_base}, **masked_headers},
                     )
                 else:
                     verbose_logger.debug(
                         "POST Request Sent from LiteLLM",
-                        extra={"api_base": {api_base}, **masked_headers},
+                        extra={"api_base": {masked_api_base}, **masked_headers},
                     )
             else:
                 headers = additional_args.get("headers", {})
@@ -1254,8 +1257,6 @@ class Logging(LiteLLMLoggingBaseClass):
             curl_command = "\nRequest Sent from LiteLLM:\n"
             request_str: Final = additional_args.get("request_str", "")
             curl_command += request_str
-        elif api_base == "":
-            curl_command = str(self.model_call_details)
         return curl_command
 
     def _get_masked_headers(self, headers: dict, ignore_sensitive_headers: bool = False) -> dict:
diff --git a/litellm/litellm_core_utils/prompt_templates/common_utils.py b/litellm/litellm_core_utils/prompt_templates/common_utils.py
index 07d5e6314dd..e4c1c9fc5cf 100644
--- a/litellm/litellm_core_utils/prompt_templates/common_utils.py
+++ b/litellm/litellm_core_utils/prompt_templates/common_utils.py
@@ -1816,16 +1816,19 @@ def split_concatenated_json_objects(raw: str) -> list[dict[str, Any]]:
     This helper uses ``json.JSONDecoder.raw_decode()`` to walk the string
     and extract each JSON object individually.
 
+    The walk degrades gracefully: if the string is malformed or truncated
+    (e.g. a stream that ended mid-tool-call), whatever complete objects were
+    parsed before the bad tail are returned and the remainder is discarded
+    with a warning, rather than raising.  The sole caller
+    (``_convert_to_bedrock_tool_call_invoke``) treats an empty result as
+    ``input={}`` so the conversation can continue instead of hard-failing.
+
     Returns
     -------
     list[dict]
         A list of parsed dicts – one per JSON object found.  If *raw* is
-        empty or whitespace-only, an empty list is returned.
-
-    Raises
-    ------
-    json.JSONDecodeError
-        If the string contains text that cannot be parsed as JSON at all.
+        empty, whitespace-only, or wholly unparseable, an empty list is
+        returned.
     """
     import json
 
@@ -1845,7 +1848,17 @@ def split_concatenated_json_objects(raw: str) -> list[dict[str, Any]]:
         if idx >= length:
             break
 
-        obj, end_idx = decoder.raw_decode(raw, idx)
+        try:
+            obj, end_idx = decoder.raw_decode(raw, idx)
+        except json.JSONDecodeError as e:
+            verbose_logger.warning(
+                "split_concatenated_json_objects: discarding unparseable tool-call "
+                "arguments tail after %d complete object(s); decode_start=%d error=%s",
+                len(results),
+                idx,
+                e,
+            )
+            break
         if isinstance(obj, dict):
             results.append(obj)
         else:
diff --git a/litellm/litellm_core_utils/prompt_templates/factory.py b/litellm/litellm_core_utils/prompt_templates/factory.py
index 2ffe015c727..0ed15c43ccf 100644
--- a/litellm/litellm_core_utils/prompt_templates/factory.py
+++ b/litellm/litellm_core_utils/prompt_templates/factory.py
@@ -3712,7 +3712,13 @@ def _convert_to_bedrock_tool_call_invoke(
                         _parts_list.append(cache_point_block)
         return _parts_list
     except Exception as e:
-        raise Exception(f"Unable to convert openai tool calls={tool_calls} to bedrock tool calls. Received error={e}")
+        tool_call_ids: Final = tuple(tool.get("id") for tool in tool_calls if isinstance(tool, dict))
+        raise litellm.BadRequestError(
+            message=f"Unable to convert openai tool calls with ids={tool_call_ids} to bedrock tool calls. "
+            f"Received error={e}",
+            model=model or "",
+            llm_provider="bedrock",
+        ) from e
 
 
 def _append_bedrock_tool_result_media_block(
diff --git a/litellm/litellm_core_utils/safe_json_dumps.py b/litellm/litellm_core_utils/safe_json_dumps.py
index ebf45ed747c..a1b71593dda 100644
--- a/litellm/litellm_core_utils/safe_json_dumps.py
+++ b/litellm/litellm_core_utils/safe_json_dumps.py
@@ -1,4 +1,5 @@
 import json
+from collections.abc import Callable
 from typing import Any, Final
 
 from pydantic import BaseModel
@@ -11,20 +12,32 @@ def strip_null_bytes(value: str) -> str:
     return value.replace("\x00", "")
 
 
-def safe_dumps(data: Any, max_depth: int = DEFAULT_MAX_RECURSE_DEPTH) -> str:
+def safe_dumps(
+    data: Any,
+    max_depth: int = DEFAULT_MAX_RECURSE_DEPTH,
+    value_transform: Callable[[str | None, str], str] | None = None,
+) -> str:
     """
     Recursively serialize data while detecting circular references.
     If a circular reference is detected then a marker string is returned.
     NUL bytes are stripped from strings to prevent PostgreSQL 22P05 errors.
+
+    value_transform, when given, is applied to every string leaf (and to the
+    str() fallback for non-serializable objects) with the mapping key the leaf
+    was reached under, so callers can rewrite values without touching structure.
     """
 
-    def _serialize(obj: Any, seen: set, depth: int) -> Any:
+    def _transform(key: str | None, value: str) -> str:
+        return value if value_transform is None else value_transform(key, value)
+
+    def _serialize(obj: Any, seen: set, depth: int, key: str | None = None) -> Any:
         # Check for maximum depth.
         if depth > max_depth:
             return "MaxDepthExceeded"
         # Base-case: if it is a primitive, simply return it.
         if isinstance(obj, str):
-            return obj.replace("\x00", "") if "\x00" in obj else obj
+            cleaned = obj.replace("\x00", "") if "\x00" in obj else obj
+            return _transform(key, cleaned)
         if isinstance(obj, (int, float, bool, type(None))):
             return obj
         # Check for circular reference.
@@ -37,30 +50,30 @@ def safe_dumps(data: Any, max_depth: int = DEFAULT_MAX_RECURSE_DEPTH) -> str:
             for k, v in obj.items():
                 if isinstance(k, (str)):
                     clean_k = k.replace("\x00", "") if "\x00" in k else k
-                    result[clean_k] = _serialize(v, seen, depth + 1)
+                    result[clean_k] = _serialize(v, seen, depth + 1, clean_k)
             seen.remove(id(obj))
             return result
         elif isinstance(obj, list):
-            result = [_serialize(item, seen, depth + 1) for item in obj]
+            result = [_serialize(item, seen, depth + 1, key) for item in obj]
             seen.remove(id(obj))
             return result
         elif isinstance(obj, tuple):
-            result = tuple(_serialize(item, seen, depth + 1) for item in obj)
+            result = tuple(_serialize(item, seen, depth + 1, key) for item in obj)
             seen.remove(id(obj))
             return result
         elif isinstance(obj, set):
-            result = sorted([_serialize(item, seen, depth + 1) for item in obj])
+            result = sorted([_serialize(item, seen, depth + 1, key) for item in obj])
             seen.remove(id(obj))
             return result
         elif isinstance(obj, BaseModel):
             dumped: Final = obj.model_dump()
-            result = _serialize(dumped, seen, depth + 1)
+            result = _serialize(dumped, seen, depth + 1, key)
             seen.remove(id(obj))
             return result
         else:
             # Fall back to string conversion for non-serializable objects.
             try:
-                return strip_null_bytes(str(obj))
+                return _transform(key, strip_null_bytes(str(obj)))
             except Exception:
                 return "Unserializable Object"
 
diff --git a/litellm/litellm_core_utils/secret_redaction.py b/litellm/litellm_core_utils/secret_redaction.py
index c991a953530..5d5bd547d22 100644
--- a/litellm/litellm_core_utils/secret_redaction.py
+++ b/litellm/litellm_core_utils/secret_redaction.py
@@ -24,9 +24,6 @@ def _build_secret_patterns() -> "re.Pattern[str]":
         r"(?:client_secret|azure_password|azure_username)\s+[^\s,'\"})\]{}>]+",
         # AWS access key IDs
         r"(?:AKIA|ASIA)[0-9A-Z]{16}",
-        # AWS secrets / session tokens / access key IDs (key=value)
-        r"(?:aws_secret_access_key|aws_session_token|aws_access_key_id)"
-        r"\s*[:=]\s*[A-Za-z0-9/+=]{20,}",
         # Bearer tokens (OAuth, JWT, etc.)
         r"Bearer\s+[A-Za-z0-9\-._~+/]{10,}=*",
         # Basic auth headers
@@ -61,6 +58,7 @@ def _build_secret_patterns() -> "re.Pattern[str]":
         # private_key with PEM-aware value capture
         r"""private_key['\"]?\s*[:=]\s*['\"]?(?:-----BEGIN[A-Z \-]*PRIVATE KEY-----[\s\S]*?-----END[A-Z \-]*PRIVATE KEY-----|[^\s,'\"})\]{}>]+)""",
         r"(?:master_key|xai_key|database_url|db_url|connection_string|"
+        r"aws_secret_access_key|aws_session_token|aws_access_key_id|"
         r"signing_key|encryption_key|"
         r"auth_token|access_token|refresh_token|"
         r"slack_webhook_url|webhook_url|"
@@ -83,3 +81,19 @@ _SECRET_RE: Final = _build_secret_patterns()
 def redact_string(value: str) -> str:
     """Scrub known secret/credential patterns from *value* and return the result."""
     return _SECRET_RE.sub(_REDACTED, value)
+
+
+def redact_structured_value(key: str | None, value: str) -> str:
+    """Scrub *value* as it appeared under *key* inside a structured record.
+
+    redact_string() replaces a whole ``key: value`` span with REDACTED, which is
+    fine inside free text but destroys the surrounding syntax when the span is a
+    JSON member rather than message content. This renders the pair the way a dict
+    repr would, so the key-name patterns still fire, but collapses only the value
+    so the caller's structure survives.
+    """
+    scrubbed: Final = redact_string(value)
+    if scrubbed != value or key is None:
+        return scrubbed
+    rendered: Final = f"'{key}': '{value}'"
+    return _REDACTED if redact_string(rendered) != rendered else value
diff --git a/litellm/llms/base_llm/chat/transformation.py b/litellm/llms/base_llm/chat/transformation.py
index 0d6d942e686..d147063df73 100644
--- a/litellm/llms/base_llm/chat/transformation.py
+++ b/litellm/llms/base_llm/chat/transformation.py
@@ -5,7 +5,7 @@ Common base config for all LLM providers
 import types
 from abc import ABC, abstractmethod
 from collections.abc import AsyncIterator, Iterator
-from typing import TYPE_CHECKING, Any, Final, Union, cast
+from typing import TYPE_CHECKING, Any, Final, Union
 
 import httpx
 from pydantic import BaseModel
@@ -90,9 +90,9 @@ class BaseConfig(ABC):
         return type_to_response_format_param(response_format=response_format)
 
     def is_thinking_enabled(self, non_default_params: dict) -> bool:
-        return (non_default_params.get("thinking") or {}).get("type") == "enabled" or non_default_params.get(
-            "reasoning_effort"
-        ) is not None
+        thinking: Final = non_default_params.get("thinking")
+        thinking_type: Final = thinking.get("type") if isinstance(thinking, dict) else None
+        return thinking is True or thinking_type == "enabled" or non_default_params.get("reasoning_effort") is not None
 
     def is_max_tokens_in_request(self, non_default_params: dict) -> bool:
         """
@@ -112,7 +112,10 @@ class BaseConfig(ABC):
         if is_thinking_enabled and (
             "max_tokens" not in non_default_params and "max_completion_tokens" not in non_default_params
         ):
-            thinking_token_budget: Final = cast(dict, optional_params["thinking"]).get("budget_tokens", None)
+            thinking_value: Final = optional_params.get("thinking")
+            thinking_token_budget: Final = (
+                thinking_value.get("budget_tokens") if isinstance(thinking_value, dict) else None
+            )
             if thinking_token_budget is not None:
                 optional_params["max_tokens"] = thinking_token_budget + DEFAULT_MAX_TOKENS
 
diff --git a/litellm/llms/bedrock/chat/converse_transformation.py b/litellm/llms/bedrock/chat/converse_transformation.py
index fd07999395b..cee89f42c2d 100644
--- a/litellm/llms/bedrock/chat/converse_transformation.py
+++ b/litellm/llms/bedrock/chat/converse_transformation.py
@@ -1090,7 +1090,10 @@ class AmazonConverseConfig(BaseConfig):
         is_thinking_enabled: Final = self.is_thinking_enabled(optional_params)
         is_max_tokens_in_request: Final = self.is_max_tokens_in_request(non_default_params)
         if is_thinking_enabled and not is_max_tokens_in_request:
-            thinking_token_budget: Final = cast(dict, optional_params["thinking"]).get("budget_tokens", None)
+            thinking_value: Final = optional_params.get("thinking")
+            thinking_token_budget: Final = (
+                thinking_value.get("budget_tokens") if isinstance(thinking_value, dict) else None
+            )
             if thinking_token_budget is not None:
                 optional_params["maxTokens"] = thinking_token_budget + DEFAULT_MAX_TOKENS
 
diff --git a/litellm/llms/custom_httpx/llm_http_handler.py b/litellm/llms/custom_httpx/llm_http_handler.py
index eccc783dd8b..3ee803646a9 100644
--- a/litellm/llms/custom_httpx/llm_http_handler.py
+++ b/litellm/llms/custom_httpx/llm_http_handler.py
@@ -2,7 +2,7 @@ import asyncio
 import json
 import os
 import ssl
-from collections.abc import AsyncIterator, Coroutine, Iterator, Mapping
+from collections.abc import AsyncIterator, Coroutine, Iterator, Mapping, Sequence
 from contextlib import asynccontextmanager
 from functools import lru_cache
 from types import ModuleType
@@ -73,6 +73,7 @@ from litellm.llms.custom_httpx.http_handler import (
 from litellm.responses.streaming_iterator import (
     BaseResponsesAPIStreamingIterator,
     MockResponsesAPIStreamingIterator,
+    ProjectQuotaCallback,
     ResponsesAPIStreamingIterator,
     ResponsesWebSocketStreaming,
     SyncResponsesAPIStreamingIterator,
@@ -256,6 +257,27 @@ def _has_pre_call_deployment_hook(logging_obj: LiteLLMLoggingObj) -> bool:
     return False
 
 
+def _collect_ws_project_quota_callbacks() -> tuple[ProjectQuotaCallback, ...]:
+    """Duck-type discover proxy hooks exposing per-frame project ITPM/OTPM
+    enforcement, so the Responses WebSocket loop can charge every
+    ``response.create`` frame, not just the connection's first one.
+
+    Uses duck-typing on ``litellm.callbacks`` (rather than importing the
+    proxy hook directly) to avoid a layering violation (SDK importing from
+    the proxy layer).
+    """
+    import litellm as _litellm
+
+    callbacks: Final = cast(  # cast-ok: callback registry is inspected before protocol use
+        Sequence[object], _litellm.callbacks
+    )
+    return tuple(
+        cast(ProjectQuotaCallback, callback)  # cast-ok: required callback method is callable
+        for callback in callbacks
+        if callable(getattr(callback, "enforce_project_io_token_quota_for_frame", None))
+    )
+
+
 class BaseLLMHTTPHandler:
     async def _make_common_async_call(
         self,
@@ -6179,6 +6201,8 @@ class BaseLLMHTTPHandler:
         - Uses ManagedResponsesWebSocketHandler which makes HTTP streaming calls
         - Forwards events over the websocket connection
         """
+        _ws_quota_callbacks: Final = _collect_ws_project_quota_callbacks()
+
         if responses_api_provider_config is None or not responses_api_provider_config.supports_native_websocket():
             from litellm.responses.streaming_iterator import (
                 ManagedResponsesWebSocketHandler,
@@ -6195,6 +6219,7 @@ class BaseLLMHTTPHandler:
                 timeout=timeout,
                 custom_llm_provider=custom_llm_provider,
                 first_message=first_message,
+                quota_callbacks=_ws_quota_callbacks,
                 **kwargs,
             )
             await handler.run()
@@ -6315,6 +6340,7 @@ class BaseLLMHTTPHandler:
                     first_message=first_message,
                     guardrail_callbacks=_ws_guardrail_callbacks,
                     output_guardrail_callbacks=_ws_output_guardrail_callbacks,
+                    quota_callbacks=_ws_quota_callbacks,
                     authorized_model=model,
                 )
                 await streaming.bidirectional_forward()
@@ -9407,6 +9433,27 @@ class BaseLLMHTTPHandler:
             )
 
     ###### VECTOR STORE HANDLER ######
+    @staticmethod
+    def _pre_call_direct_vector_store_search(
+        logging_obj: LiteLLMLoggingObj,
+        custom_llm_provider: str,
+        vector_store_id: str,
+        query: str | Sequence[str],
+    ) -> None:
+        """Direct providers have no HTTP request to echo, and an empty api_base makes the debug
+        logger fall back to dumping model_call_details, which holds stored provider credentials."""
+        endpoint: Final = f"{custom_llm_provider}://{vector_store_id}"
+        logging_obj.pre_call(
+            input="",
+            api_key="",
+            additional_args={  # mutable-ok: pre_call's additional_args contract is a dict
+                "query": query,
+                "vector_store_id": vector_store_id,
+                "api_base": endpoint,
+                "request_str": f"direct vector store search: {endpoint}",
+            },
+        )
+
     async def async_vector_store_search_handler(
         self,
         vector_store_id: str,
@@ -9423,13 +9470,11 @@ class BaseLLMHTTPHandler:
         _is_async: bool = False,
     ) -> VectorStoreSearchResponse:
         if isinstance(vector_store_provider_config, BaseDirectVectorStoreConfig):
-            logging_obj.pre_call(
-                input="",
-                api_key="",
-                additional_args={  # mutable-ok: pre_call's additional_args contract is a dict
-                    "query": query,
-                    "vector_store_id": vector_store_id,
-                },
+            self._pre_call_direct_vector_store_search(
+                logging_obj=logging_obj,
+                custom_llm_provider=custom_llm_provider,
+                vector_store_id=vector_store_id,
+                query=query,
             )
             return await vector_store_provider_config.aexecute_search_vector_store_request(
                 vector_store_id=vector_store_id,
@@ -9554,13 +9599,11 @@ class BaseLLMHTTPHandler:
             )
 
         if isinstance(vector_store_provider_config, BaseDirectVectorStoreConfig):
-            logging_obj.pre_call(
-                input="",
-                api_key="",
-                additional_args={  # mutable-ok: pre_call's additional_args contract is a dict
-                    "query": query,
-                    "vector_store_id": vector_store_id,
-                },
+            self._pre_call_direct_vector_store_search(
+                logging_obj=logging_obj,
+                custom_llm_provider=custom_llm_provider,
+                vector_store_id=vector_store_id,
+                query=query,
             )
             return vector_store_provider_config.execute_search_vector_store_request(
                 vector_store_id=vector_store_id,
diff --git a/litellm/llms/deepseek/chat/transformation.py b/litellm/llms/deepseek/chat/transformation.py
index 24da5b79261..566c960333a 100644
--- a/litellm/llms/deepseek/chat/transformation.py
+++ b/litellm/llms/deepseek/chat/transformation.py
@@ -131,9 +131,11 @@ class DeepSeekChatConfig(OpenAIGPTConfig):
           - model supports reasoning (capability check)
           - user explicitly passed thinking={"type": "enabled"} (opt-in check)
         """
+        thinking: Final = optional_params.get("thinking")
         return (
             supports_reasoning(model=model, custom_llm_provider="deepseek")
-            and (optional_params.get("thinking") or {}).get("type") == "enabled"
+            and isinstance(thinking, dict)
+            and thinking.get("type") == "enabled"
         )
 
     @staticmethod
diff --git a/litellm/llms/tinyfish/search/transformation.py b/litellm/llms/tinyfish/search/transformation.py
index ba9ca2e1bde..b688dc2cd01 100644
--- a/litellm/llms/tinyfish/search/transformation.py
+++ b/litellm/llms/tinyfish/search/transformation.py
@@ -14,6 +14,7 @@ import httpx
 from pydantic import TypeAdapter, ValidationError
 
 from litellm._logging import verbose_logger
+from litellm.litellm_core_utils.core_helpers import process_response_headers
 from litellm.litellm_core_utils.litellm_logging import Logging as LiteLLMLoggingObj
 from litellm.llms.base_llm.chat.transformation import BaseLLMException
 from litellm.llms.base_llm.search.transformation import (
@@ -22,7 +23,7 @@ from litellm.llms.base_llm.search.transformation import (
 )
 from litellm.secret_managers.main import get_secret_str
 
-_UrlEncodableParams: Final = TypeAdapter(dict[str, str | int | bool])
+_UrlEncodableParams: Final = TypeAdapter(dict[str, str | int | float | bool])
 _StrList: Final = TypeAdapter(list[str])
 _StrFrozenSet: Final = TypeAdapter(frozenset[str])
 
@@ -94,16 +95,16 @@ class TinyfishSearchConfig(BaseSearchConfig):
         TinyFish equivalents:
         - ``query`` (str or list[str]) → ``query`` (list joined by spaces)
         - ``country`` → ``location``
-        - ``search_domain_filter`` (list[str]) → folded into the query as
-          ``(<query>) (site:a OR site:b ...)`` (TinyFish has no first-class
-          field today; see ML-2084 for the planned ``include_domains``)
+        - ``search_domain_filter`` (list[str]) → folded into the query using
+          search operators
         - ``max_results`` → not sent on the wire; stashed on
           ``self._caller_max_results`` for client-side response truncation
           (TinyFish doesn't honor it server-side)
         - ``max_tokens_per_page`` → silently dropped (no TinyFish equivalent)
 
         Any other ``optional_params`` keys are forwarded to TinyFish as-is.
-        dict/list values are JSON-encoded so they survive ``urlencode``.
+        dict and list values are JSON-encoded so structured payloads survive
+        ``urlencode``.
 
         Returns:
             ``{_TINYFISH_PARAMS_KEY: <dict of querystring entries>}``.
@@ -144,14 +145,12 @@ class TinyfishSearchConfig(BaseSearchConfig):
         supported_perplexity: Final = _StrFrozenSet.validate_python(raw_supported)
         for param, value in optional_params.items():
             if param not in supported_perplexity and param not in request_data:
-                # `fetch` expects a JSON-encoded object on the wire; accept the
-                # natural Python dict form and serialize here so callers don't
-                # have to pre-stringify.
-                if isinstance(value, dict):
+                # Serialize dicts/lists as JSON so structured params survive urlencode.
+                if isinstance(value, (dict, list)):
                     value = json.dumps(value, separators=(",", ":"))
                 # `urlencode` would render Python bool as "True"/"False"
-                # (capitalized). ux-labs validators require lowercase
-                # "true"/"false" (e.g. `include_thumbnail`); normalize here.
+                # (capitalized). TinyFish Search's bool params require lowercase
+                # "true"/"false" strings on the wire; normalize here.
                 elif isinstance(value, bool):
                     value = "true" if value else "false"
                 request_data[param] = value
@@ -167,17 +166,35 @@ class TinyfishSearchConfig(BaseSearchConfig):
         """
         Transform a TinyFish response to LiteLLM's unified ``SearchResponse``.
 
-        Mappings (per-result):
-        - ``title`` → ``SearchResult.title`` (defaults to ``""`` if missing/null)
-        - ``url`` → ``SearchResult.url`` (defaults to ``""``)
-        - ``snippet`` → ``SearchResult.snippet`` (defaults to ``""``)
-        - all other per-result fields (``position``, ``site_name``,
-          ``thumbnail_url``, ``fetch``, ``fetch_error``, ...) ride through as
-          extras on ``SearchResult`` via its ``extra="allow"`` config.
+        Per-result field handling:
+        - ``title``, ``url``, ``snippet`` are declared on ``SearchResult`` and
+          populated by ``SearchResponse.model_validate`` when present. Missing
+          or ``None`` values are defaulted to ``""`` beforehand by
+          ``_default_missing_result_fields`` so a degraded result flows through
+          instead of failing the whole call.
+        - All undeclared per-result fields (``position``, ``site_name``, and
+          any others TinyFish returns) ride through as extras via
+          ``SearchResult``'s ``extra="allow"`` config — accessible as
+          attributes on the result object or enumerable via
+          ``result.model_extra``.
 
-        Top-level ``parameter_warnings`` (see ML-2085) is read when present and
-        each entry is re-fired via ``verbose_logger.warning``. Absent or
-        malformed entries are silently skipped — never throws.
+        Top-level ``parameter_warnings`` is read when present and each entry
+        is re-fired via ``verbose_logger.warning``. Absent or malformed
+        entries are silently skipped — never throws.
+
+        Top-level extras (``query``, ``total_results``, ``page``, and any
+        future TinyFish additions) ride through via
+        ``SearchResponse.extra="allow"``. The validated response is returned
+        in place after truncating ``results`` to the caller's ``max_results``,
+        so every field pydantic populated survives regardless of which
+        storage bucket (declared attribute or ``__pydantic_extra__``) holds it.
+
+        TinyFish response headers (e.g. ``x-request-id``, ``retry-after``,
+        ``x-ratelimit-limit`` — httpx normalizes header names to lowercase)
+        are stashed on ``response._hidden_params["headers"]`` (raw) and
+        ``response._hidden_params["additional_headers"]`` (sanitized via
+        ``process_response_headers``) so callers can correlate a search with
+        server-side logs.
 
         Error paths routed through ``self._wrap_error`` for uniform
         ``"TinyFish Search: <msg>. See <docs> for details."`` wrapping:
@@ -223,7 +240,12 @@ class TinyfishSearchConfig(BaseSearchConfig):
         _emit_parameter_warnings(parsed)
 
         max_results: Final = self._caller_max_results or _TINYFISH_RESULT_CAP
-        return SearchResponse(results=list(parsed.results[:max_results]))
+        parsed.results = parsed.results[:max_results]
+        raw_headers: Final = dict(raw_response.headers)
+        hidden: Final = parsed._hidden_params  # pyright: ignore[reportPrivateUsage]  # sole hidden-params channel
+        hidden["headers"] = raw_headers
+        hidden["additional_headers"] = process_response_headers(raw_headers)
+        return parsed
 
     def _wrap_error(
         self,
@@ -243,9 +265,9 @@ class TinyfishSearchConfig(BaseSearchConfig):
         carry the ``TinyFish Search:`` prefix — the bare error already names
         the host in the URL, so attribution is implicit there.
         """
-        # ux-labs frontend wraps every error body as {"error": {"code", "message", "details"?}}.
+        # TinyFish Search wraps every error body as {"error": {"code", "message", "details"?}}.
         # Best-effort unwrap to surface the inner message; fall back to the raw body
-        # for non-ux-labs responses (CDN HTML pages, other JSON envelopes, plain text).
+        # for other envelope shapes (CDN HTML pages, other JSON envelopes, plain text).
         inner_message = error_message
         try:
             body: Final[object] = json.loads(error_message)  # any-ok: json.loads -> Any
@@ -290,7 +312,7 @@ def _default_missing_result_fields(raw_json: object) -> None:
 
 
 def _emit_parameter_warnings(parsed: SearchResponse) -> None:
-    """Re-fire TinyFish-side ``parameter_warnings`` (see ML-2085) as warnings.
+    """Re-fire TinyFish-side ``parameter_warnings`` as warnings.
 
     Defensive: skip silently on any shape we don't recognize so a malformed
     entry (or an early/partial rollout of the field) never throws.
diff --git a/litellm/main.py b/litellm/main.py
index cc27da830d8..f0b20eba9b6 100644
--- a/litellm/main.py
+++ b/litellm/main.py
@@ -5007,7 +5007,6 @@ def completion(
     tool_choice = validate_chat_completion_tool_choice(tool_choice=tool_choice)
     # validate optional params
     stop = validate_openai_optional_params(stop=stop)
-    # normalize camelCase thinking keys (e.g. budgetTokens -> budget_tokens)
     thinking = validate_and_fix_thinking_param(thinking=thinking)
 
     ######### unpacking kwargs #####################
diff --git a/litellm/model_prices_and_context_window_backup.json b/litellm/model_prices_and_context_window_backup.json
index 409022016b0..07f9027313b 100644
--- a/litellm/model_prices_and_context_window_backup.json
+++ b/litellm/model_prices_and_context_window_backup.json
@@ -14456,6 +14456,25 @@
         "supports_tool_choice": true,
         "supports_output_config": true
     },
+    "databricks/databricks-claude-opus-4-6": {
+        "input_cost_per_token": 5.00003e-06,
+        "input_dbu_cost_per_token": 7.1429e-05,
+        "litellm_provider": "databricks",
+        "max_input_tokens": 1000000,
+        "max_output_tokens": 128000,
+        "max_tokens": 128000,
+        "metadata": {
+            "notes": "Input/output cost per token is dbu cost * $0.070. Number provided for reference, '*_dbu_cost_per_token' used in actual calculation."
+        },
+        "mode": "chat",
+        "output_cost_per_token": 2.5000010000000002e-05,
+        "output_dbu_cost_per_token": 0.000357143,
+        "source": "https://www.databricks.com/product/pricing/proprietary-foundation-model-serving",
+        "supports_assistant_prefill": true,
+        "supports_function_calling": true,
+        "supports_reasoning": true,
+        "supports_tool_choice": true
+    },
     "databricks/databricks-claude-sonnet-4": {
         "input_cost_per_token": 2.9999900000000002e-06,
         "input_dbu_cost_per_token": 4.2857e-05,
@@ -14513,6 +14532,25 @@
         "supports_reasoning": true,
         "supports_tool_choice": true
     },
+    "databricks/databricks-claude-sonnet-4-6": {
+        "input_cost_per_token": 2.9999900000000002e-06,
+        "input_dbu_cost_per_token": 4.2857e-05,
+        "litellm_provider": "databricks",
+        "max_input_tokens": 1000000,
+        "max_output_tokens": 64000,
+        "max_tokens": 64000,
+        "metadata": {
+            "notes": "Input/output cost per token is dbu cost * $0.070. Number provided for reference, '*_dbu_cost_per_token' used in actual calculation."
+        },
+        "mode": "chat",
+        "output_cost_per_token": 1.5000020000000002e-05,
+        "output_dbu_cost_per_token": 0.000214286,
+        "source": "https://www.databricks.com/product/pricing/proprietary-foundation-model-serving",
+        "supports_assistant_prefill": true,
+        "supports_function_calling": true,
+        "supports_reasoning": true,
+        "supports_tool_choice": true
+    },
     "databricks/databricks-gemini-2-5-flash": {
         "input_cost_per_token": 3.0001999999999996e-07,
         "input_dbu_cost_per_token": 4.285999999999999e-06,
@@ -14547,6 +14585,74 @@
         "supports_function_calling": true,
         "supports_tool_choice": true
     },
+    "databricks/databricks-gemini-3-1-flash-lite": {
+        "input_cost_per_token": 3.1248e-07,
+        "input_dbu_cost_per_token": 4.464e-06,
+        "litellm_provider": "databricks",
+        "max_input_tokens": 1048576,
+        "max_output_tokens": 65536,
+        "max_tokens": 65536,
+        "metadata": {
+            "notes": "Input/output cost per token is dbu cost * $0.070. Number provided for reference, '*_dbu_cost_per_token' used in actual calculation."
+        },
+        "mode": "chat",
+        "output_cost_per_token": 1.87502e-06,
+        "output_dbu_cost_per_token": 2.6786e-05,
+        "source": "https://www.databricks.com/product/pricing/proprietary-foundation-model-serving",
+        "supports_function_calling": true,
+        "supports_tool_choice": true
+    },
+    "databricks/databricks-gemini-3-1-pro": {
+        "input_cost_per_token": 2.49998e-06,
+        "input_dbu_cost_per_token": 3.5714e-05,
+        "litellm_provider": "databricks",
+        "max_input_tokens": 1048576,
+        "max_output_tokens": 65536,
+        "max_tokens": 65536,
+        "metadata": {
+            "notes": "Input/output cost per token is dbu cost * $0.070. Number provided for reference, '*_dbu_cost_per_token' used in actual calculation."
+        },
+        "mode": "chat",
+        "output_cost_per_token": 1.5000020000000002e-05,
+        "output_dbu_cost_per_token": 0.000214286,
+        "source": "https://www.databricks.com/product/pricing/proprietary-foundation-model-serving",
+        "supports_function_calling": true,
+        "supports_tool_choice": true
+    },
+    "databricks/databricks-gemini-3-flash": {
+        "input_cost_per_token": 6.2503e-07,
+        "input_dbu_cost_per_token": 8.929e-06,
+        "litellm_provider": "databricks",
+        "max_input_tokens": 1048576,
+        "max_output_tokens": 65536,
+        "max_tokens": 65536,
+        "metadata": {
+            "notes": "Input/output cost per token is dbu cost * $0.070. Number provided for reference, '*_dbu_cost_per_token' used in actual calculation."
+        },
+        "mode": "chat",
+        "output_cost_per_token": 3.74997e-06,
+        "output_dbu_cost_per_token": 5.3571e-05,
+        "source": "https://www.databricks.com/product/pricing/proprietary-foundation-model-serving",
+        "supports_function_calling": true,
+        "supports_tool_choice": true
+    },
+    "databricks/databricks-gemini-3-pro": {
+        "input_cost_per_token": 2.49998e-06,
+        "input_dbu_cost_per_token": 3.5714e-05,
+        "litellm_provider": "databricks",
+        "max_input_tokens": 1048576,
+        "max_output_tokens": 65536,
+        "max_tokens": 65536,
+        "metadata": {
+            "notes": "Input/output cost per token is dbu cost * $0.070. Number provided for reference, '*_dbu_cost_per_token' used in actual calculation."
+        },
+        "mode": "chat",
+        "output_cost_per_token": 1.5000020000000002e-05,
+        "output_dbu_cost_per_token": 0.000214286,
+        "source": "https://www.databricks.com/product/pricing/proprietary-foundation-model-serving",
+        "supports_function_calling": true,
+        "supports_tool_choice": true
+    },
     "databricks/databricks-gemma-3-12b": {
         "input_cost_per_token": 1.5000999999999998e-07,
         "input_dbu_cost_per_token": 2.1429999999999996e-06,
@@ -14592,6 +14698,126 @@
         "output_dbu_cost_per_token": 0.000142857,
         "source": "https://www.databricks.com/product/pricing/proprietary-foundation-model-serving"
     },
+    "databricks/databricks-gpt-5-1-codex-max": {
+        "input_cost_per_token": 1.24999e-06,
+        "input_dbu_cost_per_token": 1.7857e-05,
+        "litellm_provider": "databricks",
+        "max_input_tokens": 272000,
+        "max_output_tokens": 128000,
+        "max_tokens": 128000,
+        "metadata": {
+            "notes": "Input/output cost per token is dbu cost * $0.070. Number provided for reference, '*_dbu_cost_per_token' used in actual calculation."
+        },
+        "mode": "chat",
+        "output_cost_per_token": 9.999990000000002e-06,
+        "output_dbu_cost_per_token": 0.000142857,
+        "source": "https://www.databricks.com/product/pricing/proprietary-foundation-model-serving"
+    },
+    "databricks/databricks-gpt-5-1-codex-mini": {
+        "input_cost_per_token": 2.4997e-07,
+        "input_dbu_cost_per_token": 3.571e-06,
+        "litellm_provider": "databricks",
+        "max_input_tokens": 272000,
+        "max_output_tokens": 128000,
+        "max_tokens": 128000,
+        "metadata": {
+            "notes": "Input/output cost per token is dbu cost * $0.070. Number provided for reference, '*_dbu_cost_per_token' used in actual calculation."
+        },
+        "mode": "chat",
+        "output_cost_per_token": 1.99997e-06,
+        "output_dbu_cost_per_token": 2.8571e-05,
+        "source": "https://www.databricks.com/product/pricing/proprietary-foundation-model-serving"
+    },
+    "databricks/databricks-gpt-5-2": {
+        "input_cost_per_token": 1.75e-06,
+        "input_dbu_cost_per_token": 2.5e-05,
+        "litellm_provider": "databricks",
+        "max_input_tokens": 272000,
+        "max_output_tokens": 128000,
+        "max_tokens": 128000,
+        "metadata": {
+            "notes": "Input/output cost per token is dbu cost * $0.070. Number provided for reference, '*_dbu_cost_per_token' used in actual calculation."
+        },
+        "mode": "chat",
+        "output_cost_per_token": 1.4e-05,
+        "output_dbu_cost_per_token": 0.0002,
+        "source": "https://www.databricks.com/product/pricing/proprietary-foundation-model-serving"
+    },
+    "databricks/databricks-gpt-5-2-codex": {
+        "input_cost_per_token": 1.75e-06,
+        "input_dbu_cost_per_token": 2.5e-05,
+        "litellm_provider": "databricks",
+        "max_input_tokens": 272000,
+        "max_output_tokens": 128000,
+        "max_tokens": 128000,
+        "metadata": {
+            "notes": "Input/output cost per token is dbu cost * $0.070. Number provided for reference, '*_dbu_cost_per_token' used in actual calculation."
+        },
+        "mode": "chat",
+        "output_cost_per_token": 1.4e-05,
+        "output_dbu_cost_per_token": 0.0002,
+        "source": "https://www.databricks.com/product/pricing/proprietary-foundation-model-serving"
+    },
+    "databricks/databricks-gpt-5-3-codex": {
+        "input_cost_per_token": 1.75e-06,
+        "input_dbu_cost_per_token": 2.5e-05,
+        "litellm_provider": "databricks",
+        "max_input_tokens": 272000,
+        "max_output_tokens": 128000,
+        "max_tokens": 128000,
+        "metadata": {
+            "notes": "Input/output cost per token is dbu cost * $0.070. Number provided for reference, '*_dbu_cost_per_token' used in actual calculation."
+        },
+        "mode": "chat",
+        "output_cost_per_token": 1.4e-05,
+        "output_dbu_cost_per_token": 0.0002,
+        "source": "https://www.databricks.com/product/pricing/proprietary-foundation-model-serving"
+    },
+    "databricks/databricks-gpt-5-4": {
+        "input_cost_per_token": 2.49998e-06,
+        "input_dbu_cost_per_token": 3.5714e-05,
+        "litellm_provider": "databricks",
+        "max_input_tokens": 272000,
+        "max_output_tokens": 128000,
+        "max_tokens": 128000,
+        "metadata": {
+            "notes": "Input/output cost per token is dbu cost * $0.070. Number provided for reference, '*_dbu_cost_per_token' used in actual calculation."
+        },
+        "mode": "chat",
+        "output_cost_per_token": 1.5000020000000002e-05,
+        "output_dbu_cost_per_token": 0.000214286,
+        "source": "https://www.databricks.com/product/pricing/proprietary-foundation-model-serving"
+    },
+    "databricks/databricks-gpt-5-4-mini": {
+        "input_cost_per_token": 7.4998e-07,
+        "input_dbu_cost_per_token": 1.0714e-05,
+        "litellm_provider": "databricks",
+        "max_input_tokens": 272000,
+        "max_output_tokens": 128000,
+        "max_tokens": 128000,
+        "metadata": {
+            "notes": "Input/output cost per token is dbu cost * $0.070. Number provided for reference, '*_dbu_cost_per_token' used in actual calculation."
+        },
+        "mode": "chat",
+        "output_cost_per_token": 4.50002e-06,
+        "output_dbu_cost_per_token": 6.4286e-05,
+        "source": "https://www.databricks.com/product/pricing/proprietary-foundation-model-serving"
+    },
+    "databricks/databricks-gpt-5-4-nano": {
+        "input_cost_per_token": 1.9999e-07,
+        "input_dbu_cost_per_token": 2.857e-06,
+        "litellm_provider": "databricks",
+        "max_input_tokens": 272000,
+        "max_output_tokens": 128000,
+        "max_tokens": 128000,
+        "metadata": {
+            "notes": "Input/output cost per token is dbu cost * $0.070. Number provided for reference, '*_dbu_cost_per_token' used in actual calculation."
+        },
+        "mode": "chat",
+        "output_cost_per_token": 1.24999e-06,
+        "output_dbu_cost_per_token": 1.7857e-05,
+        "source": "https://www.databricks.com/product/pricing/proprietary-foundation-model-serving"
+    },
     "databricks/databricks-gpt-5-mini": {
         "input_cost_per_token": 2.4997000000000006e-07,
         "input_dbu_cost_per_token": 3.571e-06,
diff --git a/litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py b/litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py
index e46e6299277..1ca4c657706 100644
--- a/litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py
+++ b/litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py
@@ -1341,7 +1341,7 @@ async def _persist_dcr_client_registration(
     ``update_mcp_server`` merges credential blobs: a re-registered public client must not
     inherit the previous client's secret or auth method.
     """
-    if mcp_server.is_true_passthrough or mcp_server.is_oauth_delegate:
+    if mcp_server.is_client_forwarded_token:
         return "skipped"
 
     try:
@@ -2187,7 +2187,7 @@ async def _build_oauth_protected_resource_response(
             )
 
         if upstream_metadata is not None:
-            if mcp_server.is_true_passthrough or mcp_server.is_oauth_delegate:
+            if mcp_server.is_client_forwarded_token:
                 return upstream_metadata
             return {**upstream_metadata, "resource": resource_url}
 
diff --git a/litellm/proxy/_experimental/mcp_server/mcp_server_manager.py b/litellm/proxy/_experimental/mcp_server/mcp_server_manager.py
index 7fff6c12fe0..65855df89f6 100644
--- a/litellm/proxy/_experimental/mcp_server/mcp_server_manager.py
+++ b/litellm/proxy/_experimental/mcp_server/mcp_server_manager.py
@@ -123,6 +123,7 @@ from litellm.proxy._experimental.mcp_server.utils import (
     iter_known_server_prefixes,
     iter_known_tool_name_spellings,
     logging_safe_mcp_headers,
+    lookup_mcp_server_auth_in_headers,
     match_known_server_prefix,
     match_known_tool_name,
     merge_mcp_headers,
@@ -873,6 +874,53 @@ def _openapi_forwarded_extra_headers(
     return forwarded or None
 
 
+def _resolve_openapi_tool_auth(
+    mcp_server: MCPServer,
+    mcp_auth_header: str | None,
+    mcp_server_auth_headers: Mapping[str, str | dict[str, str]] | None,  # mutable-ok: sink shape
+    raw_headers: dict[str, str] | None,  # mutable-ok: sink takes a concrete dict
+    user_api_key_auth: UserAPIKeyAuth | None,
+) -> tuple[str | None, dict[str, str] | None, str | dict[str, str] | None]:  # mutable-ok: sink shapes
+    """The caller's upstream credential for one ``spec_path`` server, for both OpenAPI dispatch arms.
+
+    A per-server ``x-mcp-{alias}-authorization`` wins over the deprecated global / BYOK
+    ``mcp_auth_header``, the same precedence ``_call_regular_mcp_tool`` applies, so the OpenAPI and
+    managed paths cannot disagree about which credential is authoritative. The two kinds are not
+    interchangeable: a per-server value is already a complete header value and is forwarded verbatim,
+    while a BYOK credential is a raw secret that takes the server's auth-type prefix. Formatting the
+    former would ship ``Bearer Bearer <token>``.
+
+    Returns the ``Authorization`` value to inject, the extra headers to forward, and the credential to
+    hand ``resolve_openapi_upstream_auth``, whose passthrough arm reads it via
+    ``_passthrough_token_from_mcp_auth_header``. The per-server Authorization travels only in the
+    credential, never also in the forwarded headers, because the resolver pops Authorization out of
+    those and would otherwise have two sources to reconcile.
+    """
+    forwarded: Final = _openapi_forwarded_extra_headers(mcp_server, raw_headers, user_api_key_auth)
+    per_server: Final = (
+        lookup_mcp_server_auth_in_headers(
+            mcp_server_auth_headers,
+            alias=mcp_server.alias,
+            server_name=mcp_server.server_name,
+        )
+        if mcp_server_auth_headers
+        else None
+    )
+
+    if isinstance(per_server, dict):
+        authorization: Final = next((v for k, v in per_server.items() if k.lower() == "authorization"), None)
+        merged: Final = merge_mcp_headers(extra_headers=forwarded, static_headers=_without_authorization(per_server))
+        if authorization is None:
+            byok: Final = _format_byok_openapi_auth_header(mcp_server, mcp_auth_header) if mcp_auth_header else None
+            return byok, merged, mcp_auth_header
+        return authorization, merged, per_server
+    if isinstance(per_server, str) and per_server:
+        return per_server, forwarded, per_server
+    if mcp_auth_header:
+        return _format_byok_openapi_auth_header(mcp_server, mcp_auth_header), forwarded, mcp_auth_header
+    return None, forwarded, None
+
+
 async def _resolve_byok_mcp_auth_header(
     mcp_server: MCPServer,
     user_api_key_auth: UserAPIKeyAuth | None,
@@ -1740,12 +1788,14 @@ class MCPServerManager:
             server: The MCP server whose OAuth metadata must be resolved.
 
         Returns:
-            The resolved server, or the registered server when no discovery is
-            pending.
+            The resolved server; the registered server when no discovery is
+            pending, or when discovery failed for a client-forwarded-token
+            server, whose session consumes no discovered endpoint.
 
         Raises:
             HTTPException: Status 503 when discovery times out or returns
-                incomplete metadata.
+                incomplete metadata for a server whose OAuth flow the gateway
+                runs itself.
         """
         acquisition: Final = self._get_or_start_oauth_discovery_task(server)
         if acquisition is None:
@@ -1764,6 +1814,8 @@ class MCPServerManager:
                 return await self.ensure_oauth_metadata_discovered(server)
             case _OAuthDiscoveryFailed(timed_out=timed_out):
                 current: Final = self._registered_server(server)
+                if current.is_client_forwarded_token:
+                    return current
                 server_ref: Final = current.alias or current.server_name or current.name or current.server_id
                 reason: Final = "timed out" if timed_out else "returned incomplete metadata"
                 raise HTTPException(
@@ -2321,23 +2373,30 @@ class MCPServerManager:
             openapi_key_prefix: Final = prefix_root + MCP_TOOL_PREFIX_SEPARATOR
             global_mcp_tool_registry.unregister_tools_with_prefix(openapi_key_prefix)
 
-        owned_raw: Final[set[str]] = set()
-        for p in iter_known_server_prefixes(server):
-            if p:
-                owned_raw.add(p)
-        if server.name:
-            owned_raw.add(server.name)
+        owned_normalized: Final = self._owned_mapping_values(server)
 
-        owned_normalized: Final = {normalize_server_name(x) for x in owned_raw}
-
-        stale_mapping_keys: Final[list[str]] = []
-        for tool_name, mapped_server in list(self.tool_name_to_mcp_server_name_mapping.items()):
-            if mapped_server in owned_raw or normalize_server_name(str(mapped_server)) in owned_normalized:
-                stale_mapping_keys.append(tool_name)
+        stale_mapping_keys: Final = tuple(
+            tool_name
+            for tool_name, mapped_server in self.tool_name_to_mcp_server_name_mapping.items()
+            if normalize_server_name(str(mapped_server)) in owned_normalized
+        )
 
         for key in stale_mapping_keys:
             del self.tool_name_to_mcp_server_name_mapping[key]
 
+    def _owned_mapping_values(self, server: MCPServer) -> frozenset[str]:
+        return frozenset(
+            normalize_server_name(value) for value in (*iter_known_server_prefixes(server), server.name) if value
+        )
+
+    def _server_exposes_tool(self, server: MCPServer, tool_name: str) -> bool:
+        owned: Final = self._owned_mapping_values(server)
+        mapped_owners: Final = (
+            self.tool_name_to_mcp_server_name_mapping.get(spelling)
+            for spelling in iter_known_tool_name_spellings(tool_name, server)
+        )
+        return any(owner is not None and normalize_server_name(owner) in owned for owner in mapped_owners)
+
     def remove_server(self, mcp_server: LiteLLM_MCPServerTable):
         """
         Remove a server from the registry
@@ -3182,10 +3241,6 @@ class MCPServerManager:
             # Get server-specific auth header if available
             server_auth_header: str | dict[str, str] | None = None
             if mcp_server_auth_headers:
-                from litellm.proxy._experimental.mcp_server.utils import (
-                    lookup_mcp_server_auth_in_headers,
-                )
-
                 server_auth_header = lookup_mcp_server_auth_in_headers(
                     mcp_server_auth_headers,
                     alias=server.alias,
@@ -5210,11 +5265,6 @@ class MCPServerManager:
         # the exact case of server alias/name (e.g., '1litellmagcgateway' vs '1LiteLLMAGCGateway')
         server_auth_header: dict[str, str] | str | None = None
         if mcp_server_auth_headers:
-            # Normalize keys for case-insensitive lookup
-            from litellm.proxy._experimental.mcp_server.utils import (
-                lookup_mcp_server_auth_in_headers,
-            )
-
             server_auth_header = lookup_mcp_server_auth_in_headers(
                 mcp_server_auth_headers,
                 alias=mcp_server.alias,
@@ -5249,7 +5299,7 @@ class MCPServerManager:
                     user_api_key_auth=user_api_key_auth,
                 ):
                     extra_headers = _without_authorization(extra_headers)
-        elif mcp_server.is_true_passthrough or mcp_server.is_oauth_delegate:
+        elif mcp_server.is_client_forwarded_token:
             extra_headers = _client_forwarded_authorization_headers(
                 mcp_server=mcp_server,
                 oauth2_headers=oauth2_headers,
@@ -5356,7 +5406,7 @@ class MCPServerManager:
             # Scoped to the two client-forwarded token modes this stack introduced; legacy
             # oauth2 + delegate_auth_to_upstream (is_oauth_passthrough) is being removed, so it is not
             # added here even though the list path still relays for it.
-            relays_upstream_auth: Final = mcp_server.is_true_passthrough or mcp_server.is_oauth_delegate
+            relays_upstream_auth: Final = mcp_server.is_client_forwarded_token
             server_label: Final = mcp_server.name or mcp_server.server_name or mcp_server.alias or ""
 
             async def _call_tool_via_client(client, params):
@@ -5463,13 +5513,8 @@ class MCPServerManager:
         if mcp_server is None:
             raise ValueError(f"Tool {name} not found")
 
-        if resolved_by_server_name_only:
-            tool_known: Final = (
-                name in self.tool_name_to_mcp_server_name_mapping
-                or prefixed_tool_name in self.tool_name_to_mcp_server_name_mapping
-            )
-            if not tool_known:
-                raise ValueError(f"Tool {name} not found")
+        if resolved_by_server_name_only and not self._server_exposes_tool(mcp_server, name):
+            raise ValueError(f"Tool {name} not found")
 
         return mcp_server
 
@@ -5712,16 +5757,20 @@ class MCPServerManager:
                     server_name,
                 )
 
-            auth_header_value: Final = (
-                _format_byok_openapi_auth_header(mcp_server, mcp_auth_header) if mcp_auth_header else None
+            auth_header_value, openapi_forwarded_headers, upstream_credential = _resolve_openapi_tool_auth(
+                mcp_server=mcp_server,
+                mcp_auth_header=mcp_auth_header,
+                mcp_server_auth_headers=mcp_server_auth_headers,
+                raw_headers=raw_headers,
+                user_api_key_auth=user_api_key_auth,
             )
             resolved_auth_headers, forwarded_headers = await self.resolve_openapi_upstream_auth(
                 mcp_server=mcp_server,
                 oauth2_headers=caller_oauth2_headers,
                 raw_headers=raw_headers,
-                mcp_auth_header=mcp_auth_header,
+                mcp_auth_header=upstream_credential,
                 user_api_key_auth=user_api_key_auth,
-                forwarded_headers=_openapi_forwarded_extra_headers(mcp_server, raw_headers, user_api_key_auth),
+                forwarded_headers=openapi_forwarded_headers,
             )
 
             async def _call_openapi_via_handler():
@@ -5847,10 +5896,7 @@ class MCPServerManager:
         if matched is not None:
             matched_prefix, original_tool_name = matched
             matched_server: Final = prefix_to_server.get(matched_prefix)
-            if matched_server is not None and (
-                original_tool_name in self.tool_name_to_mcp_server_name_mapping
-                or tool_name in self.tool_name_to_mcp_server_name_mapping
-            ):
+            if matched_server is not None and self._server_exposes_tool(matched_server, original_tool_name):
                 return matched_server
 
         return None
diff --git a/litellm/proxy/_experimental/mcp_server/server.py b/litellm/proxy/_experimental/mcp_server/server.py
index 4184fad009c..8d69d84e492 100644
--- a/litellm/proxy/_experimental/mcp_server/server.py
+++ b/litellm/proxy/_experimental/mcp_server/server.py
@@ -430,6 +430,7 @@ if MCP_AVAILABLE:
         MCPServerManager,
         _caller_authorization_fans_out,
         _client_forwarded_authorization_headers,
+        _resolve_openapi_tool_auth,
         _should_strip_caller_authorization,
         _without_authorization,
         global_mcp_server_manager,
@@ -1704,7 +1705,7 @@ if MCP_AVAILABLE:
             )
 
         extra_headers: dict[str, str] | None = None
-        is_client_forwarded_mode: Final = server.is_true_passthrough or server.is_oauth_delegate
+        is_client_forwarded_mode: Final = server.is_client_forwarded_token
         # In a multi-server listing scope the request-wide Authorization can only carry one token,
         # so it is withheld from a client-forwarded server when another server in scope also consumes
         # it (RFC 9700 cross-resource replay); such scopes must bind per-server via
@@ -2013,6 +2014,9 @@ if MCP_AVAILABLE:
                         prefetched_creds=_prefetched_oauth_creds,
                     )
 
+                if server.is_byok and server.auth_type != MCPAuth.oauth2 and server_auth_header is None:
+                    server_auth_header = await _get_byok_credential(server, user_api_key_auth)
+
                 try:
                     tools: Final = await global_mcp_server_manager._get_tools_from_server(
                         server=server,
@@ -2832,58 +2836,26 @@ if MCP_AVAILABLE:
                 arguments = hook_result["arguments"]
 
             verbose_logger.debug("Executing local registry tool: %s", name)
-            # For BYOK servers the credential must be injected via a ContextVar
-            # because the tool function has headers baked into its closure.
-            # Pre-format the full Authorization header value using the server's
-            # configured auth_type so the generator doesn't need to know the prefix.
-            auth_header_value: str | None = None
-            if mcp_auth_header:
-                server_auth_type: Final = getattr(mcp_server, "auth_type", None) if mcp_server else None
-                if server_auth_type == MCPAuth.api_key:
-                    auth_header_value = f"ApiKey {mcp_auth_header}"
-                elif server_auth_type == MCPAuth.basic:
-                    auth_header_value = f"Basic {mcp_auth_header}"
-                else:
-                    auth_header_value = f"Bearer {mcp_auth_header}"
-
-            # Forward named client headers to OpenAPI tool upstream requests.
-            # MCPServer.extra_headers lists header names to copy from raw_headers.
-            # The strip decision is centralized in _should_strip_caller_authorization so this
-            # OpenAPI/local path agrees with the managed paths: M2M and the resolver-owned modes
-            # (token_exchange's raw subject token, authorization_code's stored token) must never
-            # have the caller's Authorization forwarded verbatim upstream.
-            forwarded_headers: dict[str, str] | None = None
-            if mcp_server and mcp_server.extra_headers and raw_headers:
-                normalized_raw: Final = {str(k).lower(): v for k, v in raw_headers.items() if isinstance(k, str)}
-                skip_caller_authorization: Final = _should_strip_caller_authorization(
-                    mcp_server=mcp_server,
-                    raw_headers=raw_headers,
-                    user_api_key_auth=user_api_key_auth,
-                )
-                for header_name in mcp_server.extra_headers:
-                    if not isinstance(header_name, str):
-                        continue
-                    if skip_caller_authorization and header_name.lower() == "authorization":
-                        continue
-                    value = normalized_raw.get(header_name.lower())
-                    if value is not None:
-                        if forwarded_headers is None:
-                            forwarded_headers = {}
-                        forwarded_headers[header_name] = value
-
-            resolved_auth_headers: dict[str, str] | None = None
-            if mcp_server:
-                (
-                    resolved_auth_headers,
-                    forwarded_headers,
-                ) = await global_mcp_server_manager.resolve_openapi_upstream_auth(
-                    mcp_server=mcp_server,
-                    oauth2_headers=oauth2_headers,
-                    raw_headers=raw_headers,
-                    mcp_auth_header=mcp_auth_header,
-                    user_api_key_auth=user_api_key_auth,
-                    forwarded_headers=forwarded_headers,
-                )
+            # The credential rides ContextVars because the tool function has its
+            # headers baked into the closure at registration time.
+            auth_header_value, openapi_forwarded_headers, upstream_credential = _resolve_openapi_tool_auth(
+                mcp_server=mcp_server,
+                mcp_auth_header=mcp_auth_header,
+                mcp_server_auth_headers=mcp_server_auth_headers,
+                raw_headers=raw_headers,
+                user_api_key_auth=user_api_key_auth,
+            )
+            (
+                resolved_auth_headers,
+                forwarded_headers,
+            ) = await global_mcp_server_manager.resolve_openapi_upstream_auth(
+                mcp_server=mcp_server,
+                oauth2_headers=oauth2_headers,
+                raw_headers=raw_headers,
+                mcp_auth_header=upstream_credential,
+                user_api_key_auth=user_api_key_auth,
+                forwarded_headers=openapi_forwarded_headers,
+            )
 
             _auth_token: Final = _request_auth_header.set(auth_header_value)
             _extra_token: Final = _request_extra_headers.set(forwarded_headers)
diff --git a/litellm/proxy/_types.py b/litellm/proxy/_types.py
index f128940c315..b0891b73fb8 100644
--- a/litellm/proxy/_types.py
+++ b/litellm/proxy/_types.py
@@ -3059,6 +3059,8 @@ class NewProjectRequest(LiteLLM_BudgetTable):
     models: list[str] = []
     model_rpm_limit: dict | None = None
     model_tpm_limit: dict | None = None
+    model_itpm_limit: Mapping[str, int] | None = None
+    model_otpm_limit: Mapping[str, int] | None = None
     blocked: bool = False
     object_permission: LiteLLM_ObjectPermissionBase | None = None
 
@@ -3091,6 +3093,8 @@ class UpdateProjectRequest(LiteLLM_BudgetTable):
     models: list[str] | None = None
     model_rpm_limit: dict | None = None
     model_tpm_limit: dict | None = None
+    model_itpm_limit: Mapping[str, int] | None = None
+    model_otpm_limit: Mapping[str, int] | None = None
     blocked: bool | None = None
     budget_id: str | None = None
     object_permission: LiteLLM_ObjectPermissionBase | None = None
@@ -4244,6 +4248,8 @@ class PassThroughEndpointLoggingTypedDict(TypedDict):
 LiteLLM_ManagementEndpoint_MetadataFields: Final = [
     "model_rpm_limit",
     "model_tpm_limit",
+    "model_itpm_limit",
+    "model_otpm_limit",
     "default_estimated_output_tokens",
     "default_estimated_output_tokens_per_model",
     "mcp_rpm_limit",
diff --git a/litellm/proxy/agent_endpoints/a2a_endpoints.py b/litellm/proxy/agent_endpoints/a2a_endpoints.py
index 1cae87aed31..cea30ffad52 100644
--- a/litellm/proxy/agent_endpoints/a2a_endpoints.py
+++ b/litellm/proxy/agent_endpoints/a2a_endpoints.py
@@ -168,14 +168,13 @@ def _jsonrpc_error(
     )
 
 
-def _get_agent(agent_id: str):
+async def _get_agent(agent_id: str) -> "AgentResponse | None":
     """Look up an agent by ID or name. Returns None if not found."""
-    from litellm.proxy.agent_endpoints.agent_registry import global_agent_registry
+    from litellm.proxy.common_utils.registry_read_through import (
+        get_agent_with_read_through,
+    )
 
-    agent = global_agent_registry.get_agent_by_id(agent_id=agent_id)
-    if agent is None:
-        agent = global_agent_registry.get_agent_by_name(agent_name=agent_id)
-    return agent
+    return await get_agent_with_read_through(agent_id)
 
 
 def _enforce_inbound_trace_id(agent: "AgentResponse", request: Request) -> None:
@@ -559,7 +558,7 @@ async def get_agent_card(
     )
 
     try:
-        agent: Final = _get_agent(agent_id)
+        agent: Final = await _get_agent(agent_id)
         if agent is None:
             raise HTTPException(status_code=404, detail=f"Agent '{agent_id}' not found")
 
@@ -673,7 +672,7 @@ async def invoke_agent_a2a(
                 params.pop(key)
 
         # Find the agent
-        agent: Final = _get_agent(agent_id)
+        agent: Final = await _get_agent(agent_id)
         if agent is None:
             return _jsonrpc_error(request_id, -32000, f"Agent '{agent_id}' not found", 404)
 
diff --git a/litellm/proxy/agent_endpoints/a2a_routing.py b/litellm/proxy/agent_endpoints/a2a_routing.py
index 038b6b4a840..8a795214750 100644
--- a/litellm/proxy/agent_endpoints/a2a_routing.py
+++ b/litellm/proxy/agent_endpoints/a2a_routing.py
@@ -25,10 +25,12 @@ async def route_a2a_agent_request(
     Returns None if not an A2A request (allows normal routing to continue).
     """
     # Import here to avoid circular imports
-    from litellm.proxy.agent_endpoints.agent_registry import global_agent_registry
     from litellm.proxy.agent_endpoints.auth.agent_permission_handler import (
         AgentRequestHandler,
     )
+    from litellm.proxy.common_utils.registry_read_through import (
+        get_agent_with_read_through,
+    )
     from litellm.proxy.route_llm_request import (
         ROUTE_ENDPOINT_MAPPING,
         ProxyModelNotFoundError,
@@ -44,11 +46,11 @@ async def route_a2a_agent_request(
     agent_name: Final = model_name[4:]
 
     # Look up agent in registry
-    agent: Final = global_agent_registry.get_agent_by_name(agent_name)
+    agent: Final = await get_agent_with_read_through(agent_name)
     if agent is None:
         verbose_proxy_logger.error("[A2A] Agent '%s' not found in registry", agent_name)
         route_name = ROUTE_ENDPOINT_MAPPING.get(route_type, route_type)
-        raise ProxyModelNotFoundError(route=route_name, model_name=model_name)
+        raise ProxyModelNotFoundError(route=route_name, model_name=model_name, retryable_with_model_read_through=False)
 
     # Verify the caller is permitted to use this agent (admins bypass the check)
     is_admin: Final = user_api_key_dict is not None and (
@@ -70,7 +72,7 @@ async def route_a2a_agent_request(
     if not agent.agent_card_params or "url" not in agent.agent_card_params:
         verbose_proxy_logger.error("[A2A] Agent '%s' has no URL configured", agent_name)
         route_name = ROUTE_ENDPOINT_MAPPING.get(route_type, route_type)
-        raise ProxyModelNotFoundError(route=route_name, model_name=model_name)
+        raise ProxyModelNotFoundError(route=route_name, model_name=model_name, retryable_with_model_read_through=False)
 
     # Inject API base and route to litellm
     data["api_base"] = agent.agent_card_params["url"]
diff --git a/litellm/proxy/agent_endpoints/agent_registry.py b/litellm/proxy/agent_endpoints/agent_registry.py
index 742fdf35b1e..64de6827679 100644
--- a/litellm/proxy/agent_endpoints/agent_registry.py
+++ b/litellm/proxy/agent_endpoints/agent_registry.py
@@ -600,3 +600,4 @@ class AgentRegistry:
 
 
 global_agent_registry: Final = AgentRegistry()
+AGENT_RECONCILE_LOCK: Final = asyncio.Lock()
diff --git a/litellm/proxy/anthropic_endpoints/endpoints.py b/litellm/proxy/anthropic_endpoints/endpoints.py
index a48ef0f08bb..f742965ade2 100644
--- a/litellm/proxy/anthropic_endpoints/endpoints.py
+++ b/litellm/proxy/anthropic_endpoints/endpoints.py
@@ -179,7 +179,7 @@ async def anthropic_response(
             await proxy_logging_obj.post_call_failure_hook(
                 user_api_key_dict=user_api_key_dict,
                 original_exception=e,
-                request_data=data,
+                request_data=base_llm_response_processor.data,
             )
         body: Final = AnthropicExceptionMapping.transform_to_anthropic_error(
             status_code=e.status_code,
@@ -189,7 +189,7 @@ async def anthropic_response(
         return JSONResponse(status_code=e.status_code, content=body)
     except Exception as e:
         await proxy_logging_obj.post_call_failure_hook(
-            user_api_key_dict=user_api_key_dict, original_exception=e, request_data=data
+            user_api_key_dict=user_api_key_dict, original_exception=e, request_data=base_llm_response_processor.data
         )
         verbose_proxy_logger.exception("litellm.proxy.proxy_server.anthropic_response(): Exception occured - %s", e)
 
diff --git a/litellm/proxy/auth/auth_utils.py b/litellm/proxy/auth/auth_utils.py
index c9f9c00f120..a105bf19458 100644
--- a/litellm/proxy/auth/auth_utils.py
+++ b/litellm/proxy/auth/auth_utils.py
@@ -1172,7 +1172,7 @@ def enforce_output_token_estimates_are_admin_only(
 def get_model_rate_limit_from_metadata(
     user_api_key_dict: UserAPIKeyAuth,
     metadata_accessor_key: Literal["team_metadata", "organization_metadata", "project_metadata"],
-    rate_limit_key: Literal["model_rpm_limit", "model_tpm_limit"],
+    rate_limit_key: Literal["model_rpm_limit", "model_tpm_limit", "model_itpm_limit", "model_otpm_limit"],
 ) -> dict[str, int] | None:
     if getattr(user_api_key_dict, metadata_accessor_key):
         return getattr(user_api_key_dict, metadata_accessor_key).get(rate_limit_key)
diff --git a/litellm/proxy/common_utils/registry_read_through.py b/litellm/proxy/common_utils/registry_read_through.py
new file mode 100644
index 00000000000..460b348e188
--- /dev/null
+++ b/litellm/proxy/common_utils/registry_read_through.py
@@ -0,0 +1,224 @@
+"""Read-through recovery for in-memory registries in multi-replica deployments.
+
+A management write (POST /model/new, /guardrails, /v1/agents) lands on one
+replica and reaches Postgres, but sibling replicas only refresh their in-memory
+registries on the periodic config reload, so a request using the new object
+immediately can land on a sibling that has never heard of it and fail 400/404.
+On a registry miss, callers here fetch the missing row from the DB and load it
+into the local registry before giving up. A short negative-result TTL per key
+plus a global resync budget per window bound the DB load from lookups of
+genuinely unknown names.
+"""
+
+import asyncio
+import time
+from collections.abc import Awaitable, Callable
+from typing import TYPE_CHECKING, Final
+
+from litellm._logging import verbose_proxy_logger
+from litellm.caching.in_memory_cache import InMemoryCache
+
+if TYPE_CHECKING:
+    from prisma.types import (
+        LiteLLM_AgentsTableInclude,
+        LiteLLM_AgentsTableWhereUniqueInput,
+        LiteLLM_GuardrailsTableWhereInput,
+        LiteLLM_ProxyModelTableWhereInput,
+    )
+
+    from litellm.integrations.custom_guardrail import CustomGuardrail
+    from litellm.types.agents import AgentResponse
+
+READ_THROUGH_MISS_TTL_SECONDS: Final = 2.0
+READ_THROUGH_RESYNC_WINDOW_SECONDS: Final = 5.0
+READ_THROUGH_MAX_RESYNCS_PER_WINDOW: Final = 20
+
+
+class RegistryReadThrough:
+    __slots__ = (
+        "_lock",
+        "_max_resyncs_per_window",
+        "_miss_ttl_seconds",
+        "_recent_misses",
+        "_resync",
+        "_resync_window_seconds",
+        "_window_resyncs",
+        "_window_started_at",
+    )
+
+    def __init__(
+        self,
+        resync: Callable[[str], Awaitable[bool]],
+        miss_ttl_seconds: float = READ_THROUGH_MISS_TTL_SECONDS,
+        max_resyncs_per_window: int = READ_THROUGH_MAX_RESYNCS_PER_WINDOW,
+        resync_window_seconds: float = READ_THROUGH_RESYNC_WINDOW_SECONDS,
+    ) -> None:
+        self._resync = resync
+        self._miss_ttl_seconds = miss_ttl_seconds
+        self._max_resyncs_per_window = max_resyncs_per_window
+        self._resync_window_seconds = resync_window_seconds
+        self._lock = asyncio.Lock()
+        self._recent_misses = InMemoryCache(max_size_in_memory=1000)
+        self._window_started_at = float("-inf")
+        self._window_resyncs = 0
+
+    def _consume_resync_budget(self) -> bool:
+        now: Final = time.monotonic()
+        if now - self._window_started_at >= self._resync_window_seconds:
+            self._window_started_at = now
+            self._window_resyncs = 0
+        if self._window_resyncs >= self._max_resyncs_per_window:
+            return False
+        self._window_resyncs += 1
+        return True
+
+    async def attempt(self, key: str) -> bool:
+        if self._recent_misses.get_cache(key) is not None:
+            return False
+        async with self._lock:
+            if self._recent_misses.get_cache(key) is not None:
+                return False
+            if not self._consume_resync_budget():
+                verbose_proxy_logger.warning(
+                    "registry read-through for %r skipped: resync budget of %s per %ss exhausted",
+                    key,
+                    self._max_resyncs_per_window,
+                    self._resync_window_seconds,
+                )
+                return False
+            try:
+                found: Final = await self._resync(key)
+            except Exception as e:  # noqa: BLE001  # a failed read-through must surface the original miss error, not a 500
+                verbose_proxy_logger.warning("registry read-through for %r failed: %s", key, e)
+                return False
+            if not found:
+                self._recent_misses.set_cache(key, True, ttl=self._miss_ttl_seconds)
+            return found
+
+
+def _db_backed_registries_enabled(object_type: str) -> bool:
+    from litellm.proxy import proxy_server
+
+    if proxy_server.prisma_client is None or proxy_server.store_model_in_db is not True:
+        return False
+    return proxy_server.should_load_db_object(object_type=object_type)
+
+
+async def _resync_model_deployments(model_name: str) -> bool:
+    from litellm.proxy import proxy_server
+    from litellm.repositories.model_repository import ModelRepository
+
+    if not _db_backed_registries_enabled("models"):
+        return False
+    prisma_client: Final = proxy_server.prisma_client
+    assert prisma_client is not None
+    table: Final = ModelRepository(prisma_client).table
+    name_filter: Final[LiteLLM_ProxyModelTableWhereInput] = {"model_name": model_name}
+    id_filter: Final[LiteLLM_ProxyModelTableWhereInput] = {"model_id": model_name}
+    rows: Final = await table.find_many(where=name_filter) or await table.find_many(where=id_filter)
+    if not rows:
+        return False
+    router: Final = proxy_server.llm_router
+    if router is None:
+        await proxy_server.proxy_config.add_deployment(
+            prisma_client=prisma_client, proxy_logging_obj=proxy_server.proxy_logging_obj
+        )
+        return proxy_server.llm_router is not None
+    async with proxy_server.MODEL_RECONCILE_LOCK:
+        proxy_server.proxy_config._add_deployment(db_models=rows)
+        proxy_server.llm_model_list = router.get_model_list()
+    return True
+
+
+async def _resync_guardrails(guardrail_name: str) -> bool:
+    from litellm.proxy import proxy_server
+    from litellm.proxy.guardrails.guardrail_registry import (
+        GUARDRAIL_RECONCILE_LOCK,
+        IN_MEMORY_GUARDRAIL_HANDLER,
+    )
+    from litellm.repositories.table_repositories import GuardrailsRepository
+    from litellm.types.guardrails import Guardrail
+
+    if not _db_backed_registries_enabled("guardrails"):
+        return False
+    prisma_client: Final = proxy_server.prisma_client
+    assert prisma_client is not None
+    active_row_filter: Final[LiteLLM_GuardrailsTableWhereInput] = {
+        "guardrail_name": guardrail_name,
+        "status": "active",
+    }
+    row: Final = await GuardrailsRepository(prisma_client).table.find_first(where=active_row_filter)
+    if row is None:
+        return False
+    async with GUARDRAIL_RECONCILE_LOCK:
+        IN_MEMORY_GUARDRAIL_HANDLER.sync_guardrail_from_db(guardrail=Guardrail(**dict(row)))
+    return _initialized_guardrail(guardrail_name) is not None
+
+
+async def _resync_agents(agent_id_or_name: str) -> bool:
+    from litellm.proxy import proxy_server
+    from litellm.proxy.agent_endpoints.agent_registry import (
+        AGENT_RECONCILE_LOCK,
+        agents_table,
+        global_agent_registry,
+    )
+    from litellm.types.agents import AgentResponse
+
+    if not _db_backed_registries_enabled("agents"):
+        return False
+    if _agent_from_registry(agent_id_or_name) is not None:
+        return True
+    prisma_client: Final = proxy_server.prisma_client
+    assert prisma_client is not None
+    table: Final = agents_table(prisma_client)
+    id_filter: Final[LiteLLM_AgentsTableWhereUniqueInput] = {"agent_id": agent_id_or_name}
+    name_filter: Final[LiteLLM_AgentsTableWhereUniqueInput] = {"agent_name": agent_id_or_name}
+    include_permission: Final[LiteLLM_AgentsTableInclude] = {"object_permission": True}
+    async with AGENT_RECONCILE_LOCK:
+        if _agent_from_registry(agent_id_or_name) is not None:
+            return True
+        row: Final = await table.find_unique(where=id_filter, include=include_permission) or await table.find_unique(
+            where=name_filter, include=include_permission
+        )
+        if row is None:
+            return False
+        global_agent_registry.register_agent(agent_config=AgentResponse.model_validate(row.model_dump()))
+        return True
+
+
+model_registry_read_through: Final = RegistryReadThrough(resync=_resync_model_deployments)
+guardrail_registry_read_through: Final = RegistryReadThrough(resync=_resync_guardrails)
+agent_registry_read_through: Final = RegistryReadThrough(resync=_resync_agents)
+
+
+def _agent_from_registry(agent_id_or_name: str) -> "AgentResponse | None":
+    from litellm.proxy.agent_endpoints.agent_registry import global_agent_registry
+
+    by_id: Final = global_agent_registry.get_agent_by_id(agent_id=agent_id_or_name)
+    if by_id is not None:
+        return by_id
+    return global_agent_registry.get_agent_by_name(agent_name=agent_id_or_name)
+
+
+async def get_agent_with_read_through(agent_id_or_name: str) -> "AgentResponse | None":
+    agent: Final = _agent_from_registry(agent_id_or_name)
+    if agent is not None:
+        return agent
+    if not await agent_registry_read_through.attempt(agent_id_or_name):
+        return None
+    return _agent_from_registry(agent_id_or_name)
+
+
+def _initialized_guardrail(guardrail_name: str) -> "CustomGuardrail | None":
+    from litellm.proxy.guardrails import guardrail_endpoints
+
+    return guardrail_endpoints.GUARDRAIL_REGISTRY.get_initialized_guardrail_callback(guardrail_name=guardrail_name)
+
+
+async def get_initialized_guardrail_with_read_through(guardrail_name: str) -> "CustomGuardrail | None":
+    active: Final = _initialized_guardrail(guardrail_name)
+    if active is not None:
+        return active
+    if not await guardrail_registry_read_through.attempt(guardrail_name):
+        return None
+    return _initialized_guardrail(guardrail_name)
diff --git a/litellm/proxy/guardrails/guardrail_endpoints.py b/litellm/proxy/guardrails/guardrail_endpoints.py
index b68d4a68b79..e50a3a5a1e7 100644
--- a/litellm/proxy/guardrails/guardrail_endpoints.py
+++ b/litellm/proxy/guardrails/guardrail_endpoints.py
@@ -2305,8 +2305,12 @@ async def apply_guardrail(
     litellm_logging_obj = None
     start_time: Final = datetime.now(timezone.utc)
 
+    from litellm.proxy.common_utils.registry_read_through import (
+        get_initialized_guardrail_with_read_through,
+    )
+
     try:
-        active_guardrail: Final[CustomGuardrail | None] = GUARDRAIL_REGISTRY.get_initialized_guardrail_callback(
+        active_guardrail: Final[CustomGuardrail | None] = await get_initialized_guardrail_with_read_through(
             guardrail_name=request.guardrail_name
         )
         if active_guardrail is None:
diff --git a/litellm/proxy/guardrails/guardrail_registry.py b/litellm/proxy/guardrails/guardrail_registry.py
index 5f7374581a2..f6d348c1045 100644
--- a/litellm/proxy/guardrails/guardrail_registry.py
+++ b/litellm/proxy/guardrails/guardrail_registry.py
@@ -1,5 +1,6 @@
 # litellm/proxy/guardrails/guardrail_registry.py
 
+import asyncio
 import importlib
 import os
 from collections.abc import Callable, Iterator, Mapping
@@ -813,4 +814,6 @@ class InMemoryGuardrailHandler:
 # In Memory Guardrail Handler for LiteLLM Proxy
 ########################################################
 IN_MEMORY_GUARDRAIL_HANDLER: Final = InMemoryGuardrailHandler()
+
+GUARDRAIL_RECONCILE_LOCK: Final = asyncio.Lock()
 ########################################################
diff --git a/litellm/proxy/hooks/batch_rate_limiter.py b/litellm/proxy/hooks/batch_rate_limiter.py
index 7e33583fc9d..d6229fb80a6 100644
--- a/litellm/proxy/hooks/batch_rate_limiter.py
+++ b/litellm/proxy/hooks/batch_rate_limiter.py
@@ -18,11 +18,12 @@ Quick summary:
 """
 
 import json
-from collections.abc import Iterable
-from typing import TYPE_CHECKING, Any, Final, Literal, NoReturn
+from collections.abc import Iterable, Mapping, Sequence
+from types import MappingProxyType
+from typing import TYPE_CHECKING, Any, Final, Literal, NoReturn, TypeAlias
 
 from fastapi import HTTPException
-from pydantic import BaseModel
+from pydantic import BaseModel, Field, TypeAdapter
 
 import litellm
 from litellm._logging import verbose_proxy_logger
@@ -40,10 +41,15 @@ from litellm.proxy._types import (
     SpecialModelNames,
     UserAPIKeyAuth,
 )
+from litellm.proxy.auth.auth_utils import get_model_rate_limit_from_metadata
 from litellm.proxy.common_utils.proxy_rate_limit_error import (
     ProxyRateLimitError,
     map_v3_rate_limit_type,
 )
+from litellm.proxy.hooks.parallel_request_limiter_v3 import (
+    PROJECT_ITPM_DESCRIPTOR_KEY,
+    PROJECT_OTPM_DESCRIPTOR_KEY,
+)
 from litellm.proxy.hooks.rate_limiter_utils import resolve_llm_provider_for_rate_limit
 
 if TYPE_CHECKING:
@@ -76,6 +82,11 @@ else:
     RateLimitDescriptor = dict[str, Any]
 
 
+_BATCH_BODY_ADAPTER: Final = TypeAdapter(dict[str, object])
+
+IncrementAmounts: TypeAlias = dict[Literal["requests", "tokens"], int]
+
+
 class BatchFileUsage(BaseModel):
     """
     Internal model for batch file usage tracking, used for batch rate limiting
@@ -83,6 +94,16 @@ class BatchFileUsage(BaseModel):
 
     total_tokens: int
     request_count: int
+    output_tokens: int = 0
+    # Keyed by each row's own `body.model`, distinct from `total_tokens`/
+    # `output_tokens` (the whole-file totals charged to the file-bound/
+    # top-level routing model's key/team/model limits). A batch's rows can
+    # each target a different model, so the project's per-model ITPM/OTPM
+    # quota for a row's actual model must be charged with that row's own
+    # tokens -- see `_create_project_io_descriptors_for_models`.
+    per_model_usage: dict[str, dict[str, int]] = Field(
+        default_factory=dict
+    )  # mutable-ok: accumulated incrementally per row while parsing the batch file
 
 
 class _PROXY_BatchRateLimiter(CustomLogger):
@@ -198,6 +219,15 @@ class _PROXY_BatchRateLimiter(CustomLogger):
         user_api_key_dict: UserAPIKeyAuth,
         data: dict,
     ) -> list["RateLimitDescriptor"]:
+        """Build the standard key/user/team/model descriptor list a batch is charged against.
+
+        Deliberately excludes the project-scoped ITPM/OTPM descriptors: those
+        are charged per the JSONL row's own `body.model` once the file is
+        parsed (`_create_project_io_descriptors_for_models`), not the
+        file-bound/top-level routing model this function resolves. Charging
+        project quotas here would let a caller bind the file to a model
+        without a quota while rows execute against a quota-limited model.
+        """
         return self.parallel_request_limiter._create_rate_limit_descriptors(
             user_api_key_dict=user_api_key_dict,
             data=data,
@@ -206,6 +236,57 @@ class _PROXY_BatchRateLimiter(CustomLogger):
             model_has_failures=False,
         )
 
+    @staticmethod
+    def _project_has_any_io_token_limits(user_api_key_dict: UserAPIKeyAuth) -> bool:
+        """True when the project has any per-model ITPM/OTPM quota configured.
+
+        Used to stop the "skip batch input file processing" fast path from
+        bypassing a project quota configured for a model other than the
+        batch's file-bound/top-level routing model: the row models that
+        actually drive execution and billing aren't known until the JSONL
+        is parsed, so the file must be read whenever *any* model could be
+        quota-limited, not only when the routing model itself is.
+        """
+        if user_api_key_dict.project_id is None:
+            return False
+        return bool(
+            get_model_rate_limit_from_metadata(user_api_key_dict, "project_metadata", "model_itpm_limit")
+        ) or bool(get_model_rate_limit_from_metadata(user_api_key_dict, "project_metadata", "model_otpm_limit"))
+
+    def _create_project_io_descriptors_for_models(
+        self,
+        user_api_key_dict: UserAPIKeyAuth,
+        per_model_usage: Mapping[str, Mapping[str, int]],
+    ) -> tuple[list["RateLimitDescriptor"], list[IncrementAmounts]]:  # mutable-ok: see below
+        """Build project ITPM/OTPM descriptors charged against each row's own model.
+
+        One descriptor pair per distinct `body.model` found in the JSONL,
+        each incremented only by that model's own counted usage -- never the
+        whole-batch total -- so a quota-limited model can't hide behind an
+        unlimited routing model, and an unrelated model's rows can't inflate
+        a different model's counter.
+        """
+        extra_descriptors: Final[list[RateLimitDescriptor]] = []  # mutable-ok: see above
+        extra_increments: Final[list[IncrementAmounts]] = []  # mutable-ok: see above
+        for model, usage in per_model_usage.items():
+            model_descriptors: list[RateLimitDescriptor] = []  # mutable-ok: reset per loop iteration, not module state
+            self.parallel_request_limiter.add_project_io_token_rate_limit_descriptors_from_metadata(
+                user_api_key_dict=user_api_key_dict,
+                requested_model=model,
+                descriptors=model_descriptors,
+            )
+            for descriptor in model_descriptors:
+                extra_descriptors.append(descriptor)
+                extra_increments.append(
+                    {  # mutable-ok: atomic limiter API requires mutable increment records
+                        "requests": 0,
+                        "tokens": usage.get("output_tokens", 0)
+                        if descriptor["key"] == PROJECT_OTPM_DESCRIPTOR_KEY
+                        else usage.get("total_tokens", 0),
+                    }
+                )
+        return extra_descriptors, extra_increments
+
     def _should_skip_batch_input_file_processing(
         self,
         data: dict,
@@ -232,6 +313,11 @@ class _PROXY_BatchRateLimiter(CustomLogger):
         routing deployment's trusted credentials and the batch is constrained
         to run on that provider.
 
+        The no-limits check also treats any project-configured ITPM/OTPM
+        quota as an applicable limit, even when it isn't scoped to the
+        routing model: a row can target a different, quota-limited model,
+        and that isn't knowable without parsing the JSONL.
+
         Returns ``(should_skip, descriptors)`` where ``descriptors`` is the
         rate-limit descriptor list computed for the no-limits check, so the
         caller can reuse it for counter enforcement without recomputing.
@@ -257,7 +343,9 @@ class _PROXY_BatchRateLimiter(CustomLogger):
             user_api_key_dict=user_api_key_dict,
             data=data,
         )
-        if not self._has_applicable_batch_rate_limits(descriptors):
+        if not self._has_applicable_batch_rate_limits(descriptors) and not self._project_has_any_io_token_limits(
+            user_api_key_dict
+        ):
             verbose_proxy_logger.debug("Skipping batch input file processing: no rate limits configured")
             return True, None
 
@@ -297,6 +385,58 @@ class _PROXY_BatchRateLimiter(CustomLogger):
             return False
         return True
 
+    def _estimate_entry_output_tokens(
+        self,
+        entry: Mapping[str, object],
+        min_configured_otpm_limit: int | None,
+    ) -> int:
+        """Conservative per-row output-token estimate for the project OTPM reservation.
+
+        Batch completion never reconciles actual usage back into the rate
+        limiter, so this pre-call estimate is the only OTPM enforcement a
+        batch gets. Mirrors the real-time no-``max_tokens`` floor so a row
+        that omits an output cap can't be used to bypass OTPM the way an
+        unbounded streaming request could.
+
+        Embeddings rows are identified by the row's own ``url`` (the OpenAI
+        batch schema puts the target route there, e.g. ``/v1/embeddings``),
+        never by body shape: a `/v1/responses` row also carries `body.input`
+        with no `messages`/`prompt`, so guessing from body shape alone would
+        misclassify a token-generating Responses row as a zero-output
+        embeddings row and let it skip the OTPM reservation entirely.
+        """
+        url: Final = entry.get("url")
+        if isinstance(url, str) and "embeddings" in url:
+            return 0  # embeddings: no output tokens
+        raw_body: Final = entry.get("body")
+        body: Final[Mapping[str, object]] = (
+            MappingProxyType(_BATCH_BODY_ADAPTER.validate_python(raw_body))
+            if isinstance(raw_body, Mapping)
+            else MappingProxyType({})  # mutable-ok: immediately frozen empty fallback
+        )
+        # `max_tokens`/`max_completion_tokens` cap chat completions; `/v1/responses`
+        # rows cap output with `max_output_tokens` instead -- omitting it here
+        # would fall through to the floor estimate for every capped Responses row.
+        explicit_cap: Final = next(
+            (
+                v
+                for v in (
+                    body.get("max_tokens"),
+                    body.get("max_completion_tokens"),
+                    body.get("max_output_tokens"),
+                )
+                if v is not None
+            ),
+            None,
+        )
+        candidate_count: Final = self.parallel_request_limiter.get_output_candidate_count(body)
+        if explicit_cap is not None:
+            try:
+                return max(0, int(explicit_cap)) * candidate_count
+            except (TypeError, ValueError, OverflowError):
+                pass
+        return self.parallel_request_limiter.no_max_tokens_output_floor(min_configured_otpm_limit) * candidate_count
+
     @staticmethod
     def _has_applicable_batch_rate_limits(
         descriptors: list["RateLimitDescriptor"],
@@ -382,9 +522,22 @@ class _PROXY_BatchRateLimiter(CustomLogger):
         """Raise :class:`ProxyRateLimitError` (a 429) for batch rate limit exceeded."""
         from datetime import datetime
 
-        # Find the descriptor for this status
+        # Find the descriptor for this status. Matching on (key, value) is
+        # required, not key alone: a batch can carry several project ITPM/OTPM
+        # descriptors sharing one key (e.g. `model_per_project_otpm`) but
+        # scoped to different models via `value`
+        # ("{project_id}:{model}") -- key-only matching would always resolve
+        # to the first same-keyed descriptor regardless of which one was
+        # actually over its limit. Falls back to key-only matching for
+        # statuses that predate `descriptor_value` (e.g. from should_rate_limit).
+        status_descriptor_value: Final = status.get("descriptor_value")
         descriptor_index: Final = next(
-            (i for i, d in enumerate(descriptors) if d.get("key") == status.get("descriptor_key")),
+            (
+                i
+                for i, d in enumerate(descriptors)
+                if d.get("key") == status.get("descriptor_key")
+                and (status_descriptor_value is None or d.get("value") == status_descriptor_value)
+            ),
             0,
         )
         descriptor: Final[RateLimitDescriptor] = (
@@ -407,9 +560,27 @@ class _PROXY_BatchRateLimiter(CustomLogger):
                 f"Limit resets at: {reset_time_formatted}"
             )
         else:  # tokens
+            # Project ITPM/OTPM descriptors are keyed "{project_id}:{model}" and
+            # charged with that model's own rows (see
+            # `_create_project_io_descriptors_for_models`), not the whole
+            # batch's totals -- report the matching per-model figure when one
+            # is available so the error reflects what was actually charged.
+            descriptor_model: Final = (
+                descriptor.get("value", "").split(":", 1)[-1]
+                if descriptor.get("key") in (PROJECT_ITPM_DESCRIPTOR_KEY, PROJECT_OTPM_DESCRIPTOR_KEY)
+                else None
+            )
+            model_usage: Final = batch_usage.per_model_usage.get(descriptor_model) if descriptor_model else None
+            batch_token_count: Final = (
+                (model_usage or {}).get("output_tokens", batch_usage.output_tokens)
+                if descriptor.get("key") == PROJECT_OTPM_DESCRIPTOR_KEY
+                else (model_usage or {}).get("total_tokens", batch_usage.total_tokens)
+                if descriptor.get("key") == PROJECT_ITPM_DESCRIPTOR_KEY
+                else batch_usage.total_tokens
+            )
             detail = (
                 f"Batch rate limit exceeded for {descriptor.get('key', 'unknown')}: {descriptor.get('value', 'unknown')}. "
-                f"Batch contains {batch_usage.total_tokens} tokens but only {remaining_display} tokens remaining "
+                f"Batch contains {batch_token_count} tokens but only {remaining_display} tokens remaining "
                 f"out of {current_limit} TPM limit. "
                 f"Limit resets at: {reset_time_formatted}"
             )
@@ -444,7 +615,10 @@ class _PROXY_BatchRateLimiter(CustomLogger):
         falls back to a per-process asyncio.Lock + in-memory operation.
 
         ``descriptors`` may be passed in by the pre-call hook to reuse the list
-        already computed when deciding whether to skip file processing.
+        already computed when deciding whether to skip file processing. It
+        never contains project ITPM/OTPM descriptors (those are model-specific
+        and only knowable once ``batch_usage.per_model_usage`` is populated by
+        parsing the JSONL), so this always builds and appends them here.
         """
         if descriptors is None:
             descriptors = self._create_batch_rate_limit_descriptors(
@@ -452,11 +626,20 @@ class _PROXY_BatchRateLimiter(CustomLogger):
                 data=data,
             )
 
-        increment: Final[dict[Literal["requests", "tokens"], int]] = {
-            "requests": batch_usage.request_count,
-            "tokens": batch_usage.total_tokens,
-        }
-        increments: Final[list[dict[Literal["requests", "tokens"], int]]] = [increment for _ in descriptors]
+        increments: list[IncrementAmounts] = [  # mutable-ok: reassigned below to append project IO increments
+            {  # mutable-ok: atomic limiter API requires mutable increment records
+                "requests": batch_usage.request_count,
+                "tokens": batch_usage.total_tokens,
+            }
+            for _d in descriptors
+        ]
+
+        project_io_descriptors, project_io_increments = self._create_project_io_descriptors_for_models(
+            user_api_key_dict=user_api_key_dict,
+            per_model_usage=batch_usage.per_model_usage,
+        )
+        descriptors = [*descriptors, *project_io_descriptors]
+        increments = [*increments, *project_io_increments]
 
         rate_limit_response: Final = await self.parallel_request_limiter.atomic_check_and_increment_by_n(
             descriptors=descriptors,
@@ -482,6 +665,7 @@ class _PROXY_BatchRateLimiter(CustomLogger):
         custom_llm_provider: Literal["openai", "azure", "vertex_ai"] = "openai",
         user_api_key_dict: UserAPIKeyAuth | None = None,
         data: dict | None = None,
+        descriptors: Sequence["RateLimitDescriptor"] | None = None,
     ) -> BatchFileUsage:
         """
         Count number of requests and tokens in a batch input file.
@@ -490,10 +674,37 @@ class _PROXY_BatchRateLimiter(CustomLogger):
             file_id: The file ID to read
             custom_llm_provider: The custom LLM provider to use for token encoding
             user_api_key_dict: User authentication information for file access (required for managed files)
+            descriptors: Rate limit descriptors already computed for this batch, so the
+                configured project OTPM limit can scale the no-``max_tokens`` output floor
 
         Returns:
-            BatchFileUsage with total_tokens and request_count
+            BatchFileUsage with total_tokens, output_tokens, request_count, and
+            per_model_usage (each row's own totals, keyed by its `body.model`)
         """
+        descriptor_otpm_limits: Final = tuple(
+            int(v)
+            for d in (descriptors or ())
+            if d.get("key") == PROJECT_OTPM_DESCRIPTOR_KEY
+            for rate_limit in (d.get("rate_limit"),)
+            for v in (rate_limit.get("tokens_per_unit") if rate_limit is not None else None,)
+            if v is not None
+        )
+        # `descriptors` only ever carries the routing model's own OTPM limit
+        # (see `_create_batch_rate_limit_descriptors`), but a row can target
+        # any project-configured model. Folding in every configured model's
+        # OTPM limit keeps the no-`max_tokens` floor from drifting wide just
+        # because a row's specific model isn't known until parsed below.
+        project_otpm_limits: Final = (
+            tuple(int(v) for v in project_otpm_limit_map.values())
+            if user_api_key_dict is not None
+            and (
+                project_otpm_limit_map := get_model_rate_limit_from_metadata(
+                    user_api_key_dict, "project_metadata", "model_otpm_limit"
+                )
+            )
+            else ()
+        )
+        min_configured_otpm_limit: Final = min((*descriptor_otpm_limits, *project_otpm_limits), default=None)
         try:
             # Check if this is a managed file (base64 encoded unified file ID)
             from litellm.proxy.openai_files_endpoints.common_utils import (
@@ -545,23 +756,51 @@ class _PROXY_BatchRateLimiter(CustomLogger):
             # Counting stays best-effort, so a legitimate (e.g. multimodal) row
             # the counter can't measure is estimated, not hard-rejected.
             models: Final[set] = set()
+            # Keyed by each row's own `body.model`, so the project ITPM/OTPM
+            # quota for that model is charged with only its own rows' tokens,
+            # never the whole batch's -- see `_create_project_io_descriptors_for_models`.
+            per_model_usage: Final[dict[str, dict[str, int]]] = {}
             total_tokens = 0
+            output_tokens = 0  # rebind-ok: accumulated per JSONL row in the loop below
             request_count = 0
             for raw_line in _iter_batch_input_lines(file_content_bytes):
                 request_count += 1
                 try:
                     entry = json.loads(raw_line)
                 except Exception:
-                    total_tokens += _estimate_batch_entry_tokens(raw_line)
+                    entry_total_tokens = _estimate_batch_entry_tokens(raw_line)
+                    entry_output_tokens = self.parallel_request_limiter.no_max_tokens_output_floor(
+                        min_configured_otpm_limit
+                    )
+                    total_tokens += entry_total_tokens
+                    output_tokens += entry_output_tokens
                     continue
+
+                model: str | None = (entry.get("body") or {}).get("model") if isinstance(entry, dict) else None
+                if model:
+                    models.add(model)
+
                 if isinstance(entry, dict):
-                    model = (entry.get("body") or {}).get("model")
-                    if model:
-                        models.add(model)
+                    entry_output_tokens = self._estimate_entry_output_tokens(entry, min_configured_otpm_limit)
+                else:
+                    entry_output_tokens = self.parallel_request_limiter.no_max_tokens_output_floor(
+                        min_configured_otpm_limit
+                    )
+                output_tokens += entry_output_tokens
+
                 try:
-                    total_tokens += _count_entry_tokens(entry)
+                    entry_total_tokens = _count_entry_tokens(entry)
                 except Exception:
-                    total_tokens += _estimate_batch_entry_tokens(raw_line)
+                    entry_total_tokens = _estimate_batch_entry_tokens(raw_line)
+                total_tokens += entry_total_tokens
+
+                if model:
+                    model_usage = per_model_usage.setdefault(
+                        model, {"total_tokens": 0, "output_tokens": 0, "request_count": 0}
+                    )
+                    model_usage["total_tokens"] += entry_total_tokens
+                    model_usage["output_tokens"] += entry_output_tokens
+                    model_usage["request_count"] += 1
 
             # Validate every model named in the batch JSONL against the
             # caller's per-key model allowlist. Without this, a caller
@@ -578,6 +817,8 @@ class _PROXY_BatchRateLimiter(CustomLogger):
             return BatchFileUsage(
                 total_tokens=total_tokens,
                 request_count=request_count,
+                output_tokens=output_tokens,
+                per_model_usage=per_model_usage,
             )
 
         except HTTPException as e:
@@ -814,6 +1055,7 @@ class _PROXY_BatchRateLimiter(CustomLogger):
                 custom_llm_provider=custom_llm_provider,
                 user_api_key_dict=user_api_key_dict,
                 data=data,
+                descriptors=batch_rate_limit_descriptors,
             )
 
             verbose_proxy_logger.debug(
diff --git a/litellm/proxy/hooks/dynamic_rate_limiter_v3.py b/litellm/proxy/hooks/dynamic_rate_limiter_v3.py
index 4492f42782c..de8834449de 100644
--- a/litellm/proxy/hooks/dynamic_rate_limiter_v3.py
+++ b/litellm/proxy/hooks/dynamic_rate_limiter_v3.py
@@ -454,7 +454,9 @@ class _PROXY_DynamicRateLimitHandlerV3(CustomLogger):
             parent_otel_span=user_api_key_dict.parent_otel_span,
         )
 
-        verbose_proxy_logger.debug("Atomic check+increment response: %s", json.dumps(atomic_response, indent=2))
+        verbose_proxy_logger.debug(
+            "Atomic check+increment response: %s", json.dumps(atomic_response, indent=2, default=list)
+        )
 
         if atomic_response["overall_code"] == "OVER_LIMIT":
             resolved_model, llm_provider = resolve_llm_provider_for_rate_limit(model)
diff --git a/litellm/proxy/hooks/parallel_request_limiter_v3.py b/litellm/proxy/hooks/parallel_request_limiter_v3.py
index 94ef08782d9..2d799ded752 100644
--- a/litellm/proxy/hooks/parallel_request_limiter_v3.py
+++ b/litellm/proxy/hooks/parallel_request_limiter_v3.py
@@ -8,7 +8,7 @@ import asyncio
 import binascii
 import os
 import uuid
-from collections.abc import Callable, Sequence
+from collections.abc import Callable, Mapping, Sequence, Set
 from contextvars import ContextVar
 from dataclasses import dataclass, field
 from datetime import datetime
@@ -22,6 +22,8 @@ from typing import (
     TypedDict,
 )
 
+from typing_extensions import NotRequired, ReadOnly
+
 from litellm import DualCache
 from litellm._logging import verbose_proxy_logger
 from litellm.constants import DYNAMIC_RATE_LIMIT_ERROR_THRESHOLD_PER_MINUTE, INTERNAL_CALL_ORIGIN_METADATA_KEY
@@ -44,11 +46,12 @@ from litellm.proxy.common_utils.proxy_rate_limit_error import (
 )
 from litellm.proxy.hooks.rate_limiter_utils import resolve_llm_provider_for_rate_limit
 from litellm.types.caching import RedisPipelineIncrementOperation
-from litellm.types.llms.openai import BaseLiteLLMOpenAIResponseObject
+from litellm.types.llms.openai import BaseLiteLLMOpenAIResponseObject, ResponseAPIUsage
 from litellm.types.utils import (
     CallTypes,
     EmbeddingResponse,
     ModelResponse,
+    RerankResponse,
     TextCompletionResponse,
     Usage,
 )
@@ -66,6 +69,7 @@ else:
     Span = Any
     InternalUsageCache = Any
 
+
 BATCH_RATE_LIMITER_SCRIPT: Final = """
 local results = {}
 local now = tonumber(ARGV[1])
@@ -120,7 +124,8 @@ CHECK_AND_INCREMENT_BY_N_SCRIPT: Final = """
 --     ARGV[(i-1)*4 + 3] = ttl_seconds (counter TTL when window resets)
 --     ARGV[(i-1)*4 + 4] = window_size_seconds (sliding-window length)
 --
--- Return on success: { 0, new_counter_1, new_counter_2, ... }
+-- Return on success:
+--     { 0, new_counter_1, window_start_1, new_counter_2, window_start_2, ... }
 -- Return on over-limit: { 1, descriptor_index, current_counter, limit }
 local time_reply = redis.call('TIME')
 local now = tonumber(time_reply[1])
@@ -157,7 +162,7 @@ for i = 1, descriptor_count do
         return { 1, i, current_counter, limit }
     end
 
-    descriptor_state[i] = { window_expired, current_counter }
+    descriptor_state[i] = { window_expired, current_counter, window_start }
 end
 
 -- Pass 2: all checks passed. Apply increments.
@@ -171,8 +176,10 @@ for i = 1, descriptor_count do
     local window_size = tonumber(ARGV[arg_base + 3])
 
     local window_expired = descriptor_state[i][1]
+    local active_window_start
 
     if window_expired then
+        active_window_start = now
         redis.call('SET', window_key, tostring(now))
         redis.call('SET', counter_key, increment)
         redis.call('EXPIRE', window_key, window_size)
@@ -181,6 +188,7 @@ for i = 1, descriptor_count do
         end
         table.insert(results, increment)
     else
+        active_window_start = tonumber(descriptor_state[i][3])
         local new_counter = redis.call('INCRBY', counter_key, increment)
         local current_ttl = redis.call('TTL', counter_key)
         if current_ttl == -1 and ttl > 0 then
@@ -188,11 +196,39 @@ for i = 1, descriptor_count do
         end
         table.insert(results, new_counter)
     end
+    table.insert(results, active_window_start)
 end
 
 return results
 """
 
+WINDOW_GUARDED_TOKEN_INCREMENT_SCRIPT: Final = """
+local results = {}
+for i = 1, #KEYS, 2 do
+    local window_key = KEYS[i]
+    local counter_key = KEYS[i + 1]
+    local arg_base = ((i - 1) / 2) * 3 + 1
+    local expected_window_start = ARGV[arg_base]
+    local increment = tonumber(ARGV[arg_base + 1])
+    local ttl = tonumber(ARGV[arg_base + 2])
+    local active_window_start = redis.call('GET', window_key)
+
+    if active_window_start and active_window_start == expected_window_start then
+        local new_counter = redis.call('INCRBY', counter_key, increment)
+        local current_ttl = redis.call('TTL', counter_key)
+        if current_ttl == -1 and ttl > 0 then
+            redis.call('EXPIRE', counter_key, ttl)
+        end
+        table.insert(results, 1)
+        table.insert(results, new_counter)
+    else
+        table.insert(results, 0)
+        table.insert(results, tonumber(redis.call('GET', counter_key) or 0))
+    end
+end
+return results
+"""
+
 PARALLEL_ACQUIRE_SCRIPT: Final = """
 -- Atomic check-and-acquire for the max_parallel_requests concurrency gauge.
 -- Each gauge key is a sorted set of per-request slot ids scored by acquire
@@ -297,6 +333,38 @@ DEFAULT_CHARS_PER_TOKEN: Final = 4
 # (baseline floor) and to the smallest configured TPM limit (capped floor for
 # small per-tenant TPM caps).
 _TPM_FLOOR_FRACTION: Final = 4
+# Both embeddings and the Responses API put their prompt in data["input"],
+# but only embeddings have no output tokens. Every "is this an embedding"
+# check on data["input"] must exclude these call types, or a Responses call
+# gets misclassified as an embedding and skips output-token reservation/caps.
+RESPONSES_API_CALL_TYPES: Final = ("aresponses", "responses")
+EMBEDDING_API_CALL_TYPES: Final = ("aembedding", "embedding")
+TEXT_COMPLETION_API_CALL_TYPES: Final = ("atext_completion", "text_completion")
+RERANK_API_CALL_TYPES: Final = (CallTypes.rerank.value, CallTypes.arerank.value)
+GOOGLE_GENAI_NATIVE_CALL_TYPES: Final = (
+    CallTypes.generate_content.value,
+    CallTypes.agenerate_content.value,
+    CallTypes.generate_content_stream.value,
+    CallTypes.agenerate_content_stream.value,
+)
+RESPONSES_API_MIN_OUTPUT_TOKENS: Final = 16
+# litellm.token_counter has no per-type handling for "input_audio" content
+# blocks (unlike images, which use use_default_image_token_count) -- it
+# silently contributes 0 tokens for them. When the block carries a base64
+# payload, the estimate is derived from the decoded byte count; when the
+# block is a reference without a payload (or the payload is missing), this
+# flat per-block floor is used instead.
+DEFAULT_AUDIO_TOKEN_ESTIMATE: Final = 300
+# Conservative bytes-per-token assumption for size-based audio estimation:
+# equivalent to 8 kHz mono PCM-16 (16 000 bytes/s) at 10 tokens/s. Choosing
+# the lowest reasonable bitrate means we never under-reserve for higher-
+# quality audio recorded at the same wall-clock duration.
+_AUDIO_BYTES_PER_TOKEN: Final = 1600
+# Descriptor "key" values for project-scoped ITPM/OTPM. Distinct from
+# "model_per_project" (the combined-TPM descriptor) so both can be enforced
+# on the same project+model simultaneously without colliding on cache keys.
+PROJECT_ITPM_DESCRIPTOR_KEY: Final = "model_per_project_itpm"
+PROJECT_OTPM_DESCRIPTOR_KEY: Final = "model_per_project_otpm"
 # How long an acquired slot counts toward the in-flight total before it is
 # considered leaked (worker crashed without any release callback firing) and
 # pruned. Also the longest request duration the gauge can track: a request
@@ -341,11 +409,24 @@ class RateLimitStatus(TypedDict):
     limit_remaining: int
     rate_limit_type: Literal["requests", "tokens", "max_parallel_requests"]
     descriptor_key: str
+    # Only populated by the atomic_check_and_increment_by_n path. A caller
+    # matching a status back to its descriptor must key on (descriptor_key,
+    # descriptor_value) when this is present, not descriptor_key alone --
+    # e.g. a batch charging several models' project ITPM/OTPM in one call
+    # produces multiple statuses sharing the same descriptor_key.
+    descriptor_value: NotRequired[ReadOnly[str]]
 
 
 class RateLimitResponse(TypedDict):
     overall_code: str
     statuses: list[RateLimitStatus]
+    reservation_windows: NotRequired[ReadOnly[frozenset[tuple[str, str, Literal["redis", "local"]]]]]
+
+
+class ReservationAwareIncrementOperation(RedisPipelineIncrementOperation):
+    window_key: NotRequired[str]
+    expected_window_start: NotRequired[str]
+    reservation_backend: NotRequired[Literal["redis", "local"]]
 
 
 class RateLimitResponseWithDescriptors(TypedDict):
@@ -353,6 +434,10 @@ class RateLimitResponseWithDescriptors(TypedDict):
     response: RateLimitResponse
 
 
+class _RateLimitDescriptorSink(Protocol):
+    def append(self, descriptor: RateLimitDescriptor, /) -> None: ...
+
+
 class WindowKeyMetadata(TypedDict):
     requests_limit: int | None
     tokens_limit: int | None
@@ -362,6 +447,7 @@ class WindowKeyMetadata(TypedDict):
 
 class AtomicCounterMeta(TypedDict):
     descriptor_key: str
+    descriptor_value: ReadOnly[str]
     current_limit: int
     rate_limit_type: Literal["requests", "tokens"]
     window_key: str
@@ -374,6 +460,7 @@ class AtomicCounterMeta(TypedDict):
 class AtomicCounterState(TypedDict):
     window_expired: bool
     current: int
+    window_start: ReadOnly[str]
 
 
 DescriptorAtomicGroup: TypeAlias = tuple[list[str], list[int], list[AtomicCounterMeta]]
@@ -418,6 +505,16 @@ class RequestRateLimiterStash:
     reserved_tokens: int = 0
     reserved_model: str | None = None
     reserved_scopes: frozenset[tuple[str, str]] = field(default_factory=frozenset)
+    itpm_reserved_tokens: int = 0
+    itpm_reserved_scopes: frozenset[tuple[str, str]] = field(default_factory=frozenset)
+    itpm_reserved_window_identities: frozenset[tuple[str, str, Literal["redis", "local"]]] = field(
+        default_factory=frozenset
+    )
+    otpm_reserved_tokens: int = 0
+    otpm_reserved_scopes: frozenset[tuple[str, str]] = field(default_factory=frozenset)
+    otpm_reserved_window_identities: frozenset[tuple[str, str, Literal["redis", "local"]]] = field(
+        default_factory=frozenset
+    )
     reservation_released: bool = False
 
 
@@ -462,21 +559,13 @@ def _call_id_from_callback_kwargs(kwargs: object) -> str | None:
     return call_id if isinstance(call_id, str) else None
 
 
-def _declared_output_budget(value: object) -> int | None:
-    """Coerce a declared output budget to tokens, or None when it names no budget.
-
-    Accepts every shape the pre-existing ``int(...)`` coercion did, floats and numeric
-    strings included, because a budget this cannot read is a budget this cannot reserve
-    against, which is the bypass the caller-declared limits are checked for.
-    """
-    if isinstance(value, (int, float)):
-        return int(value)
-    if isinstance(value, str):
-        try:
-            return int(float(value))
-        except ValueError:
-            return None
-    return None
+def _parse_output_cap_value(raw_value: object) -> int | None:
+    if isinstance(raw_value, bool) or not isinstance(raw_value, (int, float, str)):
+        return None
+    try:
+        return int(float(raw_value))
+    except (ValueError, OverflowError):
+        return None
 
 
 class _PROXY_MaxParallelRequestsHandler_v3(CustomLogger):
@@ -497,6 +586,11 @@ class _PROXY_MaxParallelRequestsHandler_v3(CustomLogger):
             self.check_and_increment_by_n_script = (
                 self.internal_usage_cache.dual_cache.redis_cache.async_register_script(CHECK_AND_INCREMENT_BY_N_SCRIPT)
             )
+            self.window_guarded_token_increment_script = (
+                self.internal_usage_cache.dual_cache.redis_cache.async_register_script(
+                    WINDOW_GUARDED_TOKEN_INCREMENT_SCRIPT
+                )
+            )
             self.parallel_acquire_script = self.internal_usage_cache.dual_cache.redis_cache.async_register_script(
                 PARALLEL_ACQUIRE_SCRIPT
             )
@@ -510,6 +604,7 @@ class _PROXY_MaxParallelRequestsHandler_v3(CustomLogger):
             self.batch_rate_limiter_script = None
             self.token_increment_script = None
             self.check_and_increment_by_n_script = None
+            self.window_guarded_token_increment_script = None
             self.parallel_acquire_script = None
             self.parallel_release_script = None
             self.parallel_count_script = None
@@ -562,7 +657,7 @@ class _PROXY_MaxParallelRequestsHandler_v3(CustomLogger):
         return self._time_provider()
 
     @staticmethod
-    def _no_max_tokens_output_floor(
+    def no_max_tokens_output_floor(
         min_configured_tpm_limit: int | None,
     ) -> int:
         """Output-budget floor used when the request omits max_tokens.
@@ -576,11 +671,164 @@ class _PROXY_MaxParallelRequestsHandler_v3(CustomLogger):
             return baseline
         return min(baseline, max(1, min_configured_tpm_limit // _TPM_FLOOR_FRACTION))
 
+    @staticmethod
+    def _is_embedding_request(data: object, call_type: str | None) -> bool:
+        if call_type in EMBEDDING_API_CALL_TYPES:
+            return True
+        if call_type in RESPONSES_API_CALL_TYPES:
+            return False
+        if call_type:
+            return False
+        if not isinstance(data, dict):
+            return False
+        return data.get("input") is not None
+
+    @staticmethod
+    def _translate_google_genai_native_request(
+        data: object,
+        call_type: str | None,
+    ) -> Mapping[str, object] | None:
+        contents: Final = data.get("contents") if isinstance(data, dict) else None
+        if (
+            not isinstance(data, dict)
+            or call_type not in GOOGLE_GENAI_NATIVE_CALL_TYPES
+            or not isinstance(contents, (dict, list))
+        ):
+            return None
+        from litellm.google_genai.adapters.transformation import GoogleGenAIAdapter
+
+        config: Final = data.get("config") if "config" in data else data.get("generationConfig")
+        return GoogleGenAIAdapter().translate_generate_content_to_completion(
+            model=data.get("model") if isinstance(data.get("model"), str) else "",
+            contents=contents,
+            config=config if isinstance(config, dict) else None,
+            systemInstruction=data.get("systemInstruction"),
+            system_instruction=data.get("system_instruction"),
+            tools=data.get("tools"),
+            toolConfig=data.get("toolConfig"),
+            tool_config=data.get("tool_config"),
+        )
+
+    @staticmethod
+    def _get_explicit_output_cap(data: object, call_type: str | None) -> int | None:
+        if not isinstance(data, dict):
+            return None
+        if call_type in GOOGLE_GENAI_NATIVE_CALL_TYPES:
+            config: Final = data.get("config") if "config" in data else data.get("generationConfig")
+            google_cap_values: Final = tuple(
+                parsed
+                for field in ("maxOutputTokens", "max_output_tokens")
+                if isinstance(config, dict)
+                for parsed in (_parse_output_cap_value(config.get(field)),)
+                if parsed is not None
+            )
+            return max(google_cap_values, default=None)
+        if call_type in RESPONSES_API_CALL_TYPES:
+            responses_cap: Final = _parse_output_cap_value(data.get("max_output_tokens"))
+            if responses_cap is None:
+                return None
+            return max(RESPONSES_API_MIN_OUTPUT_TOKENS, responses_cap)
+        if call_type in EMBEDDING_API_CALL_TYPES:
+            return None
+        fields: Final = (
+            ("max_tokens", "max_completion_tokens")
+            if call_type
+            else ("max_tokens", "max_completion_tokens", "max_output_tokens")
+        )
+        output_cap_values: Final = tuple(
+            parsed for field in fields for parsed in (_parse_output_cap_value(data.get(field)),) if parsed is not None
+        )
+        return max(output_cap_values, default=None)
+
+    @classmethod
+    def _has_explicit_output_cap(cls, data: object, call_type: str | None) -> bool:
+        """Whether the caller explicitly set an output-token cap.
+
+        Checked via ``is not None`` (not truthiness) so an explicit 0 --
+        a legitimate zero-output request -- counts as explicit.
+        """
+        return cls._get_explicit_output_cap(data, call_type) is not None
+
+    @staticmethod
+    def get_output_candidate_count(data: object, call_type: str | None = None) -> int:
+        if not isinstance(data, Mapping):
+            return 1
+        config: Final = (
+            (data.get("config") if "config" in data else data.get("generationConfig"))
+            if call_type in GOOGLE_GENAI_NATIVE_CALL_TYPES
+            else None
+        )
+        candidate_values: Final = (
+            data.get("n"),
+            data.get("best_of"),
+            config.get("candidateCount") if isinstance(config, dict) else None,
+            config.get("candidate_count") if isinstance(config, dict) else None,
+        )
+        candidate_count = 1  # rebind-ok: running maximum across candidate-count aliases
+        for value in candidate_values:
+            try:
+                candidate_count = max(candidate_count, int(value or 1))
+            except (TypeError, ValueError, OverflowError):
+                continue
+        return candidate_count
+
+    @staticmethod
+    def _apply_implicit_output_cap(
+        data: object,
+        min_configured_limit: int | None,
+        call_type: str | None,
+        configured_output_tokens: int | None = None,
+    ) -> None:
+        """Hard-cap generation length when the request has no explicit cap.
+
+        Guards against an unbounded response overshooting a small TPM/OTPM
+        budget before post-call reconciliation runs. Skips requests that
+        already set an explicit cap and embeddings, which have no generation
+        budget. The Responses API only honors ``max_output_tokens`` (its
+        underlying chat-completion transformation ignores ``max_tokens``), so
+        the cap must be written to that field for Responses call types.
+
+        ``configured_output_tokens`` is the operator-declared per-tenant
+        estimate; when it exceeds the safety floor, the cap is raised to that
+        value instead of clamping every tenant to the same floor.
+        """
+        if not isinstance(data, dict):
+            return
+        base_capped_floor: Final = _PROXY_MaxParallelRequestsHandler_v3.no_max_tokens_output_floor(min_configured_limit)
+        capped_floor: Final = (
+            max(base_capped_floor, RESPONSES_API_MIN_OUTPUT_TOKENS)
+            if call_type in RESPONSES_API_CALL_TYPES
+            else base_capped_floor
+        )
+        baseline_floor: Final = DEFAULT_MAX_TOKENS_ESTIMATE // _TPM_FLOOR_FRACTION
+        is_embedding: Final = _PROXY_MaxParallelRequestsHandler_v3._is_embedding_request(data, call_type)
+        if (
+            capped_floor >= baseline_floor
+            or _PROXY_MaxParallelRequestsHandler_v3._has_explicit_output_cap(data, call_type)
+            or is_embedding
+        ):
+            return
+        effective_cap: Final = max(capped_floor, configured_output_tokens or 0)
+        if call_type in GOOGLE_GENAI_NATIVE_CALL_TYPES:
+            config_field: Final = "config" if "config" in data or "generationConfig" not in data else "generationConfig"
+            config: Final = data.get(config_field)
+            if config is None or isinstance(config, dict):
+                data[config_field] = {  # rebind-ok: routed request needs cap  # mutable-ok: downstream needs dict
+                    **(config or {}),  # mutable-ok: downstream native routing requires a mutable request config
+                    "maxOutputTokens": effective_cap,
+                }
+            return
+        cap_field: Final = "max_output_tokens" if call_type in RESPONSES_API_CALL_TYPES else "max_tokens"
+        existing_cap: Final = data.get(cap_field)
+        if existing_cap is None or effective_cap < existing_cap:
+            data[cap_field] = effective_cap  # rebind-ok: downstream routing requires the bounded output cap
+
     def _estimate_tokens_for_request(
         self,
         data: dict,
         model: str | None = None,
         min_configured_tpm_limit: int | None = None,
+        call_type: str | None = None,
         configured_output_tokens: int | None = None,
     ) -> int:
         """
@@ -588,7 +836,9 @@ class _PROXY_MaxParallelRequestsHandler_v3(CustomLogger):
         upfront (input + output budget):
         estimated = input_tokens + max_tokens.
 
-        Supports chat (messages), completions (prompt), and embeddings (input).
+        Supports chat (messages), completions (prompt), embeddings (input),
+        and the Responses API (also `input`, disambiguated from embeddings
+        via ``call_type``).
 
         ``min_configured_tpm_limit`` is the smallest ``tokens_per_unit`` among
         the TPM-bearing descriptors this request will be charged against. When
@@ -601,78 +851,108 @@ class _PROXY_MaxParallelRequestsHandler_v3(CustomLogger):
         floor entirely, so the reservation reflects what this tenant's model
         actually emits rather than one constant shared by every tenant.
         """
-        messages = data.get("messages")
-        prompt: Final = data.get("prompt")
-        input_text: Final = data.get("input")  # embeddings
-
-        match (messages, prompt, input_text):
-            case (messages, _, _) if messages:
-                total_chars = len(get_str_from_messages(messages))
-            case (_, str() as p, _):
-                total_chars = len(p)
-            case (_, list() as p, _):
-                total_chars = sum(len(str(item)) for item in p)
-            case (_, _, str() as t):
-                total_chars = len(t)
-            case (_, _, list() as t):
-                total_chars = sum(len(str(item)) for item in t)
-            case _:
-                total_chars = 0
-
-        estimated_input_tokens: Final = max(1, total_chars // DEFAULT_CHARS_PER_TOKEN) if total_chars > 0 else 0
-
-        # Both spellings can arrive together, e.g. a deployment-level max_tokens default under a
-        # client-supplied max_completion_tokens. Reserving against the larger keeps the estimate an
-        # upper bound on what the provider can emit, whichever one it ends up honouring.
-        declared_output_budgets: Final = tuple(
-            budget
-            for budget in (
-                _declared_output_budget(data.get("max_tokens")),
-                _declared_output_budget(data.get("max_completion_tokens")),
-            )
-            if budget is not None
+        estimated_input_tokens, max_tokens_estimate = self._estimate_input_and_output_tokens(
+            data=data,
+            min_configured_tpm_limit=min_configured_tpm_limit,
+            call_type=call_type,
+            configured_output_tokens=configured_output_tokens,
         )
-        explicit_max_tokens: Final = max(declared_output_budgets) if declared_output_budgets else None
-
-        match (explicit_max_tokens, input_text):
-            case (mt, _) if mt is not None:
-                max_tokens_estimate = int(mt)
-            case (_, embeddings_input) if embeddings_input:
-                # Embeddings have no output tokens
-                max_tokens_estimate = 0
-            case _ if total_chars == 0 and configured_output_tokens is None:
-                # Fully contentless request (no messages, prompt, or input).
-                # Don't apply the conservative output-budget floor here — it
-                # would over-reserve and could push small TPM limits into a
-                # false 429. The caller floors at 1 so backpressure still
-                # applies once the counter is at limit.
-                max_tokens_estimate = 0
-            case _:
-                # No max_tokens specified — reserve at least the input size with a
-                # conservative floor so a stream of small concurrent requests can't
-                # collectively bypass the limit. Cap the floor by a fraction of
-                # the smallest TPM limit this request will be charged against,
-                # so a small per-tenant TPM cap can't be tripped by the floor
-                # alone.
-                output_floor: Final = self._no_max_tokens_output_floor(min_configured_tpm_limit)
-                max_tokens_estimate = (
-                    configured_output_tokens
-                    if configured_output_tokens is not None
-                    else max(estimated_input_tokens, output_floor)
-                )
-
         total_estimated: Final = estimated_input_tokens + max_tokens_estimate
 
         verbose_proxy_logger.debug(
-            "TPM reservation estimate: input=%s, max_tokens=%s (explicit=%s), total=%s",
+            "TPM reservation estimate: input=%s, max_tokens=%s, total=%s",
             estimated_input_tokens,
             max_tokens_estimate,
-            explicit_max_tokens is not None,
             total_estimated,
         )
 
         return total_estimated
 
+    def _estimate_input_and_output_tokens(
+        self,
+        data: object,
+        min_configured_tpm_limit: int | None = None,
+        call_type: str | None = None,
+        configured_output_tokens: int | None = None,
+    ) -> tuple[int, int]:
+        """
+        Estimate input tokens and output (max_tokens) budget separately, so
+        callers needing independent ITPM/OTPM reservations (rather than one
+        combined TPM reservation) can use each half on its own.
+
+        ``min_configured_tpm_limit`` is the smallest ``tokens_per_unit`` among
+        the TPM-bearing descriptors this request will be charged against. When
+        provided, the no-``max_tokens`` output-budget floor is capped at a
+        fraction of that limit so small TPM caps remain usable. Omit to
+        preserve the unconstrained floor.
+
+        ``call_type`` disambiguates embeddings from the Responses API: both
+        put their prompt in ``data["input"]``, but only embeddings have no
+        output tokens. Unset (the default) preserves the historical
+        "any `input` means zero output" behavior for callers that don't have
+        a call type to pass.
+
+        ``configured_output_tokens`` is the operator-declared estimate resolved
+        from key or team metadata. When provided it replaces the heuristic
+        floor entirely, so the reservation reflects what this tenant's model
+        actually emits rather than one constant shared by every tenant.
+        """
+        if not isinstance(data, dict):
+            return 0, 0
+        translated_data: Final = self._translate_google_genai_native_request(data, call_type)
+        estimable_data: Final = translated_data if translated_data is not None else data
+        selected_fields: Final[tuple[object | None, object | None, object | None]] = (
+            (None, None, estimable_data.get("input"))
+            if call_type in RESPONSES_API_CALL_TYPES or call_type in EMBEDDING_API_CALL_TYPES
+            else (None, estimable_data.get("prompt"), None)
+            if call_type in TEXT_COMPLETION_API_CALL_TYPES
+            else (estimable_data.get("messages"), None, None)
+            if call_type
+            else (
+                estimable_data.get("messages"),
+                estimable_data.get("prompt"),
+                estimable_data.get("input"),
+            )
+        )
+        messages, prompt, input_text = selected_fields
+
+        total_chars: Final = (
+            len(get_str_from_messages(messages))
+            if isinstance(messages, list) and messages
+            else len(prompt)
+            if isinstance(prompt, str)
+            else sum(len(str(item)) for item in prompt)
+            if isinstance(prompt, list)
+            else len(input_text)
+            if isinstance(input_text, str)
+            else sum(len(str(item)) for item in input_text)
+            if isinstance(input_text, list)
+            else 0
+        )
+
+        estimated_input_tokens: Final = max(1, total_chars // DEFAULT_CHARS_PER_TOKEN) if total_chars > 0 else 0
+
+        explicit_max_tokens: Final = self._get_explicit_output_cap(data, call_type)
+        is_embedding: Final = self._is_embedding_request(data, call_type)
+
+        base_output_floor: Final = self.no_max_tokens_output_floor(min_configured_tpm_limit)
+        output_floor: Final = (
+            max(base_output_floor, RESPONSES_API_MIN_OUTPUT_TOKENS)
+            if call_type in RESPONSES_API_CALL_TYPES
+            else base_output_floor
+        )
+        max_tokens_estimate: Final = (
+            0
+            if is_embedding or (explicit_max_tokens is None and total_chars == 0 and configured_output_tokens is None)
+            else explicit_max_tokens
+            if explicit_max_tokens is not None
+            else configured_output_tokens
+            if configured_output_tokens is not None
+            else max(estimated_input_tokens, output_floor)
+        )
+
+        return estimated_input_tokens, max_tokens_estimate * self.get_output_candidate_count(data, call_type)
+
     def _is_redis_cluster(self) -> bool:
         """
         Check if the dual cache is using Redis cluster.
@@ -933,7 +1213,7 @@ class _PROXY_MaxParallelRequestsHandler_v3(CustomLogger):
 
     async def should_rate_limit(
         self,
-        descriptors: list[RateLimitDescriptor],
+        descriptors: Sequence[RateLimitDescriptor],
         parent_otel_span: Span | None = None,
         read_only: bool = False,
         skip_tpm_check: bool = False,
@@ -1059,7 +1339,7 @@ class _PROXY_MaxParallelRequestsHandler_v3(CustomLogger):
 
     def _collect_windowed_keys_and_gauges(
         self,
-        descriptors: list[RateLimitDescriptor],
+        descriptors: Sequence[RateLimitDescriptor],
         skip_tpm_check: bool,
     ) -> tuple[list[str], dict[str, WindowKeyMetadata], list[ParallelRequestGauge]]:
         """
@@ -1463,6 +1743,7 @@ class _PROXY_MaxParallelRequestsHandler_v3(CustomLogger):
             meta.append(
                 {
                     "descriptor_key": descriptor_key,
+                    "descriptor_value": descriptor_value,
                     "current_limit": int(limit_value),
                     "rate_limit_type": rlt,
                     "window_key": window_key,
@@ -1485,6 +1766,11 @@ class _PROXY_MaxParallelRequestsHandler_v3(CustomLogger):
         descriptor i, refund descriptors 0..i-1's increments. On Lua failure
         mid-loop, refund applied increments and fall back to in-memory.
         """
+        if not descriptor_groups:
+            return RateLimitResponse(
+                overall_code="OK",
+                statuses=[],  # mutable-ok: response contract requires a status list
+            )
         applied: Final[list[list[AtomicCounterMeta]]] = []
         statuses: Final[list[RateLimitStatus]] = []
         raw: list[CacheCounterValue]
@@ -1519,10 +1805,16 @@ class _PROXY_MaxParallelRequestsHandler_v3(CustomLogger):
             if response["overall_code"] == "OVER_LIMIT":
                 await self._refund_applied_descriptor_groups(applied)
                 return response
+            if len(descriptor_groups) == 1:
+                return response
             applied.append(meta)
             statuses.extend(response["statuses"])
 
-        return RateLimitResponse(overall_code="OK", statuses=statuses)
+        return RateLimitResponse(
+            overall_code="OK",
+            statuses=statuses,
+            reservation_windows=frozenset(),
+        )
 
     async def _refund_applied_descriptor_groups(
         self,
@@ -1585,12 +1877,14 @@ class _PROXY_MaxParallelRequestsHandler_v3(CustomLogger):
                         limit_remaining=max(0, limit - current_counter),
                         rate_limit_type=meta["rate_limit_type"],
                         descriptor_key=meta["descriptor_key"],
+                        descriptor_value=meta["descriptor_value"],
                     )
                 ],
             )
 
         statuses: Final[list[RateLimitStatus]] = []
-        for meta, new_counter in zip(per_counter_meta, raw[1:]):
+        for index, meta in enumerate(per_counter_meta):
+            new_counter = raw[1 + index * 2]
             statuses.append(
                 RateLimitStatus(
                     code="OK",
@@ -1598,9 +1892,21 @@ class _PROXY_MaxParallelRequestsHandler_v3(CustomLogger):
                     limit_remaining=max(0, meta["current_limit"] - int(new_counter)),
                     rate_limit_type=meta["rate_limit_type"],
                     descriptor_key=meta["descriptor_key"],
+                    descriptor_value=meta["descriptor_value"],
                 )
             )
-        return RateLimitResponse(overall_code="OK", statuses=statuses)
+        return RateLimitResponse(
+            overall_code="OK",
+            statuses=statuses,
+            reservation_windows=frozenset(
+                (
+                    meta["counter_key"],
+                    str(int(raw[2 + index * 2])),
+                    "redis",
+                )
+                for index, meta in enumerate(per_counter_meta)
+            ),
+        )
 
     async def _atomic_check_and_increment_in_memory(
         self,
@@ -1653,10 +1959,17 @@ class _PROXY_MaxParallelRequestsHandler_v3(CustomLogger):
                             limit_remaining=max(0, meta["current_limit"] - current_counter),
                             rate_limit_type=meta["rate_limit_type"],
                             descriptor_key=meta["descriptor_key"],
+                            descriptor_value=meta["descriptor_value"],
                         )
                     ],
                 )
-            descriptor_state.append({"window_expired": window_expired, "current": current_counter})
+            descriptor_state.append(
+                {  # mutable-ok: local atomic-counter state is updated during pass two
+                    "window_expired": window_expired,
+                    "current": current_counter,
+                    "window_start": str(now_int if window_expired else int(window_start)),
+                }
+            )
 
         # Pass 2: apply increments.
         statuses: Final[list[RateLimitStatus]] = []
@@ -1684,9 +1997,17 @@ class _PROXY_MaxParallelRequestsHandler_v3(CustomLogger):
                     limit_remaining=max(0, meta["current_limit"] - new_counter),
                     rate_limit_type=meta["rate_limit_type"],
                     descriptor_key=meta["descriptor_key"],
+                    descriptor_value=meta["descriptor_value"],
                 )
             )
-        return RateLimitResponse(overall_code="OK", statuses=statuses)
+        return RateLimitResponse(
+            overall_code="OK",
+            statuses=statuses,
+            reservation_windows=frozenset(
+                (meta["counter_key"], state["window_start"], "local")
+                for meta, state in zip(per_counter_meta, descriptor_state)
+            ),
+        )
 
     async def reserve_tpm_tokens(
         self,
@@ -1703,6 +2024,9 @@ class _PROXY_MaxParallelRequestsHandler_v3(CustomLogger):
         TPM-only descriptor/increment list and delegates the all-or-nothing
         atomicity (Lua on Redis, asyncio-locked DualCache otherwise) to the
         shared primitive.
+
+        Excludes project ITPM/OTPM descriptors -- those are reserved
+        separately (different estimate per bucket) via ``reserve_io_tokens``.
         """
         tpm_descriptors: Final[list[RateLimitDescriptor]] = [
             RateLimitDescriptor(
@@ -1714,7 +2038,8 @@ class _PROXY_MaxParallelRequestsHandler_v3(CustomLogger):
                 ),
             )
             for d in descriptors
-            if (d.get("rate_limit") or {}).get("tokens_per_unit") is not None
+            if d["key"] not in (PROJECT_ITPM_DESCRIPTOR_KEY, PROJECT_OTPM_DESCRIPTOR_KEY)
+            and (d.get("rate_limit") or {}).get("tokens_per_unit") is not None  # mutable-ok: optional descriptor
         ]
         if not tpm_descriptors:
             return RateLimitResponse(overall_code="OK", statuses=[])
@@ -1728,6 +2053,179 @@ class _PROXY_MaxParallelRequestsHandler_v3(CustomLogger):
             parent_otel_span=parent_otel_span,
         )
 
+    async def _refund_reserved_tokens(
+        self,
+        scopes: Sequence[tuple[str, str]],
+        amount: int,
+        reservation_windows: frozenset[tuple[str, str, Literal["redis", "local"]]] = frozenset(),
+        parent_otel_span: Span | None = None,
+    ) -> None:
+        """
+        Directly decrement previously-reserved token counters for ``scopes``
+        by ``amount``. Used to roll back a reservation that already
+        succeeded once a *different* bucket in the same request turns out to
+        be over its limit (e.g. ITPM reserved fine, OTPM then hits its
+        limit -- the ITPM reservation must not be left inflated).
+        """
+        if amount <= 0 or not scopes:
+            return
+        if not reservation_windows:
+            await self.async_increment_tokens_with_ttl_preservation(
+                pipeline_operations=self._build_reservation_aware_tpm_ops(
+                    targets=scopes,
+                    reserved_scopes=frozenset(scopes),
+                    actual_tokens=0,
+                    reserved_tokens=amount,
+                ),
+                parent_otel_span=parent_otel_span,
+            )
+            return
+        pipeline_operations: Final = self._build_project_reservation_ops(
+            targets=scopes,
+            reserved_scopes=frozenset(scopes),
+            actual_tokens=0,
+            reserved_tokens=amount,
+            reservation_window_identities=reservation_windows,
+        )
+        await self.async_increment_reservation_aware_tokens(
+            pipeline_operations=pipeline_operations,
+            parent_otel_span=parent_otel_span,
+        )
+
+    async def reserve_io_tokens(
+        self,
+        descriptors: Sequence[RateLimitDescriptor],
+        estimated_input_tokens: int,
+        estimated_output_tokens: int,
+        parent_otel_span: Span | None = None,
+    ) -> tuple[RateLimitResponse, int, int]:
+        """
+        Reserve ``estimated_input_tokens`` against project ITPM descriptors
+        and ``estimated_output_tokens`` against project OTPM descriptors.
+
+        ITPM and OTPM are reserved from different-sized estimates, so unlike
+        same-size TPM descriptors they can't share a single
+        ``atomic_check_and_increment_by_n`` call -- each bucket gets its own
+        all-or-nothing atomic call. If the OTPM reservation is over limit
+        after ITPM already succeeded, the ITPM reservation this call made is
+        rolled back before returning, so a partial reservation never leaks.
+
+        Returns ``(response, itpm_reserved, otpm_reserved)`` -- the latter two
+        are the amounts actually reserved (0 if that bucket wasn't
+        configured, or if the reservation failed), for the caller to stash
+        for post-call reconciliation.
+        """
+        itpm_descriptors: Final = [  # mutable-ok: atomic limiter API requires lists
+            d for d in descriptors if d["key"] == PROJECT_ITPM_DESCRIPTOR_KEY
+        ]
+        otpm_descriptors: Final = [  # mutable-ok: atomic limiter API requires lists
+            d for d in descriptors if d["key"] == PROJECT_OTPM_DESCRIPTOR_KEY
+        ]
+
+        if not itpm_descriptors and not otpm_descriptors:
+            return RateLimitResponse(overall_code="OK", statuses=[]), 0, 0  # mutable-ok: response contract uses a list
+
+        itpm_response: Final = (
+            await self.atomic_check_and_increment_by_n(
+                descriptors=itpm_descriptors,
+                increments=[  # mutable-ok: atomic limiter API requires mutable increment records
+                    {"tokens": estimated_input_tokens}  # mutable-ok: atomic limiter increment record
+                    for _ in itpm_descriptors
+                ],
+                parent_otel_span=parent_otel_span,
+            )
+            if itpm_descriptors
+            else None
+        )
+        if itpm_response is not None and itpm_response["overall_code"] == "OVER_LIMIT":
+            return itpm_response, 0, 0
+        itpm_reserved: Final = estimated_input_tokens if itpm_response is not None else 0
+
+        if otpm_descriptors:
+            otpm_response: Final = await self.atomic_check_and_increment_by_n(
+                descriptors=otpm_descriptors,
+                increments=[  # mutable-ok: atomic limiter API requires mutable increment records
+                    {"tokens": estimated_output_tokens}  # mutable-ok: atomic limiter increment record
+                    for _ in otpm_descriptors
+                ],
+                parent_otel_span=parent_otel_span,
+            )
+            if otpm_response["overall_code"] == "OVER_LIMIT":
+                if itpm_reserved > 0:
+                    await self._refund_reserved_tokens(
+                        scopes=[  # mutable-ok: reservation rollback accepts collected scopes
+                            (d["key"], d["value"]) for d in itpm_descriptors
+                        ],
+                        amount=itpm_reserved,
+                        reservation_windows=itpm_response.get("reservation_windows", frozenset()),
+                        parent_otel_span=parent_otel_span,
+                    )
+                return otpm_response, 0, 0
+            statuses: Final = (
+                [  # mutable-ok: response contract uses a list
+                    *itpm_response["statuses"],
+                    *otpm_response["statuses"],
+                ]
+                if itpm_response is not None
+                else otpm_response["statuses"]
+            )
+            return (
+                RateLimitResponse(
+                    overall_code="OK",
+                    statuses=statuses,
+                    reservation_windows=(
+                        (
+                            itpm_response.get("reservation_windows", frozenset())
+                            if itpm_response is not None
+                            else frozenset()
+                        )
+                        | otpm_response.get("reservation_windows", frozenset())
+                    ),
+                ),
+                itpm_reserved,
+                estimated_output_tokens,
+            )
+
+        assert itpm_response is not None
+        return itpm_response, itpm_reserved, 0
+
+    async def enforce_project_io_token_quota_for_frame(
+        self,
+        user_api_key_dict: UserAPIKeyAuth | None,
+        requested_model: str | None,
+        estimated_input_tokens: int,
+        estimated_output_tokens: int,
+    ) -> None:
+        """Reserve one WebSocket ``response.create`` frame's tokens against
+        the caller's project ITPM/OTPM quota.
+
+        The Responses WebSocket connection-level pre-call hook only runs once
+        per connection, but a connection accepts many ``response.create``
+        frames over its lifetime. Without this, a project caller could send
+        unlimited high-token generations after a single minimal reservation.
+        There is no per-frame post-call hook to reconcile against, so --
+        like the batch rate limiter -- this charges the estimate immediately
+        and never refunds it.
+        """
+        if user_api_key_dict is None:
+            return
+        descriptors: Final[list[RateLimitDescriptor]] = []  # mutable-ok: descriptor helper appends in place
+        self.add_project_io_token_rate_limit_descriptors_from_metadata(
+            user_api_key_dict=user_api_key_dict,
+            requested_model=requested_model,
+            descriptors=descriptors,
+        )
+        if not descriptors:
+            return
+        response, _itpm_reserved, _otpm_reserved = await self.reserve_io_tokens(
+            descriptors=descriptors,
+            estimated_input_tokens=estimated_input_tokens,
+            estimated_output_tokens=estimated_output_tokens,
+            parent_otel_span=user_api_key_dict.parent_otel_span,
+        )
+        if response["overall_code"] == "OVER_LIMIT":
+            self._handle_rate_limit_error(response, descriptors, requested_model)
+
     def create_organization_rate_limit_descriptor(
         self, user_api_key_dict: UserAPIKeyAuth, requested_model: str | None = None
     ) -> list[RateLimitDescriptor]:
@@ -2434,6 +2932,62 @@ class _PROXY_MaxParallelRequestsHandler_v3(CustomLogger):
                     )
                 )
 
+    def add_project_io_token_rate_limit_descriptors_from_metadata(
+        self,
+        user_api_key_dict: UserAPIKeyAuth,
+        requested_model: str | None,
+        descriptors: _RateLimitDescriptorSink,
+    ) -> None:
+        """Add project-scoped ITPM/OTPM descriptors from project_metadata.
+
+        Enforced independently of, and alongside, the combined ``model_per_project``
+        TPM descriptor above -- these give Bedrock Mantle-style separate input/output
+        token quotas at the project level.
+        """
+        if requested_model is None or user_api_key_dict.project_id is None:
+            return
+
+        itpm_limit_for_project_model: Final = (
+            get_model_rate_limit_from_metadata(user_api_key_dict, "project_metadata", "model_itpm_limit")
+            or {}  # mutable-ok: metadata helper returns an optional mapping
+        )
+        otpm_limit_for_project_model: Final = (
+            get_model_rate_limit_from_metadata(user_api_key_dict, "project_metadata", "model_otpm_limit")
+            or {}  # mutable-ok: metadata helper returns an optional mapping
+        )
+
+        model_itpm_limit: Final = itpm_limit_for_project_model.get(requested_model)
+        model_otpm_limit: Final = otpm_limit_for_project_model.get(requested_model)
+
+        if model_itpm_limit is None and model_otpm_limit is None:
+            return
+
+        descriptor_value: Final = f"{user_api_key_dict.project_id}:{requested_model}"
+        if model_itpm_limit is not None:
+            descriptors.append(
+                RateLimitDescriptor(
+                    key=PROJECT_ITPM_DESCRIPTOR_KEY,
+                    value=descriptor_value,
+                    rate_limit={  # mutable-ok: descriptor TypedDict requires a runtime dict
+                        "requests_per_unit": None,
+                        "tokens_per_unit": model_itpm_limit,
+                        "window_size": self.window_size,
+                    },
+                )
+            )
+        if model_otpm_limit is not None:
+            descriptors.append(
+                RateLimitDescriptor(
+                    key=PROJECT_OTPM_DESCRIPTOR_KEY,
+                    value=descriptor_value,
+                    rate_limit={  # mutable-ok: descriptor TypedDict requires a runtime dict
+                        "requests_per_unit": None,
+                        "tokens_per_unit": model_otpm_limit,
+                        "window_size": self.window_size,
+                    },
+                )
+            )
+
     def _handle_rate_limit_error(
         self,
         response: RateLimitResponse,
@@ -2478,6 +3032,342 @@ class _PROXY_MaxParallelRequestsHandler_v3(CustomLogger):
                     llm_provider=llm_provider,
                 )
 
+    @staticmethod
+    def _estimate_audio_block_tokens(block: object) -> int:
+        """
+        Token estimate for one ``input_audio`` content block.
+
+        When the block carries a base64 ``data`` payload, the estimate comes
+        from the decoded byte count (``len(b64) * 3 // 4 // _AUDIO_BYTES_PER_TOKEN``),
+        assuming the lowest reasonable audio bitrate so we never under-reserve
+        for higher-quality recordings of the same duration.
+
+        When no payload is present (reference-only block or missing ``data``),
+        falls back to ``DEFAULT_AUDIO_TOKEN_ESTIMATE``.
+        """
+        if not isinstance(block, dict):
+            return DEFAULT_AUDIO_TOKEN_ESTIMATE
+        input_audio: Final = block.get("input_audio")
+        b64_data: Final = input_audio.get("data") if isinstance(input_audio, dict) else None
+        if b64_data and isinstance(b64_data, str):
+            decoded_bytes: Final = len(b64_data) * 3 // 4
+            return max(decoded_bytes // _AUDIO_BYTES_PER_TOKEN, DEFAULT_AUDIO_TOKEN_ESTIMATE)
+        return DEFAULT_AUDIO_TOKEN_ESTIMATE
+
+    @classmethod
+    def _estimate_audio_content_tokens(cls, messages: object) -> int:
+        """
+        Sum of per-block audio token estimates across all ``messages``.
+        Returns 0 when there are no ``input_audio`` blocks, which the caller
+        uses to skip the (relatively expensive) strip pass.
+        """
+        if not isinstance(messages, list):
+            return 0
+        return sum(
+            cls._estimate_audio_block_tokens(block)
+            for message in messages
+            if isinstance(message, dict)
+            for content in (message.get("content"),)
+            if isinstance(content, list)
+            for block in content
+            if isinstance(block, dict) and block.get("type") == "input_audio"
+        )
+
+    @staticmethod
+    def _strip_audio_content_blocks(messages: object) -> object:
+        """
+        Drop ``input_audio`` content blocks before passing ``messages`` to
+        ``token_counter``, which raises ``ValueError`` on them (no per-type
+        handling, unlike images). The audio contribution is added back
+        separately via ``DEFAULT_AUDIO_TOKEN_ESTIMATE`` so the rest of the
+        message (text/images/tools) still gets counted accurately instead of
+        the whole call falling back to the cheap char-count estimate.
+        """
+        if not isinstance(messages, list):
+            return messages
+        sanitized: Final[list[object]] = []  # mutable-ok: token_counter requires a list of message dicts
+        for message in messages:
+            if not isinstance(message, dict):
+                sanitized.append(message)
+                continue
+            content = message.get("content")
+            if not isinstance(content, list):
+                sanitized.append(message)
+                continue
+            filtered_content = [  # mutable-ok: token_counter requires list content blocks
+                block for block in content if not (isinstance(block, dict) and block.get("type") == "input_audio")
+            ]
+            sanitized.append(  # mutable-ok: token_counter requires mutable message dicts
+                {**message, "content": filtered_content}  # mutable-ok: token_counter requires message dicts
+            )
+        return sanitized
+
+    @staticmethod
+    def _responses_input_to_chat_messages(data: object) -> Sequence[object]:
+        """
+        Convert a Responses API ``input`` (string or list of input items) into
+        chat-completion-style messages via the standard LiteLLM transformation
+        (the same one guardrails use, e.g. ``purview_dlp.py``), so multimodal
+        ``input_image``/``input_text`` content blocks get counted by
+        ``token_counter``'s ``messages`` path instead of silently contributing
+        zero tokens via its ``text`` path, which only joins plain strings.
+        """
+        from litellm.responses.litellm_completion_transformation.transformation import (
+            LiteLLMCompletionResponsesConfig,
+        )
+
+        if not isinstance(data, dict):
+            return ()
+        return LiteLLMCompletionResponsesConfig.transform_responses_api_input_to_messages(
+            input=data.get("input") or "",
+            responses_api_request=data,
+        )
+
+    @staticmethod
+    def _count_pretokenized_embedding_input(value: object) -> int | None:
+        if not isinstance(value, list):
+            return None
+        if all(isinstance(token, int) for token in value):
+            return len(value)
+        if all(
+            isinstance(token_ids, list) and all(isinstance(token, int) for token in token_ids) for token_ids in value
+        ):
+            return sum(len(token_ids) for token_ids in value)
+        return None
+
+    @staticmethod
+    def _rerank_input_to_text(data: Mapping[str, object]) -> str:
+        documents: Final = data.get("documents")
+        document_items: Final[Sequence[object]] = documents if isinstance(documents, list) else ()  # pyright: ignore[reportUnknownVariableType]  # rerank documents are validated runtime JSON
+        input_parts: Final[tuple[object, ...]] = (  # pyright: ignore[reportUnknownVariableType]  # list narrowing preserves unknown JSON element types
+            data.get("query"),
+            *document_items,
+        )
+        return "\n".join(
+            str(part)  # pyright: ignore[reportUnknownArgumentType]  # accepted document dicts have provider-defined fields
+            for part in input_parts  # pyright: ignore[reportUnknownVariableType]  # runtime JSON list elements remain unknown after list narrowing
+            if isinstance(part, (str, dict))
+        )
+
+    def _estimate_precise_input_tokens(self, data: object, model: str | None, call_type: str | None = None) -> int:
+        """
+        Model-aware input token estimate for the project ITPM reservation,
+        using ``litellm.token_counter`` -- the same approach the
+        deployment-level itpm/otpm check uses in
+        ``io_token_rate_limit_check.py``. Unlike the cheap char-count
+        estimate the combined-TPM path uses, this accounts for image/tool
+        content and derives per-``input_audio``-block estimates from the
+        base64 payload size (assuming the lowest reasonable bitrate so
+        longer recordings always reserve proportionally more), so a burst
+        of multimodal, tool-heavy, or audio-heavy requests can't each
+        reserve only the one-token floor and blow past ITPM before
+        post-call reconciliation catches up.
+
+        For the Responses API, ``input`` is converted to chat messages first
+        (via ``_responses_input_to_chat_messages``) so its own multimodal
+        content blocks are counted the same way; ``token_counter``'s ``text``
+        argument can only see plain strings in a list, not content blocks.
+
+        Falls back to the cheap char-count estimate if ``token_counter``
+        can't resolve a tokenizer for this model (e.g. an unrecognized
+        custom model name) or otherwise raises -- the audio add-on still
+        applies on top of the fallback.
+        """
+        from litellm import token_counter
+
+        if not isinstance(data, dict):
+            return 0
+        is_responses_request: Final = call_type in RESPONSES_API_CALL_TYPES
+        translated_request: Final = (
+            None if is_responses_request else self._translate_google_genai_native_request(data, call_type)
+        )
+        is_embedding_request: Final = self._is_embedding_request(data, call_type)
+        embedding_text: Final = data.get("input") if is_embedding_request else None
+        pretokenized_input_tokens: Final = (
+            self._count_pretokenized_embedding_input(embedding_text) if is_embedding_request else None
+        )
+        if pretokenized_input_tokens is not None:
+            return pretokenized_input_tokens
+
+        prompt: Final = data.get("prompt")
+        fallback_text: Final = prompt if prompt is not None else data.get("input")
+        selected_inputs: Final[tuple[object | None, object | None, object | None, object | None]] = (
+            (self._responses_input_to_chat_messages(data), None, data.get("tools"), data.get("tool_choice"))
+            if is_responses_request
+            else (
+                translated_request.get("messages"),
+                None,
+                translated_request.get("tools"),
+                translated_request.get("tool_choice"),
+            )
+            if translated_request is not None
+            else (None, embedding_text, data.get("tools"), data.get("tool_choice"))
+            if is_embedding_request
+            else (None, self._rerank_input_to_text(data), data.get("tools"), data.get("tool_choice"))
+            if call_type in RERANK_API_CALL_TYPES
+            else (None, prompt, data.get("tools"), data.get("tool_choice"))
+            if call_type in TEXT_COMPLETION_API_CALL_TYPES
+            else (data.get("messages"), fallback_text, data.get("tools"), data.get("tool_choice"))
+        )
+        messages, selected_text, countable_tools, countable_tool_choice = selected_inputs
+
+        audio_token_estimate: Final = self._estimate_audio_content_tokens(messages)
+        countable_messages: Final = self._strip_audio_content_blocks(messages) if audio_token_estimate > 0 else messages
+
+        try:
+            estimate: Final = max(
+                0,
+                int(
+                    token_counter(
+                        model=model or "",
+                        messages=countable_messages,
+                        text=selected_text,
+                        tools=countable_tools,
+                        tool_choice=countable_tool_choice,
+                        use_default_image_token_count=True,
+                    )
+                ),
+            )
+            return estimate + audio_token_estimate
+        except Exception:  # noqa: BLE001  # tokenizer failures degrade to the cheap estimate
+            if call_type in RERANK_API_CALL_TYPES and isinstance(selected_text, str):
+                return max(0, len(selected_text) // DEFAULT_CHARS_PER_TOKEN)
+            estimated_input_tokens, _ = self._estimate_input_and_output_tokens(data=data, call_type=call_type)
+            return estimated_input_tokens + audio_token_estimate
+
+    async def _reserve_project_io_tokens_or_raise(
+        self,
+        descriptors: Sequence[RateLimitDescriptor],
+        data: object,
+        requested_model: str | None,
+        user_api_key_dict: UserAPIKeyAuth,
+        tpm_reservation_scopes: Sequence[tuple[str, str]],
+        tpm_reservation_amount: int,
+        call_type: str | None = None,
+    ) -> None:
+        """
+        Reserve project-scoped ITPM/OTPM tokens (Bedrock Mantle-style
+        separate input/output token buckets), independently of -- and, when
+        both are configured, in addition to -- the combined-TPM reservation
+        the caller already made. Raises (via ``_handle_rate_limit_error``) on
+        an over-limit reservation, first rolling back the combined-TPM
+        reservation named by ``tpm_reservation_scopes``/``tpm_reservation_amount``
+        if one was made, so a partial reservation never leaks.
+        """
+        if not isinstance(data, dict):
+            return
+        stash: Final = claim_request_stash_for_data(data)
+        io_token_descriptors: Final = [  # mutable-ok: reservation API requires descriptor lists
+            d for d in descriptors if d["key"] in (PROJECT_ITPM_DESCRIPTOR_KEY, PROJECT_OTPM_DESCRIPTOR_KEY)
+        ]
+        if not io_token_descriptors:
+            return
+
+        configured_otpm_limits: Final = [  # mutable-ok: min calculation materializes validated limits
+            int(v)
+            for d in io_token_descriptors
+            if d["key"] == PROJECT_OTPM_DESCRIPTOR_KEY
+            for v in [  # mutable-ok: comprehension binds the optional descriptor value
+                (d.get("rate_limit") or {}).get(  # mutable-ok: optional descriptor fallback
+                    "tokens_per_unit"
+                )
+            ]
+            if v is not None
+        ]
+        min_configured_otpm_limit: Final = min(configured_otpm_limits) if configured_otpm_limits else None
+        _, raw_estimated_output_tokens = self._estimate_input_and_output_tokens(
+            data=data,
+            min_configured_tpm_limit=min_configured_otpm_limit,
+            call_type=call_type,
+        )
+        raw_estimated_input_tokens: Final = self._estimate_precise_input_tokens(
+            data=data, model=requested_model, call_type=call_type
+        )
+        estimated_input_tokens: Final = max(raw_estimated_input_tokens, 1)
+        estimated_output_tokens: Final = (
+            raw_estimated_output_tokens
+            if self._has_explicit_output_cap(data, call_type)
+            else max(raw_estimated_output_tokens, 1)
+        )
+
+        # Hard-cap generation length so an unbounded response can't overshoot
+        # the OTPM budget before post-call reconciliation runs, mirroring the
+        # combined-TPM floor cap in the caller.
+        self._apply_implicit_output_cap(
+            data=data,
+            min_configured_limit=min_configured_otpm_limit,
+            call_type=call_type,
+        )
+
+        io_response, itpm_reserved, otpm_reserved = await self.reserve_io_tokens(
+            descriptors=io_token_descriptors,
+            estimated_input_tokens=estimated_input_tokens,
+            estimated_output_tokens=estimated_output_tokens,
+            parent_otel_span=user_api_key_dict.parent_otel_span,
+        )
+
+        if io_response["overall_code"] == "OVER_LIMIT":
+            # A combined-TPM reservation may have already succeeded above for
+            # this same request; refund it too, or its counter stays inflated
+            # until the window's TTL expires. Mark it released so the
+            # ProxyRateLimitError we're about to raise doesn't get refunded
+            # a second time when async_post_call_failure_hook sees the same
+            # (still-stashed) reservation and refunds it again.
+            if tpm_reservation_amount > 0:
+                await self._refund_reserved_tokens(
+                    scopes=tpm_reservation_scopes,
+                    amount=tpm_reservation_amount,
+                    parent_otel_span=user_api_key_dict.parent_otel_span,
+                )
+                stash.reservation_released = True
+            acquisition: Final = stash.parallel_slot
+            if acquisition is not None:
+                await self._release_parallel_request_slots(
+                    acquisition=acquisition,
+                    parent_otel_span=user_api_key_dict.parent_otel_span,
+                )
+                stash.parallel_slot = None
+            self._handle_rate_limit_error(
+                response=io_response,
+                descriptors=descriptors,
+                requested_model=requested_model,
+            )
+
+        if itpm_reserved > 0:
+            itpm_scopes: Final = tuple(
+                (d["key"], d["value"]) for d in io_token_descriptors if d["key"] == PROJECT_ITPM_DESCRIPTOR_KEY
+            )
+            stash.itpm_reserved_tokens = itpm_reserved
+            stash.itpm_reserved_scopes = frozenset(itpm_scopes)
+            stash.itpm_reserved_window_identities = frozenset(
+                (counter_key, window_start, backend)
+                for counter_key, window_start, backend in io_response.get("reservation_windows", frozenset())
+                if "model_per_project_itpm" in counter_key
+            )
+        if otpm_reserved > 0:
+            otpm_scopes: Final = tuple(
+                (d["key"], d["value"]) for d in io_token_descriptors if d["key"] == PROJECT_OTPM_DESCRIPTOR_KEY
+            )
+            stash.otpm_reserved_tokens = otpm_reserved
+            stash.otpm_reserved_scopes = frozenset(otpm_scopes)
+            stash.otpm_reserved_window_identities = frozenset(
+                (counter_key, window_start, backend)
+                for counter_key, window_start, backend in io_response.get("reservation_windows", frozenset())
+                if "model_per_project_otpm" in counter_key
+            )
+
+        if stash.rate_limit_response is not None:
+            stash.rate_limit_response["statuses"].extend(io_response["statuses"])
+        elif io_response["statuses"]:
+            stash.rate_limit_response = io_response
+
+        verbose_proxy_logger.debug(
+            "ITPM/OTPM tokens reserved: itpm=%s, otpm=%s for model %s",
+            itpm_reserved,
+            otpm_reserved,
+            requested_model,
+        )
+
     async def async_pre_call_hook(
         self,
         user_api_key_dict: UserAPIKeyAuth,
@@ -2550,6 +3440,11 @@ class _PROXY_MaxParallelRequestsHandler_v3(CustomLogger):
             requested_model=requested_model,
             descriptors=descriptors,
         )
+        self.add_project_io_token_rate_limit_descriptors_from_metadata(
+            user_api_key_dict=user_api_key_dict,
+            requested_model=requested_model,
+            descriptors=descriptors,
+        )
 
         # Org Level Rate Limits
         descriptors.extend(self.create_organization_rate_limit_descriptor(user_api_key_dict, requested_model))
@@ -2565,7 +3460,11 @@ class _PROXY_MaxParallelRequestsHandler_v3(CustomLogger):
             # in-flight request would pre-inflate the :tokens counter by 1,
             # shrinking the effective TPM budget by N and causing
             # false-positive 429s under bursts. When reservation is disabled,
-            # this pass enforces TPM directly from the post-call counters.
+            # this pass enforces TPM directly from the post-call counters --
+            # except for project ITPM/OTPM descriptors, which are excluded
+            # then because _reserve_project_io_tokens_or_raise below charges
+            # them unconditionally and counting them here too would
+            # double-charge every request.
             parallel_counter_keys: Final = [
                 self.create_rate_limit_keys(d["key"], d["value"], "max_parallel_requests")
                 for d in descriptors
@@ -2573,8 +3472,15 @@ class _PROXY_MaxParallelRequestsHandler_v3(CustomLogger):
             ]
             parallel_slot_id: Final = uuid.uuid4().hex if parallel_counter_keys else None
 
+            first_pass_descriptors: Final = (
+                descriptors
+                if self.tpm_reservation_enabled
+                else tuple(
+                    d for d in descriptors if d["key"] not in (PROJECT_ITPM_DESCRIPTOR_KEY, PROJECT_OTPM_DESCRIPTOR_KEY)
+                )
+            )
             response: Final = await self.should_rate_limit(
-                descriptors=descriptors,
+                descriptors=first_pass_descriptors,
                 parent_otel_span=user_api_key_dict.parent_otel_span,
                 skip_tpm_check=self.tpm_reservation_enabled,
                 parallel_slot_id=parallel_slot_id,
@@ -2606,32 +3512,39 @@ class _PROXY_MaxParallelRequestsHandler_v3(CustomLogger):
             configured_tpm_limits: Final = [
                 int(v)
                 for d in descriptors
+                if d["key"] not in (PROJECT_ITPM_DESCRIPTOR_KEY, PROJECT_OTPM_DESCRIPTOR_KEY)
                 for v in [(d.get("rate_limit") or {}).get("tokens_per_unit")]
                 if v is not None
             ]
             has_tpm_limits: Final = bool(configured_tpm_limits)
 
+            # Populated on a successful combined-TPM reservation below, so the
+            # project ITPM/OTPM block further down can roll it back if a
+            # different bucket in the same request subsequently hits its
+            # limit. Stays empty/0 whenever no combined-TPM reservation was
+            # made (or it was over limit, in which case execution never
+            # reaches the ITPM/OTPM block -- `_handle_rate_limit_error` raises).
+            tpm_reservation_scopes: Sequence[tuple[str, str]] = ()  # rebind-ok: set after successful reservation
+            tpm_reservation_amount = 0  # rebind-ok: set after successful reservation
+
             if has_tpm_limits and self.tpm_reservation_enabled:
                 min_configured_tpm_limit: Final = min(configured_tpm_limits)
 
-                # When the configured TPM cap is small enough to constrain the
-                # no-max_tokens floor, also hard-cap the model output via
-                # data["max_tokens"] so concurrent unbounded generations can't
-                # spend past the limit before post-call reconciliation runs.
-                # Skip when the request already sets max_tokens or has no
-                # generation budget at all (embeddings).
-                capped_floor: Final = self._no_max_tokens_output_floor(min_configured_tpm_limit)
-                baseline_floor: Final = DEFAULT_MAX_TOKENS_ESTIMATE // _TPM_FLOOR_FRACTION
-                has_explicit_max_tokens: Final = (
-                    data.get("max_tokens") is not None or data.get("max_completion_tokens") is not None
-                )
-                is_embedding: Final = data.get("input") is not None
                 configured_output_tokens: Final = get_estimated_output_tokens(
                     user_api_key_dict=user_api_key_dict,
                     model_name=requested_model,
                 )
-                if capped_floor < baseline_floor and not has_explicit_max_tokens and not is_embedding:
-                    data["max_tokens"] = max(capped_floor, configured_output_tokens or 0)
+
+                # When the configured TPM cap is small enough to constrain the
+                # no-max_tokens floor, also hard-cap the model output so
+                # concurrent unbounded generations can't spend past the limit
+                # before post-call reconciliation runs.
+                self._apply_implicit_output_cap(
+                    data=data,
+                    min_configured_limit=min_configured_tpm_limit,
+                    call_type=call_type,
+                    configured_output_tokens=configured_output_tokens,
+                )
 
                 # Floor at 1 token so contentless requests (/responses,
                 # tool-call continuations, empty messages) still flow
@@ -2645,6 +3558,7 @@ class _PROXY_MaxParallelRequestsHandler_v3(CustomLogger):
                         data=data,
                         model=requested_model,
                         min_configured_tpm_limit=min_configured_tpm_limit,
+                        call_type=call_type,
                         configured_output_tokens=configured_output_tokens,
                     ),
                     1,
@@ -2691,8 +3605,16 @@ class _PROXY_MaxParallelRequestsHandler_v3(CustomLogger):
                     stash.reserved_scopes = frozenset(
                         (d["key"], d["value"])
                         for d in descriptors
-                        if (d.get("rate_limit") or {}).get("tokens_per_unit") is not None
+                        if d["key"] not in (PROJECT_ITPM_DESCRIPTOR_KEY, PROJECT_OTPM_DESCRIPTOR_KEY)
+                        and (d.get("rate_limit") or {}).get(  # mutable-ok: optional descriptor fallback
+                            "tokens_per_unit"
+                        )
+                        is not None
                     )
+                    tpm_reservation_scopes = tuple(  # rebind-ok: record successful reservation scopes
+                        stash.reserved_scopes
+                    )
+                    tpm_reservation_amount = estimated_tokens  # rebind-ok: record successful reservation amount
 
                     # Merge TPM statuses into the stored rate-limit response
                     # so x-ratelimit-{key}-remaining-tokens / -limit-tokens
@@ -2706,6 +3628,15 @@ class _PROXY_MaxParallelRequestsHandler_v3(CustomLogger):
                     verbose_proxy_logger.debug(
                         "TPM tokens reserved: %s for model %s", estimated_tokens, requested_model
                     )
+            await self._reserve_project_io_tokens_or_raise(
+                descriptors=descriptors,
+                data=data,
+                requested_model=requested_model,
+                user_api_key_dict=user_api_key_dict,
+                tpm_reservation_scopes=tpm_reservation_scopes,
+                tpm_reservation_amount=tpm_reservation_amount,
+                call_type=call_type,
+            )
 
     def _create_pipeline_operations(
         self,
@@ -2782,7 +3713,7 @@ class _PROXY_MaxParallelRequestsHandler_v3(CustomLogger):
         return total_tokens
 
     @staticmethod
-    def _aggregate_only_total_tokens(usage: Usage | dict | None) -> int:
+    def _aggregate_only_total_tokens(usage: Usage | ResponseAPIUsage | Mapping[str, object] | None) -> int:
         """Total for usage that carries no input/output split, else 0.
 
         A source that can only report one number for the whole request (a
@@ -2792,24 +3723,43 @@ class _PROXY_MaxParallelRequestsHandler_v3(CustomLogger):
         uncharged, which is how pass-through traffic slips past a TPM limit
         it is supposed to share.
         """
-        if isinstance(usage, Usage):
-            prompt_tokens, completion_tokens, total_tokens = (
-                usage.prompt_tokens or 0,
-                usage.completion_tokens or 0,
-                usage.total_tokens or 0,
-            )
-        elif isinstance(usage, dict):
-            prompt_tokens, completion_tokens, total_tokens = (
-                usage.get("prompt_tokens") or 0,
-                usage.get("completion_tokens") or 0,
+        if usage is None:
+            return 0
+        token_counts: Final = (
+            (usage.prompt_tokens or 0, usage.completion_tokens or 0, usage.total_tokens or 0)
+            if isinstance(usage, Usage)
+            else (usage.input_tokens or 0, usage.output_tokens or 0, usage.total_tokens or 0)
+            if isinstance(usage, ResponseAPIUsage)
+            else (
+                usage.get("prompt_tokens") or usage.get("input_tokens") or 0,
+                usage.get("completion_tokens") or usage.get("output_tokens") or 0,
                 usage.get("total_tokens") or 0,
             )
-        else:
-            return 0
-        if prompt_tokens or completion_tokens:
+        )
+        prompt_tokens, completion_tokens, total_tokens = token_counts
+        if prompt_tokens or completion_tokens or not isinstance(total_tokens, int):
             return 0
         return total_tokens
 
+    @staticmethod
+    def _response_usage(
+        response_obj: object,
+    ) -> Usage | ResponseAPIUsage | Mapping[str, object] | None:
+        if isinstance(response_obj, (Usage, ResponseAPIUsage)):
+            return response_obj
+        if isinstance(
+            response_obj,
+            (ModelResponse, EmbeddingResponse, TextCompletionResponse, BaseLiteLLMOpenAIResponseObject),
+        ):
+            usage: Final = getattr(response_obj, "usage", None)
+            return usage if isinstance(usage, (Usage, ResponseAPIUsage, dict)) else None
+        if isinstance(response_obj, dict):
+            nested_usage: Final = response_obj.get("usage")
+            if isinstance(nested_usage, (Usage, ResponseAPIUsage, dict)):
+                return nested_usage
+            return response_obj
+        return None
+
     async def _execute_token_increment_script(
         self,
         pipeline_operations: list["RedisPipelineIncrementOperation"],
@@ -2885,6 +3835,116 @@ class _PROXY_MaxParallelRequestsHandler_v3(CustomLogger):
                 litellm_parent_otel_span=parent_otel_span,
             )
 
+    async def _apply_local_window_guarded_token_increments(
+        self,
+        operations: Sequence[ReservationAwareIncrementOperation],
+        parent_otel_span: Span | None = None,
+    ) -> None:
+        async with self._check_and_increment_lock:
+            for operation in operations:
+                window_key = operation.get("window_key")
+                expected_window_start = operation.get("expected_window_start")
+                if window_key is None or expected_window_start is None:
+                    continue
+                active_window_start = await self.internal_usage_cache.async_get_cache(
+                    key=window_key,
+                    litellm_parent_otel_span=parent_otel_span,
+                    local_only=True,
+                )
+                if active_window_start is None or str(active_window_start) != expected_window_start:
+                    continue
+                current_counter = (
+                    await self.internal_usage_cache.async_get_cache(
+                        key=operation["key"],
+                        litellm_parent_otel_span=parent_otel_span,
+                        local_only=True,
+                    )
+                    or 0
+                )
+                await self.internal_usage_cache.async_set_cache(
+                    key=operation["key"],
+                    value=float(current_counter) + operation["increment_value"],
+                    ttl=operation["ttl"],
+                    litellm_parent_otel_span=parent_otel_span,
+                    local_only=True,
+                )
+
+    async def _apply_redis_window_guarded_token_increments(
+        self,
+        operations: Sequence[ReservationAwareIncrementOperation],
+        parent_otel_span: Span | None = None,
+    ) -> None:
+        for operation in operations:
+            window_key = operation.get("window_key")
+            expected_window_start = operation.get("expected_window_start")
+            if window_key is None or expected_window_start is None:
+                continue
+            if self.window_guarded_token_increment_script is not None:
+                try:
+                    await self.window_guarded_token_increment_script(
+                        keys=[  # mutable-ok: Redis script interface requires a key list
+                            window_key,
+                            operation["key"],
+                        ],
+                        args=[  # mutable-ok: Redis script interface requires an argument list
+                            expected_window_start,
+                            operation["increment_value"],
+                            operation["ttl"] or 0,
+                        ],
+                    )
+                    continue
+                except Exception as e:  # noqa: BLE001  # Redis failures use the plain increment fallback
+                    verbose_proxy_logger.warning(
+                        "Window-guarded token adjustment failed for %s: %s",
+                        operation["key"],
+                        e,
+                    )
+            if operation["increment_value"] > 0:
+                await self.internal_usage_cache.async_increment_cache(
+                    key=operation["key"],
+                    value=operation["increment_value"],
+                    litellm_parent_otel_span=parent_otel_span,
+                    ttl=operation["ttl"],
+                )
+
+    async def async_increment_reservation_aware_tokens(
+        self,
+        pipeline_operations: Sequence[ReservationAwareIncrementOperation],
+        parent_otel_span: Span | None = None,
+    ) -> None:
+        for operation in pipeline_operations:
+            if operation.get("window_key") is None or operation.get("expected_window_start") is None:
+                await self.internal_usage_cache.async_increment_cache(
+                    key=operation["key"],
+                    value=operation["increment_value"],
+                    litellm_parent_otel_span=parent_otel_span,
+                    ttl=operation["ttl"],
+                )
+        local_guarded_operations: Final = tuple(
+            operation
+            for operation in pipeline_operations
+            if operation.get("window_key") is not None
+            and operation.get("expected_window_start") is not None
+            and operation.get("reservation_backend") == "local"
+        )
+        redis_guarded_operations: Final = tuple(
+            operation
+            for operation in pipeline_operations
+            if operation.get("window_key") is not None
+            and operation.get("expected_window_start") is not None
+            and operation.get("reservation_backend") != "local"
+        )
+        if local_guarded_operations:
+            await self._apply_local_window_guarded_token_increments(
+                operations=local_guarded_operations,
+                parent_otel_span=parent_otel_span,
+            )
+        if redis_guarded_operations:
+            await self._apply_redis_window_guarded_token_increments(
+                operations=redis_guarded_operations,
+                parent_otel_span=parent_otel_span,
+            )
+
     def get_rate_limit_type(self) -> Literal["output", "input", "total"]:
         from litellm.proxy.proxy_server import general_settings
 
@@ -2914,6 +3974,164 @@ class _PROXY_MaxParallelRequestsHandler_v3(CustomLogger):
             merged[f"{prefix}-limit-{status['rate_limit_type']}"] = status["current_limit"]
         return merged
 
+    @staticmethod
+    def _resolve_rerank_token_usage(response_obj: object) -> tuple[int, int, bool] | None:
+        if not isinstance(response_obj, RerankResponse) or response_obj.meta is None:
+            return None
+
+        rerank_tokens: Final = response_obj.meta.get("tokens")  # pyright: ignore[reportUnknownMemberType]  # TypedDict's optional generic metadata widens get overloads
+        if rerank_tokens is not None:
+            input_tokens: Final = rerank_tokens.get("input_tokens") or 0  # pyright: ignore[reportUnknownMemberType]  # token fields are typed integers despite the generic get overload
+            output_tokens: Final = rerank_tokens.get("output_tokens") or 0  # pyright: ignore[reportUnknownMemberType]  # token fields are typed integers despite the generic get overload
+            if input_tokens or output_tokens:
+                return max(0, input_tokens), max(0, output_tokens), True
+
+        billed_units: Final = response_obj.meta.get("billed_units")  # pyright: ignore[reportUnknownMemberType]  # TypedDict's optional generic metadata widens get overloads
+        if billed_units is not None:
+            total_tokens: Final = billed_units.get("total_tokens") or 0  # pyright: ignore[reportUnknownMemberType]  # billed total is a typed integer despite the generic get overload
+            if total_tokens:
+                return max(0, total_tokens), 0, True
+        return None
+
+    def _resolve_io_token_reconcile_usage(
+        self,
+        response_obj: object,
+    ) -> tuple[int, int, bool]:
+        """
+        Resolve ``(billable_input_tokens, completion_tokens, usage_resolved)``
+        for ITPM/OTPM reconciliation. Cache-read tokens are excluded from
+        billable input -- Bedrock Mantle doesn't count them toward ITPM --
+        but they're untouched everywhere else (cost/usage logging still sees
+        the full prompt token count).
+        """
+        rerank_usage: Final = self._resolve_rerank_token_usage(response_obj)
+        if rerank_usage is not None:
+            return rerank_usage
+
+        usage: Final = self._response_usage(response_obj)
+
+        if isinstance(usage, Usage):
+            prompt_tokens: Final = usage.prompt_tokens or 0
+            completion_tokens: Final = usage.completion_tokens or 0
+            cached_tokens: Final = (
+                getattr(usage.prompt_tokens_details, "cached_tokens", 0) or 0
+                if usage.prompt_tokens_details is not None
+                else 0
+            )
+            if prompt_tokens == 0 and completion_tokens == 0:
+                return 0, 0, False
+            return max(0, prompt_tokens - cached_tokens), completion_tokens, True
+
+        if isinstance(usage, ResponseAPIUsage):
+            response_input_tokens: Final = usage.input_tokens or 0
+            response_output_tokens: Final = usage.output_tokens or 0
+            response_cached_tokens: Final = (
+                usage.input_tokens_details.cached_tokens or 0 if usage.input_tokens_details is not None else 0
+            )
+            if response_input_tokens == 0 and response_output_tokens == 0:
+                return 0, 0, False
+            return max(0, response_input_tokens - response_cached_tokens), response_output_tokens, True
+
+        if isinstance(usage, Mapping):
+            raw_prompt_tokens: Final = usage.get("prompt_tokens") or usage.get("input_tokens") or 0
+            raw_completion_tokens: Final = usage.get("completion_tokens") or usage.get("output_tokens") or 0
+            mapped_prompt_tokens: Final = raw_prompt_tokens if isinstance(raw_prompt_tokens, int) else 0
+            mapped_completion_tokens: Final = raw_completion_tokens if isinstance(raw_completion_tokens, int) else 0
+            prompt_details: Final = usage.get("prompt_tokens_details") or usage.get("input_tokens_details")
+            raw_cached_tokens: Final = (
+                (prompt_details.get("cached_tokens", 0) if isinstance(prompt_details, dict) else 0)
+                or usage.get("cache_read_input_tokens")
+                or 0
+            )
+            mapped_cached_tokens: Final = raw_cached_tokens if isinstance(raw_cached_tokens, int) else 0
+            if mapped_prompt_tokens == 0 and mapped_completion_tokens == 0:
+                return 0, 0, False
+            return max(0, mapped_prompt_tokens - mapped_cached_tokens), mapped_completion_tokens, True
+
+        return 0, 0, False
+
+    def _build_io_token_reservation_ops(
+        self,
+        kwargs: object,
+        response_obj: object,
+    ) -> Sequence[RedisPipelineIncrementOperation]:
+        """
+        Reconcile project ITPM/OTPM reservations to actual usage on success:
+        ITPM to billable input tokens, OTPM to actual completion tokens.
+        Reuses ``_build_reservation_aware_tpm_ops``'s delta pattern -- ITPM/OTPM
+        are stored in the same ":tokens" cache bucket as combined TPM, just
+        under distinct scope keys, so the reservation-aware increment math is
+        identical; only the usage fields being reconciled against differ.
+        """
+        if not isinstance(kwargs, dict):
+            return ()
+        stash: Final = get_request_stash_for_call(_call_id_from_callback_kwargs(kwargs))
+        if stash is None:
+            return ()
+
+        itpm_reserved: Final = stash.itpm_reserved_tokens
+        otpm_reserved: Final = stash.otpm_reserved_tokens
+        if itpm_reserved <= 0 and otpm_reserved <= 0:
+            return ()
+
+        response_usage: Final = self._resolve_io_token_reconcile_usage(response_obj)
+        combined_usage: Final = self._resolve_io_token_reconcile_usage(kwargs.get("combined_usage_object"))
+        aggregate_total: Final = self._aggregate_only_total_tokens(
+            self._response_usage(response_obj)
+        ) or self._aggregate_only_total_tokens(self._response_usage(kwargs.get("combined_usage_object")))
+
+        if not response_usage[2] and not combined_usage[2] and aggregate_total <= 0 and not stash.reservation_released:
+            return ()
+        resolved_usage: Final = (
+            response_usage
+            if response_usage[2]
+            else combined_usage
+            if combined_usage[2]
+            else (aggregate_total, aggregate_total, True)
+            if aggregate_total > 0
+            else (itpm_reserved, otpm_reserved, False)
+        )
+        billable_input, completion_tokens, _ = resolved_usage
+
+        if stash.reservation_released or (
+            not stash.itpm_reserved_window_identities and not stash.otpm_reserved_window_identities
+        ):
+            return self._build_reservation_aware_tpm_ops(
+                targets=tuple(stash.itpm_reserved_scopes),
+                reserved_scopes=frozenset() if stash.reservation_released else stash.itpm_reserved_scopes,
+                actual_tokens=billable_input,
+                reserved_tokens=0 if stash.reservation_released else itpm_reserved,
+            ) + self._build_reservation_aware_tpm_ops(
+                targets=tuple(stash.otpm_reserved_scopes),
+                reserved_scopes=frozenset() if stash.reservation_released else stash.otpm_reserved_scopes,
+                actual_tokens=completion_tokens,
+                reserved_tokens=0 if stash.reservation_released else otpm_reserved,
+            )
+
+        itpm_ops: Final[Sequence[ReservationAwareIncrementOperation]] = (
+            self._build_project_reservation_ops(
+                targets=tuple(stash.itpm_reserved_scopes),
+                reserved_scopes=frozenset() if stash.reservation_released else stash.itpm_reserved_scopes,
+                actual_tokens=billable_input,
+                reserved_tokens=itpm_reserved,
+                reservation_window_identities=stash.itpm_reserved_window_identities,
+            )
+            if itpm_reserved > 0
+            else ()
+        )
+        otpm_ops: Final[Sequence[ReservationAwareIncrementOperation]] = (
+            self._build_project_reservation_ops(
+                targets=tuple(stash.otpm_reserved_scopes),
+                reserved_scopes=frozenset() if stash.reservation_released else stash.otpm_reserved_scopes,
+                actual_tokens=completion_tokens,
+                reserved_tokens=otpm_reserved,
+                reservation_window_identities=stash.otpm_reserved_window_identities,
+            )
+            if otpm_reserved > 0
+            else ()
+        )
+        return tuple((*itpm_ops, *otpm_ops))
+
     def _collect_tpm_scope_targets(
         self,
         standard_logging_metadata: dict[str, Any],
@@ -2978,8 +4196,8 @@ class _PROXY_MaxParallelRequestsHandler_v3(CustomLogger):
 
     def _build_reservation_aware_tpm_ops(
         self,
-        targets: list[tuple[str, str]],
-        reserved_scopes: frozenset[tuple[str, str]],
+        targets: Sequence[tuple[str, str]],
+        reserved_scopes: Set[tuple[str, str]],
         actual_tokens: int,
         reserved_tokens: int,
     ) -> list[RedisPipelineIncrementOperation]:
@@ -3012,6 +4230,66 @@ class _PROXY_MaxParallelRequestsHandler_v3(CustomLogger):
             )
         return ops
 
+    def _build_project_reservation_op(
+        self,
+        scope: tuple[str, str],
+        reserved_scopes: Set[tuple[str, str]],
+        actual_tokens: int,
+        reserved_tokens: int,
+        reservation_window_identities: frozenset[tuple[str, str, Literal["redis", "local"]]],
+    ) -> ReservationAwareIncrementOperation | None:
+        scope_key, scope_value = scope
+        is_reserved_scope: Final = scope in reserved_scopes
+        increment: Final = actual_tokens - reserved_tokens if is_reserved_scope else actual_tokens
+        if increment == 0:
+            return None
+        counter_key: Final = self.create_rate_limit_keys(scope_key, scope_value, "tokens")
+        window_identity: Final = next(
+            (
+                (window_start, backend)
+                for identity_counter_key, window_start, backend in reservation_window_identities
+                if identity_counter_key == counter_key
+            ),
+            None,
+        )
+        if not is_reserved_scope or window_identity is None:
+            return ReservationAwareIncrementOperation(
+                key=counter_key,
+                increment_value=increment,
+                ttl=self.window_size,
+            )
+        return ReservationAwareIncrementOperation(
+            key=counter_key,
+            increment_value=increment,
+            ttl=self.window_size,
+            window_key=f"{{{scope_key}:{scope_value}}}:window",
+            expected_window_start=window_identity[0],
+            reservation_backend=window_identity[1],
+        )
+
+    def _build_project_reservation_ops(
+        self,
+        targets: Sequence[tuple[str, str]],
+        reserved_scopes: Set[tuple[str, str]],
+        actual_tokens: int,
+        reserved_tokens: int,
+        reservation_window_identities: frozenset[tuple[str, str, Literal["redis", "local"]]],
+    ) -> tuple[ReservationAwareIncrementOperation, ...]:
+        return tuple(
+            operation
+            for scope in targets
+            if (
+                operation := self._build_project_reservation_op(
+                    scope=scope,
+                    reserved_scopes=reserved_scopes,
+                    actual_tokens=actual_tokens,
+                    reserved_tokens=reserved_tokens,
+                    reservation_window_identities=reservation_window_identities,
+                )
+            )
+            is not None
+        )
+
     def _build_success_event_pipeline_operations(
         self,
         kwargs: Any,
@@ -3134,12 +4412,26 @@ class _PROXY_MaxParallelRequestsHandler_v3(CustomLogger):
                 response_obj=response_obj,
                 rate_limit_type=rate_limit_type,
             )
-
             if pipeline_operations:
                 await self.async_increment_tokens_with_ttl_preservation(
                     pipeline_operations=pipeline_operations,
                     parent_otel_span=litellm_parent_otel_span,
                 )
+            io_token_operations: Final = self._build_io_token_reservation_ops(
+                kwargs=kwargs,
+                response_obj=response_obj,
+            )
+            if io_token_operations:
+                if isinstance(io_token_operations, list):
+                    await self.async_increment_tokens_with_ttl_preservation(
+                        pipeline_operations=io_token_operations,
+                        parent_otel_span=litellm_parent_otel_span,
+                    )
+                else:
+                    await self.async_increment_reservation_aware_tokens(
+                        pipeline_operations=io_token_operations,
+                        parent_otel_span=litellm_parent_otel_span,
+                    )
 
         except Exception as e:
             verbose_proxy_logger.exception("Error in rate limit success event: %s", e)
@@ -3232,9 +4524,12 @@ class _PROXY_MaxParallelRequestsHandler_v3(CustomLogger):
             # already released it (proxy-level rejection that also bubbles up
             # here as an LLM-error callback). max_parallel_requests is its
             # own counter and is always decremented per call.
-            reserved_tokens = 0
-            if stash is not None and not stash.reservation_released:
-                reserved_tokens = stash.reserved_tokens
+            reserved_tokens, itpm_reserved, otpm_reserved = (
+                (0, 0, 0)
+                if stash is None or stash.reservation_released
+                else (stash.reserved_tokens, stash.itpm_reserved_tokens, stash.otpm_reserved_tokens)
+            )
+
             if stash is not None and reserved_tokens > 0:
                 verbose_proxy_logger.debug("Releasing reserved TPM tokens on failure: %s", reserved_tokens)
                 # Refund only against the scopes the reservation actually
@@ -3251,12 +4546,64 @@ class _PROXY_MaxParallelRequestsHandler_v3(CustomLogger):
                     )
                 )
 
+            # Refund project ITPM/OTPM reservations the same way -- full
+            # refund, since a failed call has no billable usage to reconcile
+            # against.
+            itpm_operations: Final = (
+                self._build_project_reservation_ops(
+                    targets=tuple(stash.itpm_reserved_scopes),
+                    reserved_scopes=stash.itpm_reserved_scopes,
+                    actual_tokens=0,
+                    reserved_tokens=itpm_reserved,
+                    reservation_window_identities=stash.itpm_reserved_window_identities,
+                )
+                if stash is not None and itpm_reserved > 0 and stash.itpm_reserved_window_identities
+                else self._build_reservation_aware_tpm_ops(
+                    targets=tuple(stash.itpm_reserved_scopes),
+                    reserved_scopes=stash.itpm_reserved_scopes,
+                    actual_tokens=0,
+                    reserved_tokens=itpm_reserved,
+                )
+                if stash is not None and itpm_reserved > 0
+                else ()
+            )
+
+            otpm_operations: Final = (
+                self._build_project_reservation_ops(
+                    targets=tuple(stash.otpm_reserved_scopes),
+                    reserved_scopes=stash.otpm_reserved_scopes,
+                    actual_tokens=0,
+                    reserved_tokens=otpm_reserved,
+                    reservation_window_identities=stash.otpm_reserved_window_identities,
+                )
+                if stash is not None and otpm_reserved > 0 and stash.otpm_reserved_window_identities
+                else self._build_reservation_aware_tpm_ops(
+                    targets=tuple(stash.otpm_reserved_scopes),
+                    reserved_scopes=stash.otpm_reserved_scopes,
+                    actual_tokens=0,
+                    reserved_tokens=otpm_reserved,
+                )
+                if stash is not None and otpm_reserved > 0
+                else ()
+            )
+
             if pipeline_operations:
                 await self.internal_usage_cache.dual_cache.async_increment_cache_pipeline(
                     increment_list=pipeline_operations,
                     litellm_parent_otel_span=litellm_parent_otel_span,
                 )
-            if stash is not None and reserved_tokens > 0:
+            for project_operations in (itpm_operations, otpm_operations):
+                if isinstance(project_operations, list):
+                    await self.internal_usage_cache.dual_cache.async_increment_cache_pipeline(
+                        increment_list=project_operations,
+                        litellm_parent_otel_span=litellm_parent_otel_span,
+                    )
+                elif project_operations:
+                    await self.async_increment_reservation_aware_tokens(
+                        pipeline_operations=project_operations,
+                        parent_otel_span=litellm_parent_otel_span,
+                    )
+            if stash is not None and (reserved_tokens > 0 or itpm_reserved > 0 or otpm_reserved > 0):
                 stash.reservation_released = True
         except Exception as e:
             verbose_proxy_logger.exception("Error in rate limit failure event: %s", e)
@@ -3334,19 +4681,19 @@ class _PROXY_MaxParallelRequestsHandler_v3(CustomLogger):
         traceback_str: str | None = None,
     ) -> None:
         """
-        Release the parallel-request slot and any TPM reservation when the
-        request is rejected after the pre-call hook acquired them but before
-        the LLM call ran (e.g. a downstream guardrail/auth hook raised).
-        Without this, those resources are stranded — async_log_failure_event
-        is a litellm completion-level callback and never fires for proxy-side
-        rejections, so a leaked slot would occupy the gauge for the full
-        PARALLEL_REQUEST_SLOT_TTL_SECONDS.
+        Release the parallel-request slot and any TPM/ITPM/OTPM reservation
+        when the request is rejected after the pre-call hook acquired them
+        but before the LLM call ran (e.g. a downstream guardrail/auth hook
+        raised). Without this, those resources are stranded —
+        async_log_failure_event is a litellm completion-level callback and
+        never fires for proxy-side rejections, so a leaked slot would occupy
+        the gauge for the full PARALLEL_REQUEST_SLOT_TTL_SECONDS.
 
         Idempotent: the slot release clears the stashed acquisition (and slot
-        removal is a no-op ZREM on a second run), and the TPM refund is
-        guarded by the stash's ``reservation_released`` flag — if both this
-        hook and async_log_failure_event end up running in the same flow, only
-        the first release/refund applies.
+        removal is a no-op ZREM on a second run), and the TPM/ITPM/OTPM
+        refund is guarded by the stash's ``reservation_released`` flag — if
+        both this hook and async_log_failure_event end up running in the same
+        flow, only the first release/refund applies.
         """
         try:
             stash: Final = get_request_stash()
@@ -3362,23 +4709,80 @@ class _PROXY_MaxParallelRequestsHandler_v3(CustomLogger):
             if stash.reservation_released:
                 return
             reserved_tokens: Final = stash.reserved_tokens
-            if reserved_tokens <= 0:
+            itpm_reserved: Final = stash.itpm_reserved_tokens
+            otpm_reserved: Final = stash.otpm_reserved_tokens
+            if reserved_tokens <= 0 and itpm_reserved <= 0 and otpm_reserved <= 0:
                 return
 
-            ops: Final = self._build_reservation_aware_tpm_ops(
-                targets=list(stash.reserved_scopes),
-                reserved_scopes=stash.reserved_scopes,
-                actual_tokens=0,
-                reserved_tokens=reserved_tokens,
-            )
-            if ops:
-                verbose_proxy_logger.debug(
-                    "Releasing reserved TPM tokens on proxy-level rejection: %s", reserved_tokens
+            combined_ops: Final = (
+                self._build_reservation_aware_tpm_ops(
+                    targets=tuple(stash.reserved_scopes),
+                    reserved_scopes=stash.reserved_scopes,
+                    actual_tokens=0,
+                    reserved_tokens=reserved_tokens,
                 )
+                if reserved_tokens > 0
+                else ()
+            )
+            itpm_ops: Final = (
+                self._build_project_reservation_ops(
+                    targets=tuple(stash.itpm_reserved_scopes),
+                    reserved_scopes=stash.itpm_reserved_scopes,
+                    actual_tokens=0,
+                    reserved_tokens=itpm_reserved,
+                    reservation_window_identities=stash.itpm_reserved_window_identities,
+                )
+                if itpm_reserved > 0 and stash.itpm_reserved_window_identities
+                else self._build_reservation_aware_tpm_ops(
+                    targets=tuple(stash.itpm_reserved_scopes),
+                    reserved_scopes=stash.itpm_reserved_scopes,
+                    actual_tokens=0,
+                    reserved_tokens=itpm_reserved,
+                )
+                if itpm_reserved > 0
+                else ()
+            )
+            otpm_ops: Final = (
+                self._build_project_reservation_ops(
+                    targets=tuple(stash.otpm_reserved_scopes),
+                    reserved_scopes=stash.otpm_reserved_scopes,
+                    actual_tokens=0,
+                    reserved_tokens=otpm_reserved,
+                    reservation_window_identities=stash.otpm_reserved_window_identities,
+                )
+                if otpm_reserved > 0 and stash.otpm_reserved_window_identities
+                else self._build_reservation_aware_tpm_ops(
+                    targets=tuple(stash.otpm_reserved_scopes),
+                    reserved_scopes=stash.otpm_reserved_scopes,
+                    actual_tokens=0,
+                    reserved_tokens=otpm_reserved,
+                )
+                if otpm_reserved > 0
+                else ()
+            )
+            if combined_ops or itpm_ops or otpm_ops:
+                verbose_proxy_logger.debug(
+                    "Releasing reserved tokens on proxy-level rejection: tpm=%s, itpm=%s, otpm=%s",
+                    reserved_tokens,
+                    itpm_reserved,
+                    otpm_reserved,
+                )
+            if combined_ops:
                 await self.internal_usage_cache.dual_cache.async_increment_cache_pipeline(
-                    increment_list=ops,
+                    increment_list=combined_ops,
                     litellm_parent_otel_span=user_api_key_dict.parent_otel_span,
                 )
+            for project_ops in (itpm_ops, otpm_ops):
+                if isinstance(project_ops, list):
+                    await self.internal_usage_cache.dual_cache.async_increment_cache_pipeline(
+                        increment_list=project_ops,
+                        litellm_parent_otel_span=user_api_key_dict.parent_otel_span,
+                    )
+                elif project_ops:
+                    await self.async_increment_reservation_aware_tokens(
+                        pipeline_operations=project_ops,
+                        parent_otel_span=user_api_key_dict.parent_otel_span,
+                    )
             stash.reservation_released = True
         except Exception as e:
             verbose_proxy_logger.exception("Error releasing TPM reservation on post-call failure: %s", e)
diff --git a/litellm/proxy/management_endpoints/common_daily_activity.py b/litellm/proxy/management_endpoints/common_daily_activity.py
index 8edb3b42dce..781fe264eb8 100644
--- a/litellm/proxy/management_endpoints/common_daily_activity.py
+++ b/litellm/proxy/management_endpoints/common_daily_activity.py
@@ -594,13 +594,16 @@ def _build_aggregated_where_clause(
     sql_params.append(adjusted_end)
     p += 1
 
-    # Optional entity filter
+    # Optional entity filter; an empty list must match nothing, not everything
     if entity_id is not None:
         if isinstance(entity_id, list):
-            placeholders = ", ".join(f"${p + i}" for i in range(len(entity_id)))
-            sql_conditions.append(f'"{entity_id_field}" IN ({placeholders})')
-            sql_params.extend(entity_id)
-            p += len(entity_id)
+            if entity_id:
+                placeholders = ", ".join(f"${p + i}" for i in range(len(entity_id)))
+                sql_conditions.append(f'"{entity_id_field}" IN ({placeholders})')
+                sql_params.extend(entity_id)
+                p += len(entity_id)
+            else:
+                sql_conditions.append("FALSE")
         else:
             sql_conditions.append(f'"{entity_id_field}" = ${p}')
             sql_params.append(entity_id)
diff --git a/litellm/proxy/management_endpoints/model_access_group_management_endpoints.py b/litellm/proxy/management_endpoints/model_access_group_management_endpoints.py
index 49c0135ff10..8e8545a51cc 100644
--- a/litellm/proxy/management_endpoints/model_access_group_management_endpoints.py
+++ b/litellm/proxy/management_endpoints/model_access_group_management_endpoints.py
@@ -57,20 +57,37 @@ def _model_table(prisma_client: PrismaClient) -> _ModelTableClient:
     return ModelRepository(prisma_client).table
 
 
-def validate_models_exist(model_names: list[str], llm_router: "Router | None") -> tuple[bool, list[str]]:
+def validate_models_exist(model_names: Sequence[str], llm_router: "Router | None") -> tuple[bool, Sequence[str]]:
     """
     Validate that all requested model names exist in the router.
     Checks only exact model name matches.
 
     Returns:
-        Tuple[bool, List[str]]: (all_valid, missing_models)
+        (all_valid, missing_models)
     """
     if llm_router is None:
         return False, model_names
 
-    router_model_names: Final = set(llm_router.get_model_names())
-    missing: Final = [m for m in model_names if m not in router_model_names]
-    return (len(missing) == 0, missing)
+    router_model_names: Final = frozenset(llm_router.get_model_names())
+    missing: Final = tuple(m for m in model_names if m not in router_model_names)
+    return (not missing, missing)
+
+
+async def _missing_models_after_read_through(
+    model_names: Sequence[str], llm_router: "Router | None"
+) -> tuple[str, ...]:
+    from litellm.proxy import proxy_server
+    from litellm.proxy.common_utils.registry_read_through import (
+        model_registry_read_through,
+    )
+
+    _, missing = validate_models_exist(model_names=model_names, llm_router=llm_router)
+    if not missing:
+        return ()
+    for name in missing:
+        await model_registry_read_through.attempt(name)
+    _, still_missing = validate_models_exist(model_names=model_names, llm_router=proxy_server.llm_router)
+    return tuple(still_missing)
 
 
 def add_access_group_to_deployment(model_info: dict[str, Any], access_group: str) -> tuple[dict[str, Any], bool]:
@@ -101,13 +118,21 @@ def _raise_http_if_reload_degraded_serving(
     before: frozenset[str],
     written_models: Sequence[tuple[str, object]],
     access_group: str,
+    still_desired: frozenset[str] | None,
+    live_after: frozenset[str] | None,
 ) -> None:
     """Same verdict as the model-write endpoints, expressed through this file's
     HTTPException error convention, with the metadata-only obligation: these writes
     change group membership, not the models themselves, so a row that was already not
     serving before the reload is never blamed here; only a model this reload stopped
     serving is reported."""
-    missing, collateral = reload_serving_verdict(before=before, written_models=written_models, written_must_serve=False)
+    missing, collateral = reload_serving_verdict(
+        before=before,
+        written_models=written_models,
+        written_must_serve=False,
+        still_desired=still_desired,
+        live_after=live_after,
+    )
     gone: Final = tuple(dict.fromkeys((*missing, *collateral)))
     if not gone:
         return
@@ -390,12 +415,12 @@ async def create_model_group(
     # Validate model_names exist in router (only if using model_names path)
     if not use_model_ids and has_model_names:
         assert data.model_names is not None
-        all_valid, missing_models = validate_models_exist(
+        missing_models: Final = await _missing_models_after_read_through(
             model_names=data.model_names,
             llm_router=llm_router,
         )
 
-        if not all_valid:
+        if missing_models:
             raise HTTPException(
                 status_code=400,
                 detail={"error": f"Model(s) not found: {', '.join(missing_models)}"},
@@ -439,11 +464,13 @@ async def create_model_group(
 
         live_before_reload: Final = live_model_ids_snapshot()
 
-        await clear_cache()
+        reload_outcome: Final = await clear_cache()
         _raise_http_if_reload_degraded_serving(
             before=live_before_reload,
             written_models=updated_pairs,
             access_group=data.access_group,
+            still_desired=reload_outcome.still_desired,
+            live_after=reload_outcome.live_after,
         )
 
         verbose_proxy_logger.info(
@@ -654,12 +681,12 @@ async def update_access_group(
     # Validation: Check if all new models exist (only if using model_names path)
     if not use_model_ids and has_model_names:
         assert data.model_names is not None
-        all_valid, missing_models = validate_models_exist(
+        missing_models: Final = await _missing_models_after_read_through(
             model_names=data.model_names,
             llm_router=llm_router,
         )
 
-        if not all_valid:
+        if missing_models:
             raise HTTPException(
                 status_code=400,
                 detail={"error": f"Model(s) not found: {', '.join(missing_models)}"},
@@ -699,11 +726,13 @@ async def update_access_group(
 
         # Clear cache and reload models to pick up the access group changes
         live_before_reload: Final = live_model_ids_snapshot()
-        await clear_cache()
+        reload_outcome: Final = await clear_cache()
         _raise_http_if_reload_degraded_serving(
             before=live_before_reload,
             written_models=list({**dict(stripped_pairs), **dict(updated_pairs)}.items()),
             access_group=access_group,
+            still_desired=reload_outcome.still_desired,
+            live_after=reload_outcome.live_after,
         )
 
         verbose_proxy_logger.info(
@@ -801,11 +830,13 @@ async def delete_access_group(
 
         # Clear cache and reload models to pick up the access group changes
         live_before_reload: Final = live_model_ids_snapshot()
-        await clear_cache()
+        reload_outcome: Final = await clear_cache()
         _raise_http_if_reload_degraded_serving(
             before=live_before_reload,
             written_models=removed_pairs,
             access_group=access_group,
+            still_desired=reload_outcome.still_desired,
+            live_after=reload_outcome.live_after,
         )
 
         verbose_proxy_logger.info(
diff --git a/litellm/proxy/pass_through_endpoints/llm_passthrough_endpoints.py b/litellm/proxy/pass_through_endpoints/llm_passthrough_endpoints.py
index 635767f4db7..c5ab7f1fc63 100644
--- a/litellm/proxy/pass_through_endpoints/llm_passthrough_endpoints.py
+++ b/litellm/proxy/pass_through_endpoints/llm_passthrough_endpoints.py
@@ -50,7 +50,7 @@ from litellm.proxy.vector_store_endpoints.utils import (
     get_litellm_managed_vector_store,
     is_allowed_to_call_vector_store_endpoint,
 )
-from litellm.secret_managers.main import get_secret_str
+from litellm.secret_managers.main import get_secret_str, str_to_bool
 from litellm.types.passthrough_endpoints.pass_through_endpoints import (
     LITELLM_PASS_THROUGH_CUSTOM_BODY_STATE_KEY,
     LITELLM_PASS_THROUGH_RAW_BODY_STATE_KEY,
@@ -1016,15 +1016,21 @@ async def bedrock_proxy_route(
         raise ImportError("Missing boto3 to call bedrock. Run 'pip install boto3'.")
 
     aws_region_name: Final = litellm.utils.get_secret(secret_name="AWS_REGION_NAME")
-    if _is_bedrock_agent_runtime_route(endpoint=endpoint):  # handle bedrock agents
-        base_target_url: Final = f"https://bedrock-agent-runtime.{aws_region_name}.amazonaws.com"
-    else:
+    if not _is_bedrock_agent_runtime_route(endpoint=endpoint):
         return await bedrock_llm_proxy_route(
             endpoint=endpoint,
             request=request,
             fastapi_response=fastapi_response,
             user_api_key_dict=user_api_key_dict,
         )
+
+    if _is_bedrock_agent_runtime_passthrough_disabled():
+        raise HTTPException(
+            status_code=403,
+            detail="bedrock-agent-runtime pass-through is disabled on this proxy.",
+        )
+
+    base_target_url: Final = f"https://bedrock-agent-runtime.{aws_region_name}.amazonaws.com"
     encoded_endpoint = httpx.URL(endpoint).path
 
     # Ensure endpoint starts with '/' for proper URL construction
@@ -1292,6 +1298,15 @@ def _is_bedrock_agent_runtime_route(endpoint: str) -> bool:
     return False
 
 
+def _is_bedrock_agent_runtime_passthrough_disabled() -> bool:
+    from litellm.proxy.proxy_server import general_settings
+
+    setting: Final = general_settings.get("disable_bedrock_agent_runtime_passthrough")
+    if isinstance(setting, str):
+        return str_to_bool(setting) is True
+    return setting is True
+
+
 @router.api_route(
     "/assemblyai/{endpoint:path}",
     methods=["GET", "POST", "PUT", "DELETE", "PATCH"],
diff --git a/litellm/proxy/pass_through_endpoints/llm_provider_handlers/openai_passthrough_logging_handler.py b/litellm/proxy/pass_through_endpoints/llm_provider_handlers/openai_passthrough_logging_handler.py
index 1c8bce28454..5f6489a69ca 100644
--- a/litellm/proxy/pass_through_endpoints/llm_provider_handlers/openai_passthrough_logging_handler.py
+++ b/litellm/proxy/pass_through_endpoints/llm_provider_handlers/openai_passthrough_logging_handler.py
@@ -229,6 +229,25 @@ class OpenAIPassthroughLoggingHandler(BasePassthroughLoggingHandler):
             verbose_proxy_logger.warning("Error calculating image editing cost: %s", e)
             return 0.0
 
+    @staticmethod
+    def _calculate_embeddings_cost(
+        litellm_model_response: EmbeddingResponse,
+        model: str,
+        custom_llm_provider: str,
+    ) -> float:
+        try:
+            return litellm.completion_cost(
+                completion_response=litellm_model_response,
+                model=model,
+                custom_llm_provider=custom_llm_provider,
+                call_type="aembedding",
+            )
+        except Exception as e:  # noqa: BLE001  # completion_cost raises bare Exception for unmapped models; cost failure must never drop the spend log
+            verbose_proxy_logger.warning(
+                "Error calculating embeddings cost for model %s, logging spend with cost 0: %s", model, e
+            )
+            return 0.0
+
     @staticmethod
     def _build_responses_api_response_and_cost(
         model: str,
@@ -351,11 +370,10 @@ class OpenAIPassthroughLoggingHandler(BasePassthroughLoggingHandler):
                     model_response_object=EmbeddingResponse(),
                     response_type="embedding",
                 )
-                response_cost = litellm.completion_cost(
-                    completion_response=litellm_model_response,
+                response_cost = OpenAIPassthroughLoggingHandler._calculate_embeddings_cost(
+                    litellm_model_response=litellm_model_response,
                     model=model,
                     custom_llm_provider=custom_llm_provider,
-                    call_type="aembedding",
                 )
                 litellm_model_response._hidden_params["response_cost"] = response_cost
             elif is_image_generation:
@@ -471,6 +489,12 @@ class OpenAIPassthroughLoggingHandler(BasePassthroughLoggingHandler):
 
         except Exception as e:
             verbose_proxy_logger.error("Error in OpenAI passthrough cost tracking: %s", e)
+            if not is_chat_completions:
+                unbilled_result: Final[PassThroughEndpointLoggingTypedDict] = {
+                    "result": None,
+                    "kwargs": kwargs,
+                }
+                return unbilled_result
             # Fall back to base handler without cost tracking
             base_handler = OpenAIPassthroughLoggingHandler()
             return base_handler.passthrough_chat_handler(
diff --git a/litellm/proxy/proxy_server.py b/litellm/proxy/proxy_server.py
index 56036713fa9..be1914ea50c 100644
--- a/litellm/proxy/proxy_server.py
+++ b/litellm/proxy/proxy_server.py
@@ -4120,6 +4120,31 @@ def _swap_in_model_cost_map(new_model_cost_map: dict) -> int:
     return fetched_model_count
 
 
+def should_load_db_object(object_type: str | SupportedDBObjectType) -> bool:
+    """
+    Check if an object type should be loaded from the database based on general_settings.supported_db_objects.
+
+    Args:
+        object_type: Type of object to check (e.g., SupportedDBObjectType.MODELS, "models", etc.)
+
+    Returns:
+        True if the object should be loaded, False otherwise
+    """
+    supported_db_objects: Final = general_settings.get("supported_db_objects", None)
+
+    if supported_db_objects is None:
+        return True
+
+    if not isinstance(supported_db_objects, list):
+        verbose_proxy_logger.warning(
+            "supported_db_objects is not a list, got %s. Loading all objects.", type(supported_db_objects)
+        )
+        return True
+
+    object_type_str: Final = str(object_type)
+    return any(str(obj) == object_type_str for obj in supported_db_objects)
+
+
 class ProxyConfig:
     """
     Abstraction class on top of config loading/updating logic. Gives us one place to control all config updating logic.
@@ -6522,36 +6547,7 @@ class ProxyConfig:
         return config
 
     def _should_load_db_object(self, object_type: str | SupportedDBObjectType) -> bool:
-        """
-        Check if an object type should be loaded from the database based on general_settings.supported_db_objects.
-
-        Args:
-            object_type: Type of object to check (e.g., SupportedDBObjectType.MODELS, "models", etc.)
-
-        Returns:
-            True if the object should be loaded, False otherwise
-        """
-        global general_settings
-
-        # Get the supported_db_objects configuration
-        supported_db_objects: Final = general_settings.get("supported_db_objects", None)
-
-        # If supported_db_objects is not set, load all objects (default behavior)
-        if supported_db_objects is None:
-            return True
-
-        # If supported_db_objects is set, only load specified objects
-        if not isinstance(supported_db_objects, list):
-            verbose_proxy_logger.warning(
-                "supported_db_objects is not a list, got %s. Loading all objects.", type(supported_db_objects)
-            )
-            return True
-
-        # Convert object_type to string for comparison (handles both str and enum)
-        object_type_str: Final = str(object_type)
-
-        # Check if the object type is in the list (supports both str and enum values)
-        return any(str(obj) == object_type_str for obj in supported_db_objects)
+        return should_load_db_object(object_type=object_type)
 
     async def _get_models_from_db(self, prisma_client: PrismaClient) -> list | None:
         """
@@ -7094,38 +7090,40 @@ class ProxyConfig:
 
     async def _init_guardrails_in_db(self, prisma_client: PrismaClient):
         from litellm.proxy.guardrails.guardrail_registry import (
+            GUARDRAIL_RECONCILE_LOCK,
             IN_MEMORY_GUARDRAIL_HANDLER,
             Guardrail,
             GuardrailRegistry,
         )
 
         try:
-            guardrails_in_db: Final[list[Guardrail]] = await GuardrailRegistry.get_all_guardrails_from_db(
-                prisma_client=prisma_client
-            )
-            verbose_proxy_logger.debug("guardrails from the DB %s", str(guardrails_in_db))
-            db_guardrail_ids: Final[set] = set()
-            for guardrail in guardrails_in_db:
-                guardrail_id = guardrail.get("guardrail_id")
-                if guardrail_id:
-                    db_guardrail_ids.add(guardrail_id)
-                try:
-                    IN_MEMORY_GUARDRAIL_HANDLER.sync_guardrail_from_db(
-                        guardrail=cast(Guardrail, guardrail),
-                    )
-                except Exception as e:  # noqa: BLE001  # one unloadable row must not stop the remaining guardrails
-                    verbose_proxy_logger.error(
-                        "litellm.proxy.proxy_server.py::ProxyConfig:_init_guardrails_in_db - "
-                        "skipping guardrail '%s' (ID: %s): %s: %s",
-                        guardrail.get("guardrail_name"),
-                        guardrail_id,
-                        type(e).__name__,
-                        e,
-                    )
+            async with GUARDRAIL_RECONCILE_LOCK:
+                guardrails_in_db: Final[list[Guardrail]] = await GuardrailRegistry.get_all_guardrails_from_db(
+                    prisma_client=prisma_client
+                )
+                verbose_proxy_logger.debug("guardrails from the DB %s", str(guardrails_in_db))
+                db_guardrail_ids: Final[set] = set()
+                for guardrail in guardrails_in_db:
+                    guardrail_id = guardrail.get("guardrail_id")
+                    if guardrail_id:
+                        db_guardrail_ids.add(guardrail_id)
+                    try:
+                        IN_MEMORY_GUARDRAIL_HANDLER.sync_guardrail_from_db(
+                            guardrail=cast(Guardrail, guardrail),
+                        )
+                    except Exception as e:  # noqa: BLE001  # one unloadable row must not stop the remaining guardrails
+                        verbose_proxy_logger.error(
+                            "litellm.proxy.proxy_server.py::ProxyConfig:_init_guardrails_in_db - "
+                            "skipping guardrail '%s' (ID: %s): %s: %s",
+                            guardrail.get("guardrail_name"),
+                            guardrail_id,
+                            type(e).__name__,
+                            e,
+                        )
 
-            # Drop in-memory DB-backed entries whose row was deleted on another
-            # pod. Config-loaded entries are never touched.
-            IN_MEMORY_GUARDRAIL_HANDLER.reconcile_db_guardrails(db_guardrail_ids=db_guardrail_ids)
+                # Drop in-memory DB-backed entries whose row was deleted on another
+                # pod. Config-loaded entries are never touched.
+                IN_MEMORY_GUARDRAIL_HANDLER.reconcile_db_guardrails(db_guardrail_ids=db_guardrail_ids)
         except Exception as e:
             verbose_proxy_logger.exception("litellm.proxy.proxy_server.py::ProxyConfig:_init_guardrails_in_db - %s", e)
 
@@ -7278,13 +7276,17 @@ class ProxyConfig:
             )
 
     async def _init_agents_in_db(self, prisma_client: PrismaClient):
+        from litellm.proxy.agent_endpoints.agent_registry import (
+            AGENT_RECONCILE_LOCK,
+        )
         from litellm.proxy.agent_endpoints.agent_registry import (
             global_agent_registry as AGENT_REGISTRY,
         )
 
         try:
-            db_agents: Final = await AGENT_REGISTRY.get_all_agents_from_db(prisma_client=prisma_client)
-            AGENT_REGISTRY.load_agents_from_db_and_config(db_agents=db_agents)
+            async with AGENT_RECONCILE_LOCK:
+                db_agents: Final = await AGENT_REGISTRY.get_all_agents_from_db(prisma_client=prisma_client)
+                AGENT_REGISTRY.load_agents_from_db_and_config(db_agents=db_agents)
         except Exception as e:
             verbose_proxy_logger.exception("litellm.proxy.proxy_server.py::ProxyConfig:_init_agents_in_db - %s", e)
 
@@ -10254,11 +10256,9 @@ async def embeddings(
 
 """
     global proxy_logging_obj
-    data: Any = {}
+    data: Final = await _read_request_body(request=request)
+    base_llm_response_processor: Final = ProxyBaseLLMRequestProcessing(data=data)
     try:
-        # Use shared request body reading helper (same as chat/completions)
-        data = await _read_request_body(request=request)
-
         ### HANDLE TOKEN ARRAY INPUT DECODING ###
         # This must happen BEFORE base_process_llm_request() since it modifies the input
         router_model_names: Final = llm_router.model_names if llm_router is not None else []
@@ -10302,10 +10302,6 @@ async def embeddings(
             if hasattr(user_api_key_dict, "agent_id") and user_api_key_dict.agent_id is not None:
                 data["metadata"]["agent_id"] = user_api_key_dict.agent_id
 
-        # Use unified request processor (same as chat/completions and responses)
-        base_llm_response_processor = ProxyBaseLLMRequestProcessing(data=data)
-
-        # Process the request with all optimizations (shared sessions, network tuning, etc.)
         response: Final = await base_llm_response_processor.base_process_llm_request(
             request=request,
             fastapi_response=fastapi_response,
@@ -10327,8 +10323,6 @@ async def embeddings(
 
         return response
     except Exception as e:
-        # Use unified error handler
-        base_llm_response_processor = ProxyBaseLLMRequestProcessing(data=data)
         raise await base_llm_response_processor._handle_llm_api_exception(
             e=e,
             user_api_key_dict=user_api_key_dict,
diff --git a/litellm/proxy/route_llm_request.py b/litellm/proxy/route_llm_request.py
index c85325b6fa9..91a0c68fd58 100644
--- a/litellm/proxy/route_llm_request.py
+++ b/litellm/proxy/route_llm_request.py
@@ -146,7 +146,8 @@ ROUTE_ENDPOINT_MAPPING: Final = {
 
 
 class ProxyModelNotFoundError(HTTPException):
-    def __init__(self, route: str, model_name: str):
+    def __init__(self, route: str, model_name: str, retryable_with_model_read_through: bool = True):
+        self.retryable_with_model_read_through: Final = retryable_with_model_read_through
         detail: Final = {
             "error": f"{route}: Invalid model name passed in model={model_name}. Call `/v1/models` to view available models for your key."
         }
@@ -320,112 +321,150 @@ async def add_shared_session_to_data(data: dict) -> None:
             pass
 
 
+RouteType = Literal[
+    "acompletion",
+    "atext_completion",
+    "aembedding",
+    "aimage_generation",
+    "aspeech",
+    "atranscription",
+    "amoderation",
+    "arerank",
+    "aresponses",
+    "aget_responses",
+    "adelete_responses",
+    "acancel_responses",
+    "acompact_responses",
+    "acreate_response_reply",
+    "alist_input_items",
+    "_arealtime",  # private function for realtime API
+    "acreate_realtime_client_secret",
+    "arealtime_calls",
+    "acreate_realtime_transcription_session",
+    "_aresponses_websocket",  # private function for responses WebSocket mode
+    "aimage_edit",
+    "agenerate_content",
+    "agenerate_content_stream",
+    "allm_passthrough_route",
+    "acreate_batch",
+    "aretrieve_batch",
+    "alist_batches",
+    "afile_content",
+    "afile_retrieve",
+    "acreate_fine_tuning_job",
+    "acancel_fine_tuning_job",
+    "alist_fine_tuning_jobs",
+    "aretrieve_fine_tuning_job",
+    "avector_store_search",
+    "avector_store_create",
+    "avector_store_retrieve",
+    "avector_store_list",
+    "avector_store_update",
+    "avector_store_delete",
+    "avector_store_file_create",
+    "avector_store_file_list",
+    "avector_store_file_retrieve",
+    "avector_store_file_content",
+    "avector_store_file_update",
+    "avector_store_file_delete",
+    "aocr",
+    "asearch",
+    "avideo_generation",
+    "avideo_list",
+    "avideo_status",
+    "avideo_content",
+    "avideo_remix",
+    "avideo_create_character",
+    "avideo_get_character",
+    "avideo_edit",
+    "avideo_extension",
+    "acreate_container",
+    "alist_containers",
+    "aretrieve_container",
+    "adelete_container",
+    "aupload_container_file",
+    "alist_container_files",
+    "aretrieve_container_file",
+    "adelete_container_file",
+    "aretrieve_container_file_content",
+    "acreate_skill",
+    "alist_skills",
+    "aget_skill",
+    "adelete_skill",
+    "aingest",
+    "anthropic_messages",
+    "acreate_interaction",
+    "aget_interaction",
+    "adelete_interaction",
+    "acancel_interaction",
+    "acreate_agent",
+    "alist_agents",
+    "aget_agent",
+    "adelete_agent",
+    "alist_agent_versions",
+    "asend_message",
+    "call_mcp_tool",
+    "acancel_batch",
+    "afile_delete",
+    "acreate_eval",
+    "alist_evals",
+    "aget_eval",
+    "aupdate_eval",
+    "adelete_eval",
+    "acancel_eval",
+    "acreate_run",
+    "alist_runs",
+    "aget_run",
+    "acancel_run",
+    "adelete_run",
+]
+
+
 async def route_request(
     data: dict,
     llm_router: LitellmRouter | None,
     user_model: str | None,
-    route_type: Literal[
-        "acompletion",
-        "atext_completion",
-        "aembedding",
-        "aimage_generation",
-        "aspeech",
-        "atranscription",
-        "amoderation",
-        "arerank",
-        "aresponses",
-        "aget_responses",
-        "adelete_responses",
-        "acancel_responses",
-        "acompact_responses",
-        "acreate_response_reply",
-        "alist_input_items",
-        "_arealtime",  # private function for realtime API
-        "acreate_realtime_client_secret",
-        "arealtime_calls",
-        "acreate_realtime_transcription_session",
-        "_aresponses_websocket",  # private function for responses WebSocket mode
-        "aimage_edit",
-        "agenerate_content",
-        "agenerate_content_stream",
-        "allm_passthrough_route",
-        "acreate_batch",
-        "aretrieve_batch",
-        "alist_batches",
-        "afile_content",
-        "afile_retrieve",
-        "acreate_fine_tuning_job",
-        "acancel_fine_tuning_job",
-        "alist_fine_tuning_jobs",
-        "aretrieve_fine_tuning_job",
-        "avector_store_search",
-        "avector_store_create",
-        "avector_store_retrieve",
-        "avector_store_list",
-        "avector_store_update",
-        "avector_store_delete",
-        "avector_store_file_create",
-        "avector_store_file_list",
-        "avector_store_file_retrieve",
-        "avector_store_file_content",
-        "avector_store_file_update",
-        "avector_store_file_delete",
-        "aocr",
-        "asearch",
-        "avideo_generation",
-        "avideo_list",
-        "avideo_status",
-        "avideo_content",
-        "avideo_remix",
-        "avideo_create_character",
-        "avideo_get_character",
-        "avideo_edit",
-        "avideo_extension",
-        "acreate_container",
-        "alist_containers",
-        "aretrieve_container",
-        "adelete_container",
-        "aupload_container_file",
-        "alist_container_files",
-        "aretrieve_container_file",
-        "adelete_container_file",
-        "aretrieve_container_file_content",
-        "acreate_skill",
-        "alist_skills",
-        "aget_skill",
-        "adelete_skill",
-        "aingest",
-        "anthropic_messages",
-        "acreate_interaction",
-        "aget_interaction",
-        "adelete_interaction",
-        "acancel_interaction",
-        "acreate_agent",
-        "alist_agents",
-        "aget_agent",
-        "adelete_agent",
-        "alist_agent_versions",
-        "asend_message",
-        "call_mcp_tool",
-        "acancel_batch",
-        "afile_delete",
-        "acreate_eval",
-        "alist_evals",
-        "aget_eval",
-        "aupdate_eval",
-        "adelete_eval",
-        "acancel_eval",
-        "acreate_run",
-        "alist_runs",
-        "aget_run",
-        "acancel_run",
-        "adelete_run",
-    ],
+    route_type: RouteType,
     user_api_key_dict: UserAPIKeyAuth | None = None,
 ):
     """
     Common helper to route the request
     """
+    try:
+        return await _route_request_single_attempt(
+            data=data,
+            llm_router=llm_router,
+            user_model=user_model,
+            route_type=route_type,
+            user_api_key_dict=user_api_key_dict,
+        )
+    except ProxyModelNotFoundError as e:
+        requested_model: Final = data.get("model", "")
+        if not e.retryable_with_model_read_through or not isinstance(requested_model, str) or not requested_model:
+            raise
+        from litellm.proxy import proxy_server
+        from litellm.proxy.common_utils.registry_read_through import (
+            model_registry_read_through,
+        )
+
+        if not await model_registry_read_through.attempt(requested_model):
+            raise
+        return await _route_request_single_attempt(
+            data=data,
+            llm_router=proxy_server.llm_router,
+            user_model=user_model,
+            route_type=route_type,
+            user_api_key_dict=user_api_key_dict,
+        )
+
+
+async def _route_request_single_attempt(  # noqa: ANN202  # returns unawaited provider coroutines; the inferred union keeps route_request's callers typed
+    data: dict,  # mutable-ok: request body is the proxy-wide mutable dict contract shared with route_request
+    llm_router: LitellmRouter | None,
+    user_model: str | None,
+    route_type: RouteType,
+    user_api_key_dict: UserAPIKeyAuth | None = None,
+):
     raise_if_required_body_param_missing(route_type=route_type, data=data)
 
     await add_shared_session_to_data(data)
diff --git a/litellm/proxy/utils.py b/litellm/proxy/utils.py
index 2ad7180bd5f..a743526e975 100644
--- a/litellm/proxy/utils.py
+++ b/litellm/proxy/utils.py
@@ -40,7 +40,7 @@ from litellm.proxy._types import (
 from litellm.proxy.spend_tracking.spend_log_error_logger import spend_log_error
 from litellm.types.guardrails import GuardrailEventHooks
 from litellm.types.proxy.model_listing import ModelInfoResponse
-from litellm.types.utils import CallTypes, CallTypesLiteral, ModelInfo
+from litellm.types.utils import CallTypes, CallTypesLiteral, ModelInfo, Usage
 
 try:
     from litellm_enterprise.enterprise_callbacks.send_emails.base_email import (
@@ -403,6 +403,120 @@ def _exception_changes_request_flow(exc: BaseException) -> bool:
     return isinstance(exc, (SensitiveDataRouteException, ModifyResponseException))
 
 
+def _prompt_block_text(block: object) -> str:
+    if isinstance(block, str):
+        return block
+    if not isinstance(block, dict):
+        return ""
+    block_text: Final = block.get("text")
+    return block_text if isinstance(block_text, str) else ""
+
+
+def _system_prompt_text(system_input: object) -> str:
+    if isinstance(system_input, str):
+        return system_input
+    if not isinstance(system_input, list):
+        return ""
+    return "".join(_prompt_block_text(block) for block in system_input)
+
+
+def _count_request_input_tokens(model: str, request_input: object, system_input: object) -> int:
+    system_text: Final = _system_prompt_text(system_input)
+    system_tokens: Final = litellm.token_counter(model=model, text=system_text) if system_text else 0
+    if isinstance(request_input, str):
+        return system_tokens + litellm.token_counter(model=model, text=request_input)
+    if not isinstance(request_input, list) or not request_input:
+        return system_tokens
+    text_entries: Final = tuple(entry for entry in request_input if isinstance(entry, str))
+    if len(text_entries) == len(request_input):
+        return system_tokens + litellm.token_counter(model=model, text="".join(text_entries))
+    return system_tokens + litellm.token_counter(
+        model=model, messages=request_input, use_default_image_token_count=True
+    )
+
+
+def _estimate_dispatched_failure_usage(model: str, request_input: object, system_input: object) -> Usage | None:
+    """A request that failed after dispatch consumed provider-billed input
+    tokens, but no provider usage ever came back. Estimate the input side with
+    the same tokenizer fallback interrupted streams use, so the spend log's
+    failure row records what was sent instead of zero."""
+    try:
+        input_tokens: Final = _count_request_input_tokens(
+            model=model, request_input=request_input, system_input=system_input
+        )
+    except Exception:
+        return None
+    if input_tokens <= 0:
+        return None
+    return Usage(prompt_tokens=input_tokens, completion_tokens=0, total_tokens=input_tokens)
+
+
+_INPUT_ESTIMABLE_CALL_TYPES: Final = frozenset(
+    call_type.value
+    for call_type in (
+        CallTypes.completion,
+        CallTypes.acompletion,
+        CallTypes.text_completion,
+        CallTypes.atext_completion,
+        CallTypes.anthropic_messages,
+        CallTypes.aanthropic_messages,
+        CallTypes.responses,
+        CallTypes.aresponses,
+        CallTypes.embedding,
+        CallTypes.aembedding,
+        CallTypes.moderation,
+        CallTypes.amoderation,
+        CallTypes.image_generation,
+        CallTypes.aimage_generation,
+        CallTypes.speech,
+        CallTypes.aspeech,
+        CallTypes.rerank,
+        CallTypes.arerank,
+        CallTypes.generate_content,
+        CallTypes.agenerate_content,
+        CallTypes.generate_content_stream,
+        CallTypes.agenerate_content_stream,
+    )
+)
+
+
+def _failure_usage_to_lift(
+    model_call_details: Mapping[str, object],
+    request_body: Mapping[str, object],
+    dispatched: bool,
+) -> tuple[object, object] | None:
+    """A stream that broke mid-flight still billed the provider for the chunks
+    already delivered; the streaming handler stashes that recovered usage and
+    cost in model_call_details, so prefer it. Otherwise a request that was
+    dispatched to a provider and failed without upstream usage gets an
+    estimated input-side Usage with zero cost. The raw request body backfills
+    the system prompt when the SDK bridges an endpoint (e.g. /v1/messages on a
+    chat-completions provider) without filling optional_params. Returns the
+    (combined_usage_object, response_cost) pair to lift, or None."""
+    recovered_usage: Final = model_call_details.get("combined_usage_object")
+    if recovered_usage is not None:
+        return recovered_usage, model_call_details.get("response_cost")
+    if not dispatched or model_call_details.get(LITELLM_LOGGING_NO_UPSTREAM_LLM_CALL):
+        return None
+    if str(model_call_details.get("call_type")) not in _INPUT_ESTIMABLE_CALL_TYPES:
+        return None
+    optional_params: Final = model_call_details.get("optional_params")
+    dispatched_system: Final = (
+        (optional_params.get("system") or optional_params.get("instructions"))
+        if isinstance(optional_params, dict)
+        else None
+    )
+    system_input: Final = dispatched_system or request_body.get("system") or request_body.get("instructions")
+    estimated_usage: Final = _estimate_dispatched_failure_usage(
+        model=str(model_call_details.get("model") or ""),
+        request_input=model_call_details.get("messages"),
+        system_input=system_input,
+    )
+    if estimated_usage is None:
+        return None
+    return estimated_usage, 0.0
+
+
 @dataclass(frozen=True)
 class _CallbackCapabilities:
     """Cached per-hook capability flags derived from ``litellm.callbacks``.
@@ -2190,15 +2304,19 @@ class ProxyLogging:
             if _first_handoff is not None:
                 request_data["first_api_call_start_time"] = _first_handoff
 
-            # A stream that broke mid-flight still billed the provider for the
-            # chunks already delivered; the streaming handler stashes that
-            # recovered usage and cost here. Lift them onto request_data so the
+            # Lift recovered partial-stream usage, or an estimated input-side
+            # usage for a dispatched failure, onto request_data so the
             # failure-path spend callbacks (which run after the logging object
-            # is popped) record the real partial spend instead of zero.
-            _recovered_usage: Final = _model_call_details.get("combined_usage_object")
-            if _recovered_usage is not None:
-                request_data["combined_usage_object"] = _recovered_usage
-                request_data["response_cost"] = _model_call_details.get("response_cost")
+            # is popped) record real token counts instead of zero.
+            _usage_to_lift: Final = _failure_usage_to_lift(
+                model_call_details=_model_call_details,
+                request_body=request_data,
+                dispatched=_first_handoff is not None,
+            )
+            if _usage_to_lift is not None:
+                _lifted_usage, _lifted_cost = _usage_to_lift
+                request_data["combined_usage_object"] = _lifted_usage
+                request_data["response_cost"] = _lifted_cost
 
         # Remove before callbacks iterate — not serialisable
         request_data.pop("litellm_logging_obj", None)
diff --git a/litellm/responses/streaming_iterator.py b/litellm/responses/streaming_iterator.py
index 25e5fcb6976..e678fba2852 100644
--- a/litellm/responses/streaming_iterator.py
+++ b/litellm/responses/streaming_iterator.py
@@ -20,7 +20,7 @@ from litellm.constants import (
     LITELLM_MAX_STREAMING_DURATION_SECONDS,
     STREAM_SSE_DONE_STRING,
 )
-from litellm.exceptions import MidStreamFallbackError
+from litellm.exceptions import MidStreamFallbackError, RateLimitError
 from litellm.litellm_core_utils.asyncify import run_async_function
 from litellm.litellm_core_utils.core_helpers import process_response_headers
 from litellm.litellm_core_utils.litellm_logging import Logging as LiteLLMLoggingObj
@@ -50,6 +50,16 @@ if TYPE_CHECKING:
     )
 
 
+class ProjectQuotaCallback(Protocol):
+    async def enforce_project_io_token_quota_for_frame(
+        self,
+        user_api_key_dict: UserAPIKeyAuth | None,
+        requested_model: str | None,
+        estimated_input_tokens: int,
+        estimated_output_tokens: int,
+    ) -> None: ...
+
+
 @lru_cache(maxsize=1)
 def _get_openai_response_types():
     from litellm.types.llms import openai as openai_types
@@ -1326,6 +1336,84 @@ def _build_synthetic_response_events(
 
 from litellm._logging import verbose_logger
 
+# Conservative per-frame output-token floor used when a response.create
+# frame omits max_output_tokens, so a project OTPM quota can't be bypassed
+# by simply never declaring an output cap.
+_FRAME_NO_MAX_OUTPUT_TOKENS_FLOOR: Final = 1024
+
+# Rough chars-per-token ratio for estimating a frame's input tokens without
+# resolving a real per-model tokenizer, matching the conservative estimate
+# the proxy's own rate limiter uses for the same purpose.
+_FRAME_CHARS_PER_TOKEN_ESTIMATE: Final = 4
+
+
+def _extract_frame_quota_estimate_inputs(msg_obj: Mapping[str, object]) -> tuple[int, int | None]:
+    """Extract a rough input-token count and any explicit max_output_tokens
+    from a ``response.create`` frame, handling both wire shapes:
+      flat:   {"type": "response.create", "input": ..., "max_output_tokens": ...}
+      nested: {"type": "response.create", "response": {"input": ..., "max_output_tokens": ...}}
+    """
+    nested: Final = msg_obj.get("response")
+    params: Final[Mapping[str, object]] = (
+        nested
+        if _is_json_object(nested) and nested
+        else MappingProxyType(  # mutable-ok: immediately frozen filtered frame
+            {k: v for k, v in msg_obj.items() if k != "type"}
+        )
+    )
+    text_parts: Final[list[str]] = []  # mutable-ok: local accumulator built in one pass, not shared
+    pending: Final[list[object]] = [  # mutable-ok: explicit worklist avoids recursion
+        params.get("input"),
+        params.get("instructions"),
+    ]
+    while pending:
+        value = pending.pop()
+        if isinstance(value, str):
+            text_parts.append(value)
+        elif _is_json_array(value):
+            for item in value:
+                if isinstance(item, str):
+                    text_parts.append(item)
+                elif _is_json_object(item):
+                    pending.append(item.get("content"))
+                    pending.append(item.get("text"))
+    total_chars: Final = sum(len(part) for part in text_parts)
+    estimated_input_tokens: Final = max(1, total_chars // _FRAME_CHARS_PER_TOKEN_ESTIMATE) if total_chars else 0
+
+    max_output_tokens: Final = params.get("max_output_tokens")
+    return estimated_input_tokens, max_output_tokens if isinstance(max_output_tokens, int) else None
+
+
+async def _enforce_frame_project_quota(
+    quota_callbacks: Sequence[ProjectQuotaCallback],
+    user_api_key_dict: UserAPIKeyAuth | None,
+    model: str | None,
+    raw_message: str,
+) -> None:
+    """Charge one response.create frame's estimated tokens against every
+    registered project ITPM/OTPM quota callback, in isolation from PII
+    masking / logging so a malformed frame still reaches those callbacks."""
+    if not quota_callbacks:
+        return
+    try:
+        msg_obj = json.loads(raw_message)
+    except (json.JSONDecodeError, TypeError):
+        return
+    if not _is_json_object(msg_obj) or msg_obj.get("type") != "response.create":
+        return
+    estimated_input_tokens, explicit_max_output_tokens = _extract_frame_quota_estimate_inputs(msg_obj)
+    estimated_output_tokens: Final = (
+        explicit_max_output_tokens if explicit_max_output_tokens is not None else _FRAME_NO_MAX_OUTPUT_TOKENS_FLOOR
+    )
+    for callback in quota_callbacks:
+        await callback.enforce_project_io_token_quota_for_frame(
+            user_api_key_dict=user_api_key_dict,
+            requested_model=model,
+            estimated_input_tokens=estimated_input_tokens,
+            estimated_output_tokens=estimated_output_tokens,
+        )
+
+
 RESPONSES_WS_LOGGED_EVENT_TYPES: Final = [
     "response.created",
     "response.completed",
@@ -1360,6 +1448,7 @@ class ResponsesWebSocketStreaming:
         first_message: str | None = None,
         guardrail_callbacks: list[Any] | None = None,
         output_guardrail_callbacks: list[PresidioGuardrailCallback] | None = None,
+        quota_callbacks: Sequence[ProjectQuotaCallback] | None = None,
         authorized_model: str | None = None,
     ):
         self.websocket = websocket
@@ -1372,6 +1461,7 @@ class ResponsesWebSocketStreaming:
         self.first_message = first_message
         self.guardrail_callbacks: list[Any] = guardrail_callbacks or []
         self.output_guardrail_callbacks: list[PresidioGuardrailCallback] = output_guardrail_callbacks or []
+        self.quota_callbacks: tuple[ProjectQuotaCallback, ...] = tuple(quota_callbacks) if quota_callbacks else ()
         # Model name authorized at connection time; enforced on every
         # response.create frame to prevent deployment-substitution attacks.
         self.authorized_model: str | None = authorized_model
@@ -1781,10 +1871,39 @@ class ResponsesWebSocketStreaming:
 
         return json.dumps(evt_obj) if modified else response_str
 
+    async def _enforce_or_reject_frame(self, message: str) -> bool:
+        """Run the per-frame project quota check.
+
+        On rejection, sends an ``error`` event to the client and reports that
+        the frame must be dropped instead of forwarded, so the connection
+        stays open for the client to retry once the window resets.
+        """
+        try:
+            await _enforce_frame_project_quota(
+                self.quota_callbacks, self.user_api_key_dict, self.authorized_model, message
+            )
+        except RateLimitError as e:
+            try:
+                await self.websocket.send_text(
+                    json.dumps(  # mutable-ok: WebSocket wire payload requires JSON objects
+                        {  # mutable-ok: WebSocket wire payload requires JSON objects
+                            "type": "error",
+                            "error": {  # mutable-ok: nested WebSocket error object
+                                "type": "rate_limit_exceeded",
+                                "message": str(e),
+                            },
+                        }
+                    )
+                )
+            except Exception:  # noqa: BLE001, S110  # client may already be gone
+                pass
+            return False
+        return True
+
     async def client_to_backend(self) -> None:
         """Forward response.create events from client to backend."""
         try:
-            if self.first_message is not None:
+            if self.first_message is not None and await self._enforce_or_reject_frame(self.first_message):
                 masked_first: Final = await self._mask_response_create(self.first_message)
                 self._store_input(masked_first)
                 self._store_event(masked_first)
@@ -1792,6 +1911,8 @@ class ResponsesWebSocketStreaming:
 
             while True:
                 message = await self.websocket.receive_text()
+                if not await self._enforce_or_reject_frame(message):
+                    continue
                 masked = await self._mask_response_create(message)
                 self._store_input(masked)
                 self._store_event(masked)
@@ -1871,6 +1992,7 @@ class ManagedResponsesWebSocketHandler:
         timeout: float | None = None,
         custom_llm_provider: str | None = None,
         first_message: str | None = None,
+        quota_callbacks: Sequence[ProjectQuotaCallback] | None = None,
         **kwargs: object,
     ) -> None:
         self.websocket = websocket
@@ -1887,6 +2009,7 @@ class ManagedResponsesWebSocketHandler:
         self.custom_llm_provider = custom_llm_provider
         self._connection_provider = self._resolve_provider(model) or custom_llm_provider
         self.first_message = first_message
+        self.quota_callbacks: tuple[ProjectQuotaCallback, ...] = tuple(quota_callbacks) if quota_callbacks else ()
         # Carry through safe pass-through kwargs (e.g. extra_headers)
         self.extra_kwargs: dict[str, object] = {k: v for k, v in kwargs.items() if k not in _MANAGED_WS_SKIP_KWARGS}
         # In-memory session history: response_id → full accumulated message list.
@@ -2292,6 +2415,14 @@ class ManagedResponsesWebSocketHandler:
                 verbose_logger.debug("ManagedResponsesWS: error sending warmup ack: %s", exc)
             return
 
+        try:
+            await _enforce_frame_project_quota(
+                self.quota_callbacks, self.user_api_key_dict, self.model_group or self.model, raw_message
+            )
+        except RateLimitError as e:
+            await self._send_error(str(e), error_type="rate_limit_exceeded")
+            return
+
         call_kwargs: Final = self._build_base_call_kwargs(msg_obj)
         call_kwargs["stream"] = True
 
diff --git a/litellm/router.py b/litellm/router.py
index c5881960c80..00c6c4c8b6f 100644
--- a/litellm/router.py
+++ b/litellm/router.py
@@ -8573,11 +8573,9 @@ class Router:
         Returns:
         - The added/updated deployment
         """
+        _deployment_model_id: Final = deployment.model_info.id or ""
+        _deployment_on_router: Final[Deployment | None] = self.get_deployment(model_id=_deployment_model_id)
         try:
-            # check if deployment already exists
-            _deployment_model_id: Final = deployment.model_info.id or ""
-
-            _deployment_on_router: Final[Deployment | None] = self.get_deployment(model_id=_deployment_model_id)
             if _deployment_on_router is not None:
                 # deployment with this model_id exists on the router
                 if (
@@ -8628,10 +8626,31 @@ class Router:
                     deployment.model_info.id,
                     e,
                 )
+                self._restore_deployment_after_failed_upsert(
+                    previous_deployment=_deployment_on_router, model_id=_deployment_model_id
+                )
                 return None
             else:
                 raise e
 
+    def _restore_deployment_after_failed_upsert(self, previous_deployment: Deployment | None, model_id: str) -> None:
+        if previous_deployment is None or self.has_model_id(model_id):
+            return
+        try:
+            self.add_deployment(deployment=previous_deployment)
+            verbose_router_logger.info(
+                "Restored deployment %s (id=%s); it keeps serving its previous configuration.",
+                previous_deployment.model_name,
+                model_id,
+            )
+        except Exception as restore_error:  # noqa: BLE001  # best-effort restore: a second failure must not abort the reload
+            verbose_router_logger.warning(
+                "Could not restore previously served deployment %s (id=%s) after the failed upsert: %s",
+                previous_deployment.model_name,
+                model_id,
+                restore_error,
+            )
+
     @staticmethod
     def _backend_cost_map_keys(model: str, custom_llm_provider: str | None) -> tuple[str, ...]:
         """The ``litellm.model_cost`` keys a deployment's shared backend info is registered under."""
@@ -11463,8 +11482,10 @@ class Router:
         deployment the strategy was registered from via its (model_name, tags)
         pair.
 
-        With tag filtering enabled, strategies that all carry real tags matching
-        none of the request's do not capture it when the name also has plain
+        With tag filtering enabled, router-wide or by the request's
+        enable_tag_filtering (which the proxy sets from key/team
+        router_settings), strategies that all carry real tags matching none of
+        the request's do not capture it when the name also has plain
         deployments: returning None hands the request to ordinary tag-aware
         deployment selection.
         """
@@ -11487,8 +11508,9 @@ class Router:
         for tagged in candidates:
             if "default" in tagged.tags:
                 return tagged
+        request_scoped_filtering: Final = request_kwargs.get("enable_tag_filtering") is True
         if (
-            self.enable_tag_filtering
+            (self.enable_tag_filtering or request_scoped_filtering)
             and all(tagged.tags for tagged in candidates)
             and self._model_name_has_plain_deployments(model)
         ):
diff --git a/litellm/router_utils/fallback_event_handlers.py b/litellm/router_utils/fallback_event_handlers.py
index 63bc5203417..3c9a4097321 100644
--- a/litellm/router_utils/fallback_event_handlers.py
+++ b/litellm/router_utils/fallback_event_handlers.py
@@ -253,6 +253,7 @@ def get_fallback_model_group(fallbacks: list[Any], model_group: str) -> tuple[li
 
 
 PROVIDER_SCOPED_RESOURCE_KEYS: Final = ("input_file_id", "training_file")
+PROVIDER_SCOPED_CREATION_FUNCTION_NAMES: Final = frozenset({"_acreate_file"})
 
 
 def _get_fallback_target_model_group(fallback_entry: str | Mapping[str, object]) -> str | None:
@@ -274,6 +275,18 @@ def references_provider_scoped_resource(kwargs: Mapping[str, object]) -> bool:
     return any(kwargs.get(key) for key in PROVIDER_SCOPED_RESOURCE_KEYS)
 
 
+def creates_provider_scoped_resource(kwargs: Mapping[str, object]) -> bool:
+    """
+    True when the request creates a resource that will live under one provider's credentials.
+
+    A file uploaded for batches or fine-tuning is stored in the account of the deployment
+    that handled it, and its id is only usable against the model group the caller named.
+    Letting the upload fall back to a different model group silently stores the file with
+    the wrong provider, and every later use of the returned id fails.
+    """
+    return getattr(kwargs.get("original_function"), "__name__", None) in PROVIDER_SCOPED_CREATION_FUNCTION_NAMES
+
+
 async def run_async_fallback(
     *args: tuple[Any],
     litellm_router: LitellmRouter,
@@ -322,7 +335,9 @@ async def run_async_fallback(
     metadata_variable_name: Final = _get_router_metadata_variable_name(
         function_name=getattr(kwargs.get("original_function"), "__name__", None)
     )
-    same_model_group_only: Final = references_provider_scoped_resource(kwargs)
+    same_model_group_only: Final = references_provider_scoped_resource(kwargs) or creates_provider_scoped_resource(
+        kwargs
+    )
     # Read out of kwargs and narrowed here rather than declared as a parameter: every caller
     # reaches this function by spreading a loosely-typed kwargs dict, so a declared parameter
     # would carry an annotation that no call site can actually be checked against.
diff --git a/litellm/types/mcp_server/mcp_server_manager.py b/litellm/types/mcp_server/mcp_server_manager.py
index aeeeca21d3b..d09503cdc4d 100644
--- a/litellm/types/mcp_server/mcp_server_manager.py
+++ b/litellm/types/mcp_server/mcp_server_manager.py
@@ -224,6 +224,14 @@ class MCPServer(BaseModel):
         JWT) but forwards the caller's separate upstream ``Authorization`` unchanged, minting nothing."""
         return self.auth_type == MCPAuth.oauth_delegate
 
+    @property
+    def is_client_forwarded_token(self) -> bool:
+        """True for the two modes whose upstream credential is the caller's own bearer, forwarded
+        unchanged: the gateway mints nothing for them and holds no OAuth client identity, so a
+        discovered ``authorization_url`` / ``token_url`` enriches only the gateway's own OAuth front
+        door and is never a precondition for opening a session."""
+        return self.is_true_passthrough or self.is_oauth_delegate
+
     @property
     def is_dcr_bridge(self) -> bool:
         """True when this client-forwarded-token server serves the gateway-hosted DCR front door
@@ -231,7 +239,7 @@ class MCPServer(BaseModel):
         authorize, and token relays) instead of relaying the upstream's own OAuth discovery
         verbatim. ``dcr_bridge`` is rejected on every other auth type at create, update, and
         config load, so the mode gate here only defends rows edited outside those paths."""
-        return bool(self.dcr_bridge) and (self.is_true_passthrough or self.is_oauth_delegate)
+        return bool(self.dcr_bridge) and self.is_client_forwarded_token
 
     @property
     def requires_per_user_auth(self) -> bool:
@@ -248,7 +256,7 @@ class MCPServer(BaseModel):
         if self.needs_user_oauth_token:
             return True
 
-        if self.is_true_passthrough or self.is_oauth_delegate:
+        if self.is_client_forwarded_token:
             return True
 
         # PAT passthrough: auth_type is none but extra_headers includes auth headers
diff --git a/litellm/types/utils.py b/litellm/types/utils.py
index 6f6f317b257..5b925e610e7 100644
--- a/litellm/types/utils.py
+++ b/litellm/types/utils.py
@@ -1631,8 +1631,20 @@ class PromptTokensDetailsWrapper(
 
     def __init__(self, *args, **kwargs) -> None:
         super().__init__(*args, **kwargs)
+        extra_fields: Final = self.model_extra
+        nested_cache_creation_input_tokens: Final = (
+            extra_fields.get("cache_creation_input_tokens") if extra_fields is not None else None
+        )
         self.cache_write_tokens = (
-            self.cache_write_tokens if self.cache_write_tokens is not None else self.cache_creation_tokens
+            self.cache_write_tokens
+            if self.cache_write_tokens is not None
+            else (
+                self.cache_creation_tokens
+                if self.cache_creation_tokens is not None
+                else (
+                    nested_cache_creation_input_tokens if isinstance(nested_cache_creation_input_tokens, int) else None
+                )
+            )
         )
         if self.character_count is None:
             del self.character_count
diff --git a/litellm/utils.py b/litellm/utils.py
index 1c880ee9521..a7b70c4129a 100644
--- a/litellm/utils.py
+++ b/litellm/utils.py
@@ -65,6 +65,7 @@ from litellm.constants import (
     DEFAULT_EMBEDDING_PARAM_VALUES,
     DEFAULT_MAX_LRU_CACHE_SIZE,
     DEFAULT_MINIMUM_PROMPT_CACHE_TOKEN_COUNT,
+    DEFAULT_REASONING_EFFORT_MEDIUM_THINKING_BUDGET,
     DEFAULT_TRIM_RATIO,
     FUNCTION_DEFINITION_TOKEN_COUNT,
     INITIAL_RETRY_DELAY,
@@ -7638,12 +7639,20 @@ def validate_and_fix_openai_tools(tools: list | None) -> list[dict] | None:
 
 
 def validate_and_fix_thinking_param(
-    thinking: AnthropicThinkingParam | None,
+    thinking: AnthropicThinkingParam | bool | None,
 ) -> AnthropicThinkingParam | None:
     """
-    Normalizes camelCase keys in the thinking param to snake_case.
+    Coerces bool thinking values (True becomes enabled with the default medium budget, False becomes None)
+    and normalizes camelCase keys in the thinking param to snake_case.
     Handles clients that send budgetTokens instead of budget_tokens.
     """
+    if thinking is True:
+        return cast(
+            "AnthropicThinkingParam",
+            {"type": "enabled", "budget_tokens": DEFAULT_REASONING_EFFORT_MEDIUM_THINKING_BUDGET},
+        )
+    if thinking is False:
+        return None
     if thinking is None or not isinstance(thinking, dict):
         return thinking
     normalized: Final = dict(thinking)
diff --git a/model_prices_and_context_window.json b/model_prices_and_context_window.json
index 409022016b0..07f9027313b 100644
--- a/model_prices_and_context_window.json
+++ b/model_prices_and_context_window.json
@@ -14456,6 +14456,25 @@
         "supports_tool_choice": true,
         "supports_output_config": true
     },
+    "databricks/databricks-claude-opus-4-6": {
+        "input_cost_per_token": 5.00003e-06,
+        "input_dbu_cost_per_token": 7.1429e-05,
+        "litellm_provider": "databricks",
+        "max_input_tokens": 1000000,
+        "max_output_tokens": 128000,
+        "max_tokens": 128000,
+        "metadata": {
+            "notes": "Input/output cost per token is dbu cost * $0.070. Number provided for reference, '*_dbu_cost_per_token' used in actual calculation."
+        },
+        "mode": "chat",
+        "output_cost_per_token": 2.5000010000000002e-05,
+        "output_dbu_cost_per_token": 0.000357143,
+        "source": "https://www.databricks.com/product/pricing/proprietary-foundation-model-serving",
+        "supports_assistant_prefill": true,
+        "supports_function_calling": true,
+        "supports_reasoning": true,
+        "supports_tool_choice": true
+    },
     "databricks/databricks-claude-sonnet-4": {
         "input_cost_per_token": 2.9999900000000002e-06,
         "input_dbu_cost_per_token": 4.2857e-05,
@@ -14513,6 +14532,25 @@
         "supports_reasoning": true,
         "supports_tool_choice": true
     },
+    "databricks/databricks-claude-sonnet-4-6": {
+        "input_cost_per_token": 2.9999900000000002e-06,
+        "input_dbu_cost_per_token": 4.2857e-05,
+        "litellm_provider": "databricks",
+        "max_input_tokens": 1000000,
+        "max_output_tokens": 64000,
+        "max_tokens": 64000,
+        "metadata": {
+            "notes": "Input/output cost per token is dbu cost * $0.070. Number provided for reference, '*_dbu_cost_per_token' used in actual calculation."
+        },
+        "mode": "chat",
+        "output_cost_per_token": 1.5000020000000002e-05,
+        "output_dbu_cost_per_token": 0.000214286,
+        "source": "https://www.databricks.com/product/pricing/proprietary-foundation-model-serving",
+        "supports_assistant_prefill": true,
+        "supports_function_calling": true,
+        "supports_reasoning": true,
+        "supports_tool_choice": true
+    },
     "databricks/databricks-gemini-2-5-flash": {
         "input_cost_per_token": 3.0001999999999996e-07,
         "input_dbu_cost_per_token": 4.285999999999999e-06,
@@ -14547,6 +14585,74 @@
         "supports_function_calling": true,
         "supports_tool_choice": true
     },
+    "databricks/databricks-gemini-3-1-flash-lite": {
+        "input_cost_per_token": 3.1248e-07,
+        "input_dbu_cost_per_token": 4.464e-06,
+        "litellm_provider": "databricks",
+        "max_input_tokens": 1048576,
+        "max_output_tokens": 65536,
+        "max_tokens": 65536,
+        "metadata": {
+            "notes": "Input/output cost per token is dbu cost * $0.070. Number provided for reference, '*_dbu_cost_per_token' used in actual calculation."
+        },
+        "mode": "chat",
+        "output_cost_per_token": 1.87502e-06,
+        "output_dbu_cost_per_token": 2.6786e-05,
+        "source": "https://www.databricks.com/product/pricing/proprietary-foundation-model-serving",
+        "supports_function_calling": true,
+        "supports_tool_choice": true
+    },
+    "databricks/databricks-gemini-3-1-pro": {
+        "input_cost_per_token": 2.49998e-06,
+        "input_dbu_cost_per_token": 3.5714e-05,
+        "litellm_provider": "databricks",
+        "max_input_tokens": 1048576,
+        "max_output_tokens": 65536,
+        "max_tokens": 65536,
+        "metadata": {
+            "notes": "Input/output cost per token is dbu cost * $0.070. Number provided for reference, '*_dbu_cost_per_token' used in actual calculation."
+        },
+        "mode": "chat",
+        "output_cost_per_token": 1.5000020000000002e-05,
+        "output_dbu_cost_per_token": 0.000214286,
+        "source": "https://www.databricks.com/product/pricing/proprietary-foundation-model-serving",
+        "supports_function_calling": true,
+        "supports_tool_choice": true
+    },
+    "databricks/databricks-gemini-3-flash": {
+        "input_cost_per_token": 6.2503e-07,
+        "input_dbu_cost_per_token": 8.929e-06,
+        "litellm_provider": "databricks",
+        "max_input_tokens": 1048576,
+        "max_output_tokens": 65536,
+        "max_tokens": 65536,
+        "metadata": {
+            "notes": "Input/output cost per token is dbu cost * $0.070. Number provided for reference, '*_dbu_cost_per_token' used in actual calculation."
+        },
+        "mode": "chat",
+        "output_cost_per_token": 3.74997e-06,
+        "output_dbu_cost_per_token": 5.3571e-05,
+        "source": "https://www.databricks.com/product/pricing/proprietary-foundation-model-serving",
+        "supports_function_calling": true,
+        "supports_tool_choice": true
+    },
+    "databricks/databricks-gemini-3-pro": {
+        "input_cost_per_token": 2.49998e-06,
+        "input_dbu_cost_per_token": 3.5714e-05,
+        "litellm_provider": "databricks",
+        "max_input_tokens": 1048576,
+        "max_output_tokens": 65536,
+        "max_tokens": 65536,
+        "metadata": {
+            "notes": "Input/output cost per token is dbu cost * $0.070. Number provided for reference, '*_dbu_cost_per_token' used in actual calculation."
+        },
+        "mode": "chat",
+        "output_cost_per_token": 1.5000020000000002e-05,
+        "output_dbu_cost_per_token": 0.000214286,
+        "source": "https://www.databricks.com/product/pricing/proprietary-foundation-model-serving",
+        "supports_function_calling": true,
+        "supports_tool_choice": true
+    },
     "databricks/databricks-gemma-3-12b": {
         "input_cost_per_token": 1.5000999999999998e-07,
         "input_dbu_cost_per_token": 2.1429999999999996e-06,
@@ -14592,6 +14698,126 @@
         "output_dbu_cost_per_token": 0.000142857,
         "source": "https://www.databricks.com/product/pricing/proprietary-foundation-model-serving"
     },
+    "databricks/databricks-gpt-5-1-codex-max": {
+        "input_cost_per_token": 1.24999e-06,
+        "input_dbu_cost_per_token": 1.7857e-05,
+        "litellm_provider": "databricks",
+        "max_input_tokens": 272000,
+        "max_output_tokens": 128000,
+        "max_tokens": 128000,
+        "metadata": {
+            "notes": "Input/output cost per token is dbu cost * $0.070. Number provided for reference, '*_dbu_cost_per_token' used in actual calculation."
+        },
+        "mode": "chat",
+        "output_cost_per_token": 9.999990000000002e-06,
+        "output_dbu_cost_per_token": 0.000142857,
+        "source": "https://www.databricks.com/product/pricing/proprietary-foundation-model-serving"
+    },
+    "databricks/databricks-gpt-5-1-codex-mini": {
+        "input_cost_per_token": 2.4997e-07,
+        "input_dbu_cost_per_token": 3.571e-06,
+        "litellm_provider": "databricks",
+        "max_input_tokens": 272000,
+        "max_output_tokens": 128000,
+        "max_tokens": 128000,
+        "metadata": {
+            "notes": "Input/output cost per token is dbu cost * $0.070. Number provided for reference, '*_dbu_cost_per_token' used in actual calculation."
+        },
+        "mode": "chat",
+        "output_cost_per_token": 1.99997e-06,
+        "output_dbu_cost_per_token": 2.8571e-05,
+        "source": "https://www.databricks.com/product/pricing/proprietary-foundation-model-serving"
+    },
+    "databricks/databricks-gpt-5-2": {
+        "input_cost_per_token": 1.75e-06,
+        "input_dbu_cost_per_token": 2.5e-05,
+        "litellm_provider": "databricks",
+        "max_input_tokens": 272000,
+        "max_output_tokens": 128000,
+        "max_tokens": 128000,
+        "metadata": {
+            "notes": "Input/output cost per token is dbu cost * $0.070. Number provided for reference, '*_dbu_cost_per_token' used in actual calculation."
+        },
+        "mode": "chat",
+        "output_cost_per_token": 1.4e-05,
+        "output_dbu_cost_per_token": 0.0002,
+        "source": "https://www.databricks.com/product/pricing/proprietary-foundation-model-serving"
+    },
+    "databricks/databricks-gpt-5-2-codex": {
+        "input_cost_per_token": 1.75e-06,
+        "input_dbu_cost_per_token": 2.5e-05,
+        "litellm_provider": "databricks",
+        "max_input_tokens": 272000,
+        "max_output_tokens": 128000,
+        "max_tokens": 128000,
+        "metadata": {
+            "notes": "Input/output cost per token is dbu cost * $0.070. Number provided for reference, '*_dbu_cost_per_token' used in actual calculation."
+        },
+        "mode": "chat",
+        "output_cost_per_token": 1.4e-05,
+        "output_dbu_cost_per_token": 0.0002,
+        "source": "https://www.databricks.com/product/pricing/proprietary-foundation-model-serving"
+    },
+    "databricks/databricks-gpt-5-3-codex": {
+        "input_cost_per_token": 1.75e-06,
+        "input_dbu_cost_per_token": 2.5e-05,
+        "litellm_provider": "databricks",
+        "max_input_tokens": 272000,
+        "max_output_tokens": 128000,
+        "max_tokens": 128000,
+        "metadata": {
+            "notes": "Input/output cost per token is dbu cost * $0.070. Number provided for reference, '*_dbu_cost_per_token' used in actual calculation."
+        },
+        "mode": "chat",
+        "output_cost_per_token": 1.4e-05,
+        "output_dbu_cost_per_token": 0.0002,
+        "source": "https://www.databricks.com/product/pricing/proprietary-foundation-model-serving"
+    },
+    "databricks/databricks-gpt-5-4": {
+        "input_cost_per_token": 2.49998e-06,
+        "input_dbu_cost_per_token": 3.5714e-05,
+        "litellm_provider": "databricks",
+        "max_input_tokens": 272000,
+        "max_output_tokens": 128000,
+        "max_tokens": 128000,
+        "metadata": {
+            "notes": "Input/output cost per token is dbu cost * $0.070. Number provided for reference, '*_dbu_cost_per_token' used in actual calculation."
+        },
+        "mode": "chat",
+        "output_cost_per_token": 1.5000020000000002e-05,
+        "output_dbu_cost_per_token": 0.000214286,
+        "source": "https://www.databricks.com/product/pricing/proprietary-foundation-model-serving"
+    },
+    "databricks/databricks-gpt-5-4-mini": {
+        "input_cost_per_token": 7.4998e-07,
+        "input_dbu_cost_per_token": 1.0714e-05,
+        "litellm_provider": "databricks",
+        "max_input_tokens": 272000,
+        "max_output_tokens": 128000,
+        "max_tokens": 128000,
+        "metadata": {
+            "notes": "Input/output cost per token is dbu cost * $0.070. Number provided for reference, '*_dbu_cost_per_token' used in actual calculation."
+        },
+        "mode": "chat",
+        "output_cost_per_token": 4.50002e-06,
+        "output_dbu_cost_per_token": 6.4286e-05,
+        "source": "https://www.databricks.com/product/pricing/proprietary-foundation-model-serving"
+    },
+    "databricks/databricks-gpt-5-4-nano": {
+        "input_cost_per_token": 1.9999e-07,
+        "input_dbu_cost_per_token": 2.857e-06,
+        "litellm_provider": "databricks",
+        "max_input_tokens": 272000,
+        "max_output_tokens": 128000,
+        "max_tokens": 128000,
+        "metadata": {
+            "notes": "Input/output cost per token is dbu cost * $0.070. Number provided for reference, '*_dbu_cost_per_token' used in actual calculation."
+        },
+        "mode": "chat",
+        "output_cost_per_token": 1.24999e-06,
+        "output_dbu_cost_per_token": 1.7857e-05,
+        "source": "https://www.databricks.com/product/pricing/proprietary-foundation-model-serving"
+    },
     "databricks/databricks-gpt-5-mini": {
         "input_cost_per_token": 2.4997000000000006e-07,
         "input_dbu_cost_per_token": 3.571e-06,
diff --git a/pyproject.toml b/pyproject.toml
index 275343ccef6..ffbc96eefb9 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "litellm"
-version = "1.98.0"
+version = "1.99.0"
 description = "Library to easily interface with LLM API providers"
 readme = "README.md"
 requires-python = ">=3.10, <3.15"
@@ -67,8 +67,8 @@ proxy = [
     "azure-identity>=1.25.2,<2.0",
     "azure-storage-blob>=12.28.0,<13.0",
     "mcp>=1.28.1,<2.0",
-    "litellm-proxy-extras==0.4.86",
-    "litellm-enterprise==0.1.56",
+    "litellm-proxy-extras==0.4.87",
+    "litellm-enterprise==0.1.57",
     "RestrictedPython>=8.1,<9.0",
     "rich>=13.9.4,<14.0",
     "InquirerPy>=0.3.4,<1.0",
@@ -306,7 +306,7 @@ members = ["enterprise", "litellm-proxy-extras"]
 profile = "black"
 
 [tool.commitizen]
-version = "1.98.0"
+version = "1.99.0"
 version_files = [
     "pyproject.toml:^version",
 ]
diff --git a/ruff-strict-budget.json b/ruff-strict-budget.json
index 6882479a344..096e039b8aa 100644
--- a/ruff-strict-budget.json
+++ b/ruff-strict-budget.json
@@ -12,7 +12,7 @@
     "limit": 2017
   },
   "ANN202": {
-    "limit": 855
+    "limit": 854
   },
   "ANN204": {
     "limit": 711
diff --git a/tests/batches_tests/test_batch_rate_limits.py b/tests/batches_tests/test_batch_rate_limits.py
index 0baff6c17be..bb41c1137da 100644
--- a/tests/batches_tests/test_batch_rate_limits.py
+++ b/tests/batches_tests/test_batch_rate_limits.py
@@ -27,6 +27,16 @@ from litellm.proxy.hooks.parallel_request_limiter_v3 import (
 from litellm.proxy.utils import InternalUsageCache
 
 
+def _build_batch_limiter() -> _PROXY_BatchRateLimiter:
+    internal_usage_cache = InternalUsageCache(dual_cache=DualCache())
+    return _PROXY_BatchRateLimiter(
+        internal_usage_cache=internal_usage_cache,
+        parallel_request_limiter=_PROXY_MaxParallelRequestsHandler_v3(
+            internal_usage_cache=internal_usage_cache
+        ),
+    )
+
+
 def get_expected_batch_file_usage(file_path: str) -> tuple[int, int]:
     """
     Helper function to calculate expected request count and token count from a batch JSONL file.
@@ -69,10 +79,7 @@ async def test_batch_rate_limits():
     """
     litellm._turn_on_debug()
     CUSTOM_LLM_PROVIDER = "openai"
-    BATCH_LIMITER = _PROXY_BatchRateLimiter(
-        internal_usage_cache=None,
-        parallel_request_limiter=None,
-    )
+    BATCH_LIMITER = _build_batch_limiter()
 
     file_name = "openai_batch_completions.jsonl"
     _current_dir = os.path.dirname(os.path.abspath(__file__))
@@ -580,10 +587,7 @@ async def test_batch_rate_limiter_without_user_context(tmp_path):
     CUSTOM_LLM_PROVIDER = "openai"
 
     # Setup
-    BATCH_LIMITER = _PROXY_BatchRateLimiter(
-        internal_usage_cache=None,
-        parallel_request_limiter=None,
-    )
+    BATCH_LIMITER = _build_batch_limiter()
 
     # Create a simple batch file
     batch_content = """{"custom_id": "request-1", "method": "POST", "url": "/v1/chat/completions", "body": {"model": "gpt-3.5-turbo", "messages": [{"role": "user", "content": "Hello"}]}}"""
diff --git a/tests/e2e/coverage_registry/reliability.yaml b/tests/e2e/coverage_registry/reliability.yaml
index ebbfd3415a5..b50551ec105 100644
--- a/tests/e2e/coverage_registry/reliability.yaml
+++ b/tests/e2e/coverage_registry/reliability.yaml
@@ -18,6 +18,16 @@
 - {id: reliability.routing.usage_based.picks_under_tpm, module: reliability, tier: P0, behavior: routing, variant: usage_based, assertions: [picks_under_tpm], exercised_on: [chat_completions, messages], source: "router_strategy/lowest_tpm_rpm_v2.py", rationale: "Routes to lowest-TPM deployment; prevents over-allocation"}
 - {id: reliability.routing.least_busy.picks_lowest_traffic, module: reliability, tier: P1, behavior: routing, variant: least_busy, assertions: [picks_lowest_traffic], exercised_on: [chat_completions, messages], source: "router_strategy/least_busy.py", rationale: "Fewest in-flight requests"}
 - {id: reliability.routing.complexity_llm_classifier.routes_by_llm_tier, module: reliability, tier: P1, behavior: routing, variant: complexity_llm_classifier, assertions: [routes_by_llm_tier], exercised_on: [chat_completions], source: "router_strategy/complexity_router/complexity_router.py", fail_before_fix: proven, rationale: "v2 auto-router LLM complexity classifier runs over the proxy and routes by semantic tier instead of silently crashing on absent litellm_metadata and falling back to heuristic scoring"}
+- {id: reliability.routing.tagged_marker.request_tag_selects_marker, module: reliability, tier: P0, behavior: routing, variant: tagged_marker, assertions: [request_tag_selects_marker], exercised_on: [chat_completions], source: "litellm/router.py:11445", rationale: "Tagged request selects the tagged strategy marker under a shared model_name instead of the plain deployment registered first (GitHub issue #36619)"}
+- {id: reliability.routing.tagged_marker.untagged_request_served_by_plain_deployment, module: reliability, tier: P0, behavior: routing, variant: tagged_marker, assertions: [untagged_request_served_by_plain_deployment], exercised_on: [chat_completions, messages, responses], source: "litellm/router.py:11445", rationale: "Untagged requests to a shared model_name are served by the plain deployment on every call, never captured or errored by the tagged marker (GitHub issue #36620)"}
+- {id: reliability.routing.tagged_marker.header_tag_selects_marker, module: reliability, tier: P0, behavior: routing, variant: tagged_marker, assertions: [header_tag_selects_marker], exercised_on: [messages], source: "litellm/router.py:11445", rationale: "A request tagged only via the x-litellm-tags header selects the tagged marker on Anthropic-native /v1/messages (GitHub issue #36621)"}
+- {id: reliability.routing.tagged_marker.untagged_tier_deployments_still_served, module: reliability, tier: P1, behavior: routing, variant: tagged_marker, assertions: [untagged_tier_deployments_still_served], exercised_on: [chat_completions, messages], source: "litellm/router_strategy/tag_based_routing.py:433", rationale: "Routing tags the marker consumed no longer constrain deployment selection inside the routed tier group, so untagged tier deployments serve the rewrite (GitHub issue #36621)"}
+- {id: reliability.routing.tagged_marker.tag_semantics_stay_strict, module: reliability, tier: P1, behavior: routing, variant: tagged_marker, assertions: [tag_semantics_stay_strict], exercised_on: [chat_completions], source: "litellm/router_strategy/tag_based_routing.py:299", rationale: "Tag consumption must not loosen strict semantics: a tagged call aimed straight at an untagged deployment still gets the 401 tags-configuration denial"}
+- {id: reliability.routing.tagged_marker.responses_input_routes_through_marker, module: reliability, tier: P0, behavior: routing, variant: tagged_marker, assertions: [responses_input_routes_through_marker], exercised_on: [responses], source: "litellm/router.py:11489", rationale: "Tagged /v1/responses (header or litellm_metadata.tags, string or list input) routes through the marker to its tier, extending the GitHub issues #36620/#36621 tag split to the Responses surface"}
+- {id: reliability.routing.tagged_marker.alias_connection_params_stay_with_tier, module: reliability, tier: P0, behavior: routing, variant: tagged_marker, assertions: [alias_connection_params_stay_with_tier], exercised_on: [chat_completions], source: "litellm/router.py:11567", rationale: "An api_key or api_base on the marker alias is never forwarded onto the routed request; the tier deployment calls its provider with its own credential (GitHub PR #36626)"}
+- {id: reliability.routing.semantic_auto_router.responses_input_routed, module: reliability, tier: P0, behavior: routing, variant: semantic_auto_router, assertions: [responses_input_routed], exercised_on: [responses], source: "litellm/router_strategy/auto_router/auto_router.py:131", fail_before_fix: proven, rationale: "/v1/responses input is resolved into messages for the semantic auto-router pre-routing hook instead of failing 400 Unmapped LLM provider auto_router (GitHub PR #37333)"}
+- {id: reliability.routing.strategy_alias.custom_pricing_ignored, module: reliability, tier: P1, behavior: routing, variant: strategy_alias, assertions: [custom_pricing_ignored], exercised_on: [chat_completions], source: "litellm/router.py:11489", rationale: "Custom pricing on a strategy-router alias never prices the routed request; spend logs at the routed tier deployment's own rate (GitHub PR #36691)"}
+- {id: reliability.routing.complexity_heuristic.scores_current_ask_only, module: reliability, tier: P1, behavior: routing, variant: complexity_heuristic, assertions: [scores_current_ask_only], exercised_on: [chat_completions], source: "router_strategy/complexity_router/complexity_router.py:942", rationale: "The heuristic complexity classifier scores the caller's current ask only, so a keyword-heavy agent system prompt cannot inflate the tier (GitHub PR #36721)"}
 - {id: reliability.cache.exact.returns_cached, module: reliability, tier: P1, behavior: cache, variant: exact, assertions: [returns_cached], exercised_on: [chat_completions, messages, embeddings], source: "litellm/caching/caching.py", rationale: "Response cache returns cached on exact match"}
 - {id: reliability.cache.prompt_caching_model_select.returns_cached, module: reliability, tier: P1, behavior: cache, variant: prompt_caching_model_select, assertions: [returns_cached], exercised_on: [chat_completions], source: "router_utils/prompt_caching_cache.py", rationale: "Selects model supporting prompt caching for cacheable prefix"}
 - {id: reliability.circuit_breaker.redis.trips_then_recovers, module: reliability, tier: P0, behavior: circuit_breaker, variant: redis, assertions: [trips_then_recovers], exercised_on: [chat_completions, messages, embeddings], source: "litellm/caching/redis_cache.py:99", rationale: "Redis breaker CLOSED->OPEN->HALF_OPEN; guards all cache/rate-limit ops"}
diff --git a/tests/e2e/e2e_http.py b/tests/e2e/e2e_http.py
index f4db88b1e19..cb6fc7a01e5 100644
--- a/tests/e2e/e2e_http.py
+++ b/tests/e2e/e2e_http.py
@@ -75,6 +75,8 @@ class NetworkError(BaseModel):
 
 class UnauthorizedError(BaseModel):
     kind: Literal["unauthorized"] = "unauthorized"
+    # litellm 401s for key auth, model access, and tag routing alike, so keep the body to tell them apart.
+    body: str = ""
 
 
 class RateLimitedError(BaseModel):
@@ -289,7 +291,7 @@ def _classify[R: BaseModel](
     resp: requests.Response, response_type: type[R]
 ) -> Result[R]:
     if resp.status_code == 401:
-        return UnauthorizedError()
+        return UnauthorizedError(body=resp.text)
     if resp.status_code == 429:
         return RateLimitedError(body=resp.text)
     if not resp.ok:
diff --git a/tests/e2e/models.py b/tests/e2e/models.py
index 734e63a94e6..df5cb841fad 100644
--- a/tests/e2e/models.py
+++ b/tests/e2e/models.py
@@ -73,6 +73,7 @@ class KeyGenerateBody(BaseModel):
     allowed_passthrough_routes: list[str] | None = None
     metadata: KeyMetadata | None = None
     object_permission: ObjectPermission | None = None
+    router_settings: "RouterSettingsOverride | None" = None
 
 
 class KeyGenerateResponse(BaseModel):
@@ -234,16 +235,18 @@ class ChatBody(BaseModel):
 
 
 class RouterSettingsOverride(BaseModel):
-    """Per-request `router_settings_override` in a /chat/completions body: the
-    reliability knobs (fallbacks by trigger, retry count) the reliability suite
-    drives per call instead of via static router config. Serialized exclude_none, so
-    an override sets only the strategies a test exercises. Each fallbacks map is
-    model_name -> the ordered fallback model_names to try."""
+    """Router settings a test scopes below the global config: sent per request as
+    `router_settings_override` in a /chat/completions body (the reliability suite's
+    fallback and retry knobs) or stored on a key as `router_settings` at
+    /key/generate (the auto-router suite's tag filtering switch). Serialized
+    exclude_none, so an override sets only the knobs a test exercises. Each
+    fallbacks map is model_name -> the ordered fallback model_names to try."""
 
     fallbacks: list[dict[str, list[str]]] | None = None
     context_window_fallbacks: list[dict[str, list[str]]] | None = None
     content_policy_fallbacks: list[dict[str, list[str]]] | None = None
     num_retries: int | None = None
+    enable_tag_filtering: bool | None = None
 
 
 class ReliabilityChatBody(ChatBody):
@@ -744,6 +747,10 @@ class LiteLLMParamsBody(BaseModel):
     extra_headers: dict[str, str] | None = None
     use_in_pass_through: bool | None = None
     complexity_router_config: dict[str, object] | None = None
+    auto_router_config: str | None = None
+    auto_router_default_model: str | None = None
+    auto_router_embedding_model: str | None = None
+    tags: list[str] | None = None
     mock_response: str | None = None
     timeout: float | None = None
     tpm: int | None = None
diff --git a/tests/e2e/router/test_auto_router_regressions_e2e.py b/tests/e2e/router/test_auto_router_regressions_e2e.py
new file mode 100644
index 00000000000..35ba2c8d3d1
--- /dev/null
+++ b/tests/e2e/router/test_auto_router_regressions_e2e.py
@@ -0,0 +1,620 @@
+"""Live e2e regression pins for strategy-router (auto-router) routing.
+
+A strategy marker (an ``auto_router/complexity_router`` deployment) and a plain
+deployment can share one ``model_name``, split by tags once
+``enable_tag_filtering`` is on: tagged requests route through the marker to its
+tier models, untagged requests go to the plain deployment. That split, and the
+strategy-router alias behaviors around it, regressed repeatedly; each test here
+pins one fixed behavior:
+
+- GitHub issue #36619: a tagged request selects the tagged marker under a
+  shared name even when a plain deployment was registered first.
+- GitHub issue #36620: untagged requests keep being served by the plain
+  deployment on every call, never captured or 400'd by the tagged marker.
+- GitHub issue #36621: a request tagged via the ``x-litellm-tags`` header
+  routes through the marker even when the tier deployments carry no tags
+  (the marker consumes the routing tags before deployment selection), while a
+  tagged call aimed straight at an untagged deployment stays denied.
+- GitHub issues #36620/#36621 on /v1/responses: the same tag split holds for
+  string and list input, whether the tag arrives in litellm_metadata or the
+  x-litellm-tags header.
+- GitHub PR #37333: /v1/responses input is resolved into messages for a
+  semantic ``auto_router`` deployment's pre-routing hook; such requests used
+  to fail with 400 "Unmapped LLM provider auto_router" because only chat
+  messages fed the route matcher.
+- GitHub PR #36691: custom pricing on the marker alias never prices the routed
+  request; spend logs at the routed tier deployment's own rate.
+- GitHub PR #36721: the heuristic complexity classifier scores the caller's
+  current ask only, so a large agent system prompt cannot inflate the tier.
+- GitHub PR #36626: connection params on the marker alias (``api_key``,
+  ``api_base``) stay with the alias; the routed tier calls its provider with
+  its own credentials.
+
+Every deployment is registered via /model/new (stage has no static config for
+these) and ``enable_tag_filtering`` is enabled through key-level
+``router_settings`` on the keys the tag tests mint, so the switch rides only
+this module's own requests and the rest of the suite is never filtered.
+The served deployment is always read back from the spend log's ``model``,
+which stores either the registered alias or the provider-prefixed form.
+"""
+
+import json
+import os
+from collections.abc import Iterator
+from dataclasses import dataclass
+from typing import Final
+
+import pytest
+from pydantic import BaseModel, ConfigDict, Field
+
+from e2e_config import unique_marker
+from e2e_http import AnthropicHeaders, AuthHeaders, UnauthorizedError, unwrap
+from lifecycle import ResourceManager
+from models import (
+    AnthropicMessagesBody,
+    AnthropicMessagesResponse,
+    ChatBody,
+    ChatMessage,
+    ChatMetadata,
+    KeyGenerateBody,
+    LiteLLMParamsBody,
+    RouterSettingsOverride,
+    SpendLogRow,
+)
+from proxy_client import ProxyClient
+
+pytestmark = pytest.mark.e2e
+
+PLAIN_MODEL = "anthropic/claude-sonnet-5"
+CHEAP_MODEL = "anthropic/claude-haiku-4-5"
+STRONG_MODEL = "openai/gpt-5.6"
+MAX_TOKENS = 16
+TAG_DENIAL_MESSAGE = "Not allowed to access model due to tags configuration"
+PLAIN_SERVED = frozenset({PLAIN_MODEL, "claude-sonnet-5"})
+CHEAP_SERVED = frozenset({CHEAP_MODEL, "claude-haiku-4-5"})
+EMBEDDING_MODEL = "openai/text-embedding-3-small"
+SEMANTIC_ROUTE_UTTERANCE = "summarize this quarterly revenue report into three bullet points"
+
+KEYWORD_HEAVY_SYSTEM_PROMPT = (
+    "You are the principal architecture assistant for a distributed systems platform. "
+    "Analyze every request step by step: design the algorithm, prove its correctness, "
+    "evaluate time and space complexity, and reason about concurrency, consistency, and "
+    "fault tolerance tradeoffs. When asked, refactor and debug multi-threaded code, "
+    "optimize database query plans, derive mathematical proofs, and explain the theorem "
+    "or lemma behind each optimization. Think through edge cases rigorously before answering. "
+) * 4
+
+
+class TaggedAuthHeaders(AuthHeaders):
+    x_litellm_tags: str | None = Field(default=None, serialization_alias="x-litellm-tags")
+
+
+class TaggedAnthropicHeaders(AnthropicHeaders):
+    x_litellm_tags: str | None = Field(default=None, serialization_alias="x-litellm-tags")
+
+
+class ResponsesTagMetadata(BaseModel):
+    tags: list[str]
+
+
+class ResponsesInputItem(BaseModel):
+    role: str
+    content: str
+
+
+class ResponsesBody(BaseModel):
+    model: str
+    input: str | list[ResponsesInputItem]
+    max_output_tokens: int | None = None
+    litellm_metadata: ResponsesTagMetadata | None = None
+
+
+class ResponsesApiResponse(BaseModel):
+    """Minimal /v1/responses answer shape; routing is proven from spend logs,
+    so only the fields the assertions read are modeled."""
+
+    model_config = ConfigDict(extra="allow")
+    id: str | None = None
+    status: str | None = None
+    model: str | None = None
+
+
+@dataclass(frozen=True, slots=True)
+class TagSplitDeployments:
+    """Scenario A mirrors the customer-shaped config from GitHub issue #36619:
+    plain deployment registered first, tier deployment and marker both tagged.
+    Scenario B flips both axes for GitHub issue #36621: marker registered first
+    and its tier deployment left untagged, so routing depends neither on
+    registration order nor on tier deployments carrying tags."""
+
+    tag_a: str
+    shared_a: str
+    tier_a: str
+    tag_b: str
+    shared_b: str
+    tier_b: str
+
+
+@dataclass(frozen=True, slots=True)
+class ZeroPricedAlias:
+    alias: str
+    tier: str
+
+
+@dataclass(frozen=True, slots=True)
+class HeuristicSplit:
+    alias: str
+    cheap: str
+    strong: str
+
+
+@dataclass(frozen=True, slots=True)
+class SemanticAutoRouter:
+    marker: str
+    target: str
+    fallback: str
+    embedding: str
+
+
+@dataclass(frozen=True, slots=True)
+class CredentialedAlias:
+    alias: str
+    tier: str
+
+
+def _provider_key(env_var: str) -> str:
+    return os.environ.get(env_var) or f"os.environ/{env_var}"
+
+
+def _uniform_tier_config(tier_model: str) -> dict[str, object]:
+    return {
+        "classifier_type": "heuristic",
+        "tiers": {"SIMPLE": tier_model, "MEDIUM": tier_model, "COMPLEX": tier_model, "REASONING": tier_model},
+    }
+
+
+def _key_for(
+    proxy: ProxyClient, resources: ResourceManager, models: list[str], tag_filtering: bool = False
+) -> str:
+    key: Final = proxy.generate_key(
+        KeyGenerateBody(
+            models=models,
+            user_id="e2e-auto-router-regressions",
+            router_settings=RouterSettingsOverride(enable_tag_filtering=True) if tag_filtering else None,
+        )
+    )
+    resources.defer(lambda: proxy.delete_key(key))
+    return key
+
+
+def _hello_chat_body(model: str, tags: list[str] | None = None) -> ChatBody:
+    return ChatBody(
+        model=model,
+        messages=[ChatMessage(role="user", content=f"say hello {unique_marker()}")],
+        max_tokens=MAX_TOKENS,
+        metadata=ChatMetadata(tags=tags) if tags is not None else None,
+    )
+
+
+def _hello_messages_body(model: str) -> AnthropicMessagesBody:
+    return AnthropicMessagesBody(
+        model=model,
+        messages=[ChatMessage(role="user", content=f"say hello {unique_marker()}")],
+        max_tokens=MAX_TOKENS,
+    )
+
+
+def _assert_served_only_by(rows: list[SpendLogRow], allowed: frozenset[str], context: str) -> None:
+    served: Final = tuple(row.model for row in rows)
+    assert served and all(model in allowed for model in served), (
+        f"{context}: expected every request to be served by one of {sorted(allowed)}, spend logs show {served}"
+    )
+
+
+@pytest.fixture(scope="module")
+def split(proxy: ProxyClient) -> Iterator[TagSplitDeployments]:
+    marker: Final = unique_marker()
+    deployments: Final = TagSplitDeployments(
+        tag_a=f"e2e-split-a-{marker}",
+        shared_a=f"e2e-autoroute-a-{marker}",
+        tier_a=f"e2e-tier-a-{marker}",
+        tag_b=f"e2e-split-b-{marker}",
+        shared_b=f"e2e-autoroute-b-{marker}",
+        tier_b=f"e2e-tier-b-{marker}",
+    )
+    anthropic_key: Final = _provider_key("ANTHROPIC_API_KEY")
+    marker_params_a: Final = LiteLLMParamsBody(
+        model="auto_router/complexity_router",
+        complexity_router_config=_uniform_tier_config(deployments.tier_a),
+        tags=[deployments.tag_a],
+    )
+    marker_params_b: Final = LiteLLMParamsBody(
+        model="auto_router/complexity_router",
+        complexity_router_config=_uniform_tier_config(deployments.tier_b),
+        tags=[deployments.tag_b],
+    )
+    registrations: Final[tuple[tuple[str, LiteLLMParamsBody], ...]] = (
+        (deployments.shared_a, LiteLLMParamsBody(model=PLAIN_MODEL, api_key=anthropic_key)),
+        (deployments.tier_a, LiteLLMParamsBody(model=CHEAP_MODEL, api_key=anthropic_key, tags=[deployments.tag_a])),
+        (deployments.shared_a, marker_params_a),
+        (deployments.shared_b, marker_params_b),
+        (deployments.tier_b, LiteLLMParamsBody(model=CHEAP_MODEL, api_key=anthropic_key)),
+        (deployments.shared_b, LiteLLMParamsBody(model=PLAIN_MODEL, api_key=anthropic_key)),
+    )
+    created: Final = tuple(proxy.create_model(name, params) for name, params in registrations)
+    try:
+        yield deployments
+    finally:
+        for model_id in created:
+            proxy.delete_model(model_id)
+
+
+@pytest.fixture(scope="module")
+def zero_priced_alias(proxy: ProxyClient) -> Iterator[ZeroPricedAlias]:
+    marker: Final = unique_marker()
+    named: Final = ZeroPricedAlias(alias=f"e2e-priced-alias-{marker}", tier=f"e2e-priced-tier-{marker}")
+    alias_params: Final = LiteLLMParamsBody(
+        model="auto_router/complexity_router",
+        complexity_router_config=_uniform_tier_config(named.tier),
+        input_cost_per_token=0.0,
+        output_cost_per_token=0.0,
+    )
+    registrations: Final[tuple[tuple[str, LiteLLMParamsBody], ...]] = (
+        (named.tier, LiteLLMParamsBody(model=CHEAP_MODEL, api_key=_provider_key("ANTHROPIC_API_KEY"))),
+        (named.alias, alias_params),
+    )
+    created: Final = tuple(proxy.create_model(name, params) for name, params in registrations)
+    try:
+        yield named
+    finally:
+        for model_id in created:
+            proxy.delete_model(model_id)
+
+
+@pytest.fixture(scope="module")
+def heuristic_split(proxy: ProxyClient) -> Iterator[HeuristicSplit]:
+    marker: Final = unique_marker()
+    named: Final = HeuristicSplit(
+        alias=f"e2e-heuristic-router-{marker}",
+        cheap=f"e2e-heuristic-cheap-{marker}",
+        strong=f"e2e-heuristic-strong-{marker}",
+    )
+    config: Final[dict[str, object]] = {
+        "classifier_type": "heuristic",
+        "token_thresholds": {"simple": 15, "complex": 400},
+        "tiers": {"SIMPLE": named.cheap, "MEDIUM": named.strong, "COMPLEX": named.strong, "REASONING": named.strong},
+    }
+    registrations: Final[tuple[tuple[str, LiteLLMParamsBody], ...]] = (
+        (named.cheap, LiteLLMParamsBody(model=CHEAP_MODEL, api_key=_provider_key("ANTHROPIC_API_KEY"))),
+        (named.strong, LiteLLMParamsBody(model=STRONG_MODEL, api_key=_provider_key("OPENAI_API_KEY"))),
+        (named.alias, LiteLLMParamsBody(model="auto_router/complexity_router", complexity_router_config=config)),
+    )
+    created: Final = tuple(proxy.create_model(name, params) for name, params in registrations)
+    try:
+        yield named
+    finally:
+        for model_id in created:
+            proxy.delete_model(model_id)
+
+
+@pytest.fixture(scope="module")
+def semantic_auto_router(proxy: ProxyClient) -> Iterator[SemanticAutoRouter]:
+    marker: Final = unique_marker()
+    named: Final = SemanticAutoRouter(
+        marker=f"e2e-semantic-router-{marker}",
+        target=f"e2e-semantic-target-{marker}",
+        fallback=f"e2e-semantic-fallback-{marker}",
+        embedding=f"e2e-semantic-embedding-{marker}",
+    )
+    router_config: Final = json.dumps(
+        {"routes": [{"name": named.target, "utterances": [SEMANTIC_ROUTE_UTTERANCE], "score_threshold": 0.3}]}
+    )
+    marker_params: Final = LiteLLMParamsBody(
+        model=f"auto_router/{named.marker}",
+        auto_router_config=router_config,
+        auto_router_default_model=named.fallback,
+        auto_router_embedding_model=named.embedding,
+    )
+    registrations: Final[tuple[tuple[str, LiteLLMParamsBody], ...]] = (
+        (named.embedding, LiteLLMParamsBody(model=EMBEDDING_MODEL, api_key=_provider_key("OPENAI_API_KEY"))),
+        (named.target, LiteLLMParamsBody(model=CHEAP_MODEL, api_key=_provider_key("ANTHROPIC_API_KEY"))),
+        (named.fallback, LiteLLMParamsBody(model=PLAIN_MODEL, api_key=_provider_key("ANTHROPIC_API_KEY"))),
+        (named.marker, marker_params),
+    )
+    created: Final = tuple(proxy.create_model(name, params) for name, params in registrations)
+    try:
+        yield named
+    finally:
+        for model_id in created:
+            proxy.delete_model(model_id)
+
+
+@pytest.fixture(scope="module")
+def credentialed_alias(proxy: ProxyClient) -> Iterator[CredentialedAlias]:
+    marker: Final = unique_marker()
+    named: Final = CredentialedAlias(alias=f"e2e-cred-alias-{marker}", tier=f"e2e-cred-tier-{marker}")
+    alias_params: Final = LiteLLMParamsBody(
+        model="auto_router/complexity_router",
+        complexity_router_config=_uniform_tier_config(named.tier),
+        api_key=f"sk-alias-never-used-{marker}",
+    )
+    registrations: Final[tuple[tuple[str, LiteLLMParamsBody], ...]] = (
+        (named.tier, LiteLLMParamsBody(model=CHEAP_MODEL, api_key=_provider_key("ANTHROPIC_API_KEY"))),
+        (named.alias, alias_params),
+    )
+    created: Final = tuple(proxy.create_model(name, params) for name, params in registrations)
+    try:
+        yield named
+    finally:
+        for model_id in created:
+            proxy.delete_model(model_id)
+
+
+class TestTagSplitRouting:
+    @pytest.mark.covers("reliability.routing.tagged_marker.request_tag_selects_marker")
+    def test_body_tagged_chat_routes_through_the_marker_to_its_tier(
+        self, proxy: ProxyClient, resources: ResourceManager, split: TagSplitDeployments
+    ) -> None:
+        """Pins GitHub issue #36619: with tag filtering on, a chat request whose
+        body metadata tags match the tagged marker under a shared model name is
+        answered by the marker's tier deployment, not by the plain deployment
+        that was registered under the name first."""
+        key: Final = _key_for(proxy, resources, [split.shared_a, split.tier_a], tag_filtering=True)
+        chat: Final = unwrap(proxy.chat(key, _hello_chat_body(split.shared_a, tags=[split.tag_a])))
+        assert chat.choices, "tagged chat through the shared name returned no choices"
+        rows: Final = proxy.poll_logs_for_key(key, min_rows=1)
+        _assert_served_only_by(rows, CHEAP_SERVED | {split.tier_a}, "body-tagged chat on the shared name")
+
+    @pytest.mark.covers("reliability.routing.tagged_marker.untagged_request_served_by_plain_deployment")
+    def test_untagged_chat_is_always_served_by_the_plain_deployment(
+        self, proxy: ProxyClient, resources: ResourceManager, split: TagSplitDeployments
+    ) -> None:
+        """Pins GitHub issue #36620: untagged chat requests to the shared name
+        succeed on every call and are all served by the plain deployment; the
+        tagged marker never captures them, so no intermittent auto-router
+        errors and no tier hijacking."""
+        key: Final = _key_for(proxy, resources, [split.shared_a, split.tier_a], tag_filtering=True)
+        for _ in range(5):
+            chat = unwrap(proxy.chat(key, _hello_chat_body(split.shared_a)))
+            assert chat.choices, "untagged chat through the shared name returned no choices"
+        rows: Final = proxy.poll_logs_for_key(key, min_rows=5)
+        _assert_served_only_by(rows, PLAIN_SERVED | {split.shared_a}, "untagged chat on the shared name")
+
+    @pytest.mark.covers("reliability.routing.tagged_marker.untagged_request_served_by_plain_deployment")
+    def test_untagged_messages_is_served_by_the_plain_deployment(
+        self, proxy: ProxyClient, resources: ResourceManager, split: TagSplitDeployments
+    ) -> None:
+        """Pins GitHub issue #36620 on the /v1/messages surface: an untagged
+        Anthropic-native request to the shared name is served by the plain
+        deployment, not captured by the tagged marker."""
+        key: Final = _key_for(proxy, resources, [split.shared_a, split.tier_a], tag_filtering=True)
+        answer: Final = unwrap(proxy.messages(key, _hello_messages_body(split.shared_a)))
+        assert answer.content or answer.choices, "untagged /v1/messages returned neither content nor choices"
+        rows: Final = proxy.poll_logs_for_key(key, min_rows=1)
+        _assert_served_only_by(rows, PLAIN_SERVED | {split.shared_a}, "untagged /v1/messages on the shared name")
+
+
+class TestUntaggedTierDeployments:
+    @pytest.mark.covers("reliability.routing.tagged_marker.header_tag_selects_marker")
+    def test_header_tagged_messages_routes_through_the_marker_to_an_untagged_tier(
+        self, proxy: ProxyClient, resources: ResourceManager, split: TagSplitDeployments
+    ) -> None:
+        """Pins GitHub issue #36621: a /v1/messages request tagged only via the
+        x-litellm-tags header selects the tagged marker, and the rewrite still
+        lands on the tier deployment even though that deployment carries no
+        tags, because the marker consumed the routing tags."""
+        key: Final = _key_for(proxy, resources, [split.shared_b, split.tier_b], tag_filtering=True)
+        headers: Final = TaggedAnthropicHeaders(authorization=f"Bearer {key}", x_litellm_tags=split.tag_b)
+        answer: Final = unwrap(
+            proxy.transport.post(
+                "/v1/messages",
+                headers=headers,
+                json=_hello_messages_body(split.shared_b),
+                response_type=AnthropicMessagesResponse,
+            )
+        )
+        assert answer.content or answer.choices, "header-tagged /v1/messages returned neither content nor choices"
+        rows: Final = proxy.poll_logs_for_key(key, min_rows=1)
+        _assert_served_only_by(rows, CHEAP_SERVED | {split.tier_b}, "header-tagged /v1/messages on the shared name")
+
+    @pytest.mark.covers("reliability.routing.tagged_marker.untagged_tier_deployments_still_served")
+    def test_body_tagged_chat_reaches_the_untagged_tier_after_marker_rewrite(
+        self, proxy: ProxyClient, resources: ResourceManager, split: TagSplitDeployments
+    ) -> None:
+        """Pins the tag-consumption half of GitHub issue #36621: after the
+        tagged marker rewrites the request to its tier model, the consumed
+        routing tags no longer constrain deployment selection, so the untagged
+        tier deployment serves the request instead of a strict-tag denial."""
+        key: Final = _key_for(proxy, resources, [split.shared_b, split.tier_b], tag_filtering=True)
+        chat: Final = unwrap(proxy.chat(key, _hello_chat_body(split.shared_b, tags=[split.tag_b])))
+        assert chat.choices, "body-tagged chat through the marker-first shared name returned no choices"
+        rows: Final = proxy.poll_logs_for_key(key, min_rows=1)
+        _assert_served_only_by(rows, CHEAP_SERVED | {split.tier_b}, "body-tagged chat with untagged tier")
+
+    @pytest.mark.covers("reliability.routing.tagged_marker.tag_semantics_stay_strict")
+    def test_tagged_call_straight_at_an_untagged_deployment_stays_denied(
+        self, proxy: ProxyClient, resources: ResourceManager, split: TagSplitDeployments
+    ) -> None:
+        """The tag-consumption fix must not loosen strict tag semantics: a
+        tagged request aimed directly at an untagged deployment (no marker
+        involved) is still rejected with the 401 tags-configuration error."""
+        key: Final = _key_for(proxy, resources, [split.tier_b], tag_filtering=True)
+        result: Final = proxy.chat(key, _hello_chat_body(split.tier_b, tags=[split.tag_b]))
+        assert isinstance(result, UnauthorizedError), (
+            f"expected the tagged direct call to an untagged deployment to be denied with 401, got {result}"
+        )
+        assert TAG_DENIAL_MESSAGE in result.body, (
+            f"expected the denial to come from tag routing, got a 401 reading {result.body[:300]}"
+        )
+
+
+class TestResponsesApiTagRouting:
+    @pytest.mark.covers("reliability.routing.tagged_marker.responses_input_routes_through_marker")
+    def test_header_tagged_responses_with_string_input_routes_to_the_tier(
+        self, proxy: ProxyClient, resources: ResourceManager, split: TagSplitDeployments
+    ) -> None:
+        """Pins the /v1/responses surface of the tag split (GitHub issues
+        #36620/#36621): a /v1/responses request with string input, tagged via
+        the x-litellm-tags header, succeeds and routes through the tagged
+        marker to its tier."""
+        key: Final = _key_for(proxy, resources, [split.shared_a, split.tier_a], tag_filtering=True)
+        headers: Final = TaggedAuthHeaders(authorization=f"Bearer {key}", x_litellm_tags=split.tag_a)
+        body: Final = ResponsesBody(
+            model=split.shared_a, input=f"say hello {unique_marker()}", max_output_tokens=64
+        )
+        answer: Final = unwrap(
+            proxy.transport.post("/v1/responses", headers=headers, json=body, response_type=ResponsesApiResponse)
+        )
+        assert answer.id, "header-tagged /v1/responses returned no response id"
+        rows: Final = proxy.poll_logs_for_key(key, min_rows=1)
+        _assert_served_only_by(rows, CHEAP_SERVED | {split.tier_a}, "header-tagged /v1/responses string input")
+
+    @pytest.mark.covers("reliability.routing.tagged_marker.responses_input_routes_through_marker")
+    def test_body_tagged_responses_with_list_input_routes_to_the_tier(
+        self, proxy: ProxyClient, resources: ResourceManager, split: TagSplitDeployments
+    ) -> None:
+        """Pins the body-tag and list-input combination of the same split:
+        /v1/responses with litellm_metadata.tags and structured input items
+        routes through the tagged marker to its tier."""
+        key: Final = _key_for(proxy, resources, [split.shared_a, split.tier_a], tag_filtering=True)
+        body: Final = ResponsesBody(
+            model=split.shared_a,
+            input=[ResponsesInputItem(role="user", content=f"say hello {unique_marker()}")],
+            max_output_tokens=64,
+            litellm_metadata=ResponsesTagMetadata(tags=[split.tag_a]),
+        )
+        answer: Final = unwrap(
+            proxy.transport.post(
+                "/v1/responses",
+                headers=proxy.transport.bearer(key),
+                json=body,
+                response_type=ResponsesApiResponse,
+            )
+        )
+        assert answer.id, "body-tagged /v1/responses returned no response id"
+        rows: Final = proxy.poll_logs_for_key(key, min_rows=1)
+        _assert_served_only_by(rows, CHEAP_SERVED | {split.tier_a}, "body-tagged /v1/responses list input")
+
+    @pytest.mark.covers("reliability.routing.tagged_marker.untagged_request_served_by_plain_deployment")
+    def test_untagged_responses_is_served_by_the_plain_deployment(
+        self, proxy: ProxyClient, resources: ResourceManager, split: TagSplitDeployments
+    ) -> None:
+        """Pins the untagged half of the /v1/responses tag split: an untagged
+        request to the shared name is served by the plain deployment, matching
+        the chat and messages surfaces."""
+        key: Final = _key_for(proxy, resources, [split.shared_a, split.tier_a], tag_filtering=True)
+        body: Final = ResponsesBody(
+            model=split.shared_a, input=f"say hello {unique_marker()}", max_output_tokens=64
+        )
+        answer: Final = unwrap(
+            proxy.transport.post(
+                "/v1/responses",
+                headers=proxy.transport.bearer(key),
+                json=body,
+                response_type=ResponsesApiResponse,
+            )
+        )
+        assert answer.id, "untagged /v1/responses returned no response id"
+        rows: Final = proxy.poll_logs_for_key(key, min_rows=1)
+        _assert_served_only_by(rows, PLAIN_SERVED | {split.shared_a}, "untagged /v1/responses on the shared name")
+
+
+class TestStrategyAliasPricing:
+    @pytest.mark.covers("reliability.routing.strategy_alias.custom_pricing_ignored")
+    def test_zero_priced_alias_still_logs_spend_at_the_tier_rate(
+        self, proxy: ProxyClient, resources: ResourceManager, zero_priced_alias: ZeroPricedAlias
+    ) -> None:
+        """Pins GitHub PR #36691: custom pricing registered on a strategy-router
+        alias never prices the routed request. The alias here carries explicit
+        zero pricing, so any zero-spend row would prove the alias pricing was
+        applied; the routed tier deployment's real rate must produce spend > 0."""
+        key: Final = _key_for(proxy, resources, [zero_priced_alias.alias, zero_priced_alias.tier])
+        chat: Final = unwrap(proxy.chat(key, _hello_chat_body(zero_priced_alias.alias)))
+        assert chat.choices, "chat through the zero-priced alias returned no choices"
+        rows: Final = proxy.poll_logs_for_key(
+            key, min_rows=1, predicate=lambda logged: all((row.spend or 0.0) > 0.0 for row in logged)
+        )
+        _assert_served_only_by(rows, CHEAP_SERVED | {zero_priced_alias.tier}, "chat through the zero-priced alias")
+        priced: Final = tuple((row.model, row.spend) for row in rows)
+        assert all((row.spend or 0.0) > 0.0 for row in rows), (
+            f"expected spend at the tier deployment's own rate, got zero-spend rows: {priced}"
+        )
+
+
+class TestComplexityHeuristicScope:
+    @pytest.mark.covers("reliability.routing.complexity_heuristic.scores_current_ask_only")
+    def test_trivial_ask_behind_keyword_heavy_system_prompt_stays_on_the_cheap_tier(
+        self, proxy: ProxyClient, resources: ResourceManager, heuristic_split: HeuristicSplit
+    ) -> None:
+        """Pins GitHub PR #36721: the heuristic complexity classifier scores the
+        caller's current ask alone. The trivial ask scores SIMPLE on its own,
+        while the accompanying ~2KB agent system prompt is packed with enough
+        reasoning and complexity keywords that scoring the combined text lands
+        in REASONING; only ask-only scoring keeps this on the cheap tier."""
+        key: Final = _key_for(
+            proxy, resources, [heuristic_split.alias, heuristic_split.cheap, heuristic_split.strong]
+        )
+        body: Final = ChatBody(
+            model=heuristic_split.alias,
+            messages=[
+                ChatMessage(role="system", content=KEYWORD_HEAVY_SYSTEM_PROMPT),
+                ChatMessage(role="user", content=f"hi {unique_marker()}"),
+            ],
+            max_tokens=MAX_TOKENS,
+        )
+        chat: Final = unwrap(proxy.chat(key, body))
+        assert chat.choices, "chat through the heuristic router returned no choices"
+        rows: Final = proxy.poll_logs_for_key(key, min_rows=1)
+        _assert_served_only_by(
+            rows, CHEAP_SERVED | {heuristic_split.cheap}, "trivial ask behind a keyword-heavy system prompt"
+        )
+
+
+class TestSemanticAutoRouterResponses:
+    @pytest.mark.covers("reliability.routing.semantic_auto_router.responses_input_routed")
+    def test_responses_input_reaches_the_semantic_auto_router(
+        self, proxy: ProxyClient, resources: ResourceManager, semantic_auto_router: SemanticAutoRouter
+    ) -> None:
+        """Pins GitHub PR #37333: /v1/responses input is resolved into messages
+        for the semantic auto-router's pre-routing hook, so the marker embeds
+        the input, matches its route, and the target deployment serves the
+        request; before the fix the hook saw no messages and the request
+        failed with 400 "Unmapped LLM provider auto_router"."""
+        key: Final = _key_for(
+            proxy,
+            resources,
+            [semantic_auto_router.marker, semantic_auto_router.target, semantic_auto_router.fallback],
+        )
+        body: Final = ResponsesBody(
+            model=semantic_auto_router.marker, input=SEMANTIC_ROUTE_UTTERANCE, max_output_tokens=64
+        )
+        answer: Final = unwrap(
+            proxy.transport.post(
+                "/v1/responses",
+                headers=proxy.transport.bearer(key),
+                json=body,
+                response_type=ResponsesApiResponse,
+            )
+        )
+        assert answer.id, "/v1/responses through the semantic auto-router returned no response id"
+        rows: Final = proxy.poll_logs_for_key(key, min_rows=1)
+        _assert_served_only_by(
+            rows, CHEAP_SERVED | {semantic_auto_router.target}, "semantic auto-router /v1/responses string input"
+        )
+
+
+class TestAliasParamForwarding:
+    @pytest.mark.covers("reliability.routing.tagged_marker.alias_connection_params_stay_with_tier")
+    def test_alias_api_key_never_overrides_the_tier_credential(
+        self, proxy: ProxyClient, resources: ResourceManager, credentialed_alias: CredentialedAlias
+    ) -> None:
+        """Pins GitHub PR #36626: an api_key set on the marker alias entry is
+        never forwarded onto the routed request, so the tier deployment calls
+        its provider with its own credential. Before the fix the alias's key
+        was copied into the request, overriding the tier's credential, and
+        every routed call failed provider auth."""
+        key: Final = _key_for(proxy, resources, [credentialed_alias.alias, credentialed_alias.tier])
+        chat: Final = unwrap(proxy.chat(key, _hello_chat_body(credentialed_alias.alias)))
+        assert chat.choices, "chat through the credentialed alias returned no choices"
+        rows: Final = proxy.poll_logs_for_key(key, min_rows=1)
+        _assert_served_only_by(rows, CHEAP_SERVED | {credentialed_alias.tier}, "chat through the credentialed alias")
diff --git a/tests/e2e/ui/tests/mcp/mcpTools.spec.ts b/tests/e2e/ui/tests/mcp/mcpTools.spec.ts
index edaeab196aa..225ca8b9449 100644
--- a/tests/e2e/ui/tests/mcp/mcpTools.spec.ts
+++ b/tests/e2e/ui/tests/mcp/mcpTools.spec.ts
@@ -63,7 +63,7 @@ test.describe("MCP Tools", () => {
 
     // The form is generated from the tool's inputSchema, so `repoName` proves the schema
     // round-tripped through the proxy instead of the panel falling back to a generic field.
-    const repoInput = page.locator('input[id="repoName"]');
+    const repoInput = page.getByLabel(/repoName/);
     await expect(repoInput).toBeVisible();
     await repoInput.fill(TOOL_ARG_REPO);
 
diff --git a/tests/e2e/ui/tests/modelsPage/addModel.spec.ts b/tests/e2e/ui/tests/modelsPage/addModel.spec.ts
index 1b11ea69f97..bd5373e1569 100644
--- a/tests/e2e/ui/tests/modelsPage/addModel.spec.ts
+++ b/tests/e2e/ui/tests/modelsPage/addModel.spec.ts
@@ -338,8 +338,8 @@ test.describe("Add Model", () => {
 
       await page.getByRole("button", { name: "Add Model" }).last().click();
 
-      // Scope to antd's notification container so a stale toast can't satisfy this.
-      await expect(page.locator(".ant-notification").getByText("created successfully").last()).toBeVisible({
+      // Scope to the toast container so a stale toast can't satisfy this.
+      await expect(page.locator("[data-sonner-toast]").getByText("created successfully").last()).toBeVisible({
         timeout: 15_000,
       });
 
diff --git a/tests/e2e/ui/tests/modelsPage/clearCustomPricing.spec.ts b/tests/e2e/ui/tests/modelsPage/clearCustomPricing.spec.ts
index e67dcb96f36..c532641b238 100644
--- a/tests/e2e/ui/tests/modelsPage/clearCustomPricing.spec.ts
+++ b/tests/e2e/ui/tests/modelsPage/clearCustomPricing.spec.ts
@@ -85,9 +85,9 @@ test.describe("Clear custom pricing on a deployment", () => {
     const inputCost = page.getByPlaceholder("Enter input cost");
     const outputCost = page.getByPlaceholder("Enter output cost");
     // Both cache fields share the same placeholder ("Defaults to Input Cost if blank"),
-    // so disambiguate via the Form.Item id (AntD assigns the `name` prop as input id).
-    const cacheReadCost = page.locator("#cache_read_cost");
-    const cacheWriteCost = page.locator("#cache_write_cost");
+    // so disambiguate via their labels.
+    const cacheReadCost = page.getByLabel(/Cache Read Cost/);
+    const cacheWriteCost = page.getByLabel(/Cache Write Cost/);
     await inputCost.waitFor({ timeout: 15_000 });
     for (const field of [inputCost, outputCost, cacheReadCost, cacheWriteCost]) {
       await field.click({ clickCount: 3 });
diff --git a/tests/e2e/ui/tests/proxy-admin/keys.spec.ts b/tests/e2e/ui/tests/proxy-admin/keys.spec.ts
index d9b0f959c9f..004fedb3263 100644
--- a/tests/e2e/ui/tests/proxy-admin/keys.spec.ts
+++ b/tests/e2e/ui/tests/proxy-admin/keys.spec.ts
@@ -36,9 +36,8 @@ test.describe("Proxy Admin - Keys", () => {
     // Wait for the key creation modal
     await expect(page.getByText("Key Ownership")).toBeVisible({ timeout: 10_000 });
 
-    // Fill key name (has data-testid="base-input" in the built UI)
     const keyName = `e2e-admin-key-${Date.now()}`;
-    await page.getByTestId("base-input").fill(keyName);
+    await page.getByLabel(/Key Name/).fill(keyName);
 
     // Select team
     const teamSelect = page.getByTestId("team-dropdown").getByRole("combobox");
@@ -192,7 +191,7 @@ test.describe("Proxy Admin - Keys", () => {
     await expect(page.getByText("Key Ownership")).toBeVisible({ timeout: 10_000 });
 
     const keyName = `e2e-admin-allproxy-${Date.now()}`;
-    await page.getByTestId("base-input").fill(keyName);
+    await page.getByLabel(/Key Name/).fill(keyName);
 
     // No team selection — leave team dropdown empty so the key is owned by the admin user
 
@@ -220,7 +219,7 @@ test.describe("Proxy Admin - Keys", () => {
     await expect(page.getByText("Key Ownership")).toBeVisible({ timeout: 10_000 });
 
     const keyName = `e2e-admin-specific-${Date.now()}`;
-    await page.getByTestId("base-input").fill(keyName);
+    await page.getByLabel(/Key Name/).fill(keyName);
 
     // Open the model multi-select and pick a single specific model. Use
     // getByRole("option", ...) to avoid the strict-mode collision between
diff --git a/tests/e2e/ui/tests/proxy-admin/teams.spec.ts b/tests/e2e/ui/tests/proxy-admin/teams.spec.ts
index d7c8eb6237e..172fde173df 100644
--- a/tests/e2e/ui/tests/proxy-admin/teams.spec.ts
+++ b/tests/e2e/ui/tests/proxy-admin/teams.spec.ts
@@ -79,7 +79,7 @@ test.describe("Proxy Admin - Teams", () => {
     await expect(modal).toBeVisible({ timeout: 5_000 });
 
     // The email field is a Select — type to search, then select from dropdown
-    await modal.locator(".ant-select").first().click();
+    await modal.getByRole("combobox").first().click();
     await page.keyboard.type("invitable@test.local");
 
     // Wait for the option to appear, then select via keyboard (avoids viewport issues)
diff --git a/tests/e2e/ui/tests/team-admin/teamAdmin.spec.ts b/tests/e2e/ui/tests/team-admin/teamAdmin.spec.ts
index d71d5e6c0fe..0ef74e71529 100644
--- a/tests/e2e/ui/tests/team-admin/teamAdmin.spec.ts
+++ b/tests/e2e/ui/tests/team-admin/teamAdmin.spec.ts
@@ -66,7 +66,7 @@ test.describe("Team Admin", () => {
 
     // Use a dedicated invitee user so this doesn't race with the proxy-admin
     // "Invite a user" test that adds invitable@test.local to the same team.
-    await modal.locator(".ant-select").first().click();
+    await modal.getByRole("combobox").first().click();
     await page.keyboard.type("invitable-team@test.local");
 
     const emailOption = page.getByRole("option", { name: "invitable-team@test.local" }).first();
@@ -136,7 +136,7 @@ test.describe("Team Admin", () => {
     await expect(page.getByText("Key Ownership")).toBeVisible({ timeout: 10_000 });
 
     const keyName = `e2e-team-admin-key-${Date.now()}`;
-    await page.getByTestId("base-input").fill(keyName);
+    await page.getByLabel(/Key Name/).fill(keyName);
 
     // Team selector — same locator pattern as the proxy-admin keys test.
     const teamSelect = page.getByTestId("team-dropdown").getByRole("combobox");
diff --git a/tests/image_gen_tests/test_image_generation.py b/tests/image_gen_tests/test_image_generation.py
index f0a73325afa..33dcdbb57a5 100644
--- a/tests/image_gen_tests/test_image_generation.py
+++ b/tests/image_gen_tests/test_image_generation.py
@@ -269,7 +269,7 @@ class TestAimlImageGeneration(BaseImageGenTest):
 
 class TestGoogleImageGen(BaseImageGenTest):
     def get_base_image_generation_call_args(self) -> dict:
-        return {"model": "gemini/imagen-4.0-generate-001"}
+        return {"model": "gemini/gemini-3.1-flash-image"}
 
 
 @pytest.mark.skip(reason="Runwayml image generation API only tested locally")
diff --git a/tests/llm_translation/test_groq.py b/tests/llm_translation/test_groq.py
index cf4be9e801e..c720f818eaf 100644
--- a/tests/llm_translation/test_groq.py
+++ b/tests/llm_translation/test_groq.py
@@ -20,7 +20,7 @@ from litellm.llms.groq.chat.transformation import (
 class TestGroq(BaseLLMChatTest):
     def get_base_completion_call_args(self) -> dict:
         return {
-            "model": "groq/llama-3.3-70b-versatile",
+            "model": "groq/openai/gpt-oss-120b",
         }
 
     def test_tool_call_no_arguments(self, tool_call_no_arguments):
diff --git a/tests/local_testing/test_model_alias_map.py b/tests/local_testing/test_model_alias_map.py
index 14c1de2f6a7..9ef0448e7c6 100644
--- a/tests/local_testing/test_model_alias_map.py
+++ b/tests/local_testing/test_model_alias_map.py
@@ -15,7 +15,7 @@ from litellm import completion, embedding
 
 litellm.set_verbose = True
 
-model_alias_map = {"good-model": "groq/llama-3.1-8b-instant"}
+model_alias_map = {"good-model": "groq/openai/gpt-oss-120b"}
 
 
 def test_model_alias_map(caplog):
@@ -34,7 +34,7 @@ def test_model_alias_map(caplog):
             if rec.levelname == "ERROR" and rec.name.startswith("LiteLLM"):
                 pytest.fail(f"Unexpected litellm ERROR log: {rec.getMessage()}")
 
-        assert "llama-3.1-8b-instant" in response.model
+        assert "gpt-oss-120b" in response.model
     except litellm.ServiceUnavailableError:
         pass
     except Exception as e:
diff --git a/tests/local_testing/test_router.py b/tests/local_testing/test_router.py
index af1a052e86d..7bc29517f8c 100644
--- a/tests/local_testing/test_router.py
+++ b/tests/local_testing/test_router.py
@@ -120,7 +120,7 @@ async def test_router_provider_wildcard_routing():
     print("response 2 = ", response2)
 
     response3 = await router.acompletion(
-        model="groq/llama-3.1-8b-instant",
+        model="groq/openai/gpt-oss-120b",
         messages=[{"role": "user", "content": "hello"}],
     )
 
diff --git a/tests/local_testing/test_router_batch_completion.py b/tests/local_testing/test_router_batch_completion.py
index f7a1b41ca29..bb9e1851c61 100644
--- a/tests/local_testing/test_router_batch_completion.py
+++ b/tests/local_testing/test_router_batch_completion.py
@@ -44,7 +44,7 @@ async def test_batch_completion_multiple_models(mode):
             {
                 "model_name": "groq-llama",
                 "litellm_params": {
-                    "model": "groq/llama-3.1-8b-instant",
+                    "model": "groq/openai/gpt-oss-120b",
                 },
             },
         ]
@@ -143,7 +143,7 @@ async def test_batch_completion_fastest_response_streaming():
             {
                 "model_name": "groq-llama",
                 "litellm_params": {
-                    "model": "groq/llama-3.1-8b-instant",
+                    "model": "groq/openai/gpt-oss-120b",
                 },
             },
         ]
@@ -179,7 +179,7 @@ async def test_batch_completion_multiple_models_multiple_messages():
             {
                 "model_name": "groq-llama",
                 "litellm_params": {
-                    "model": "groq/llama-3.1-8b-instant",
+                    "model": "groq/openai/gpt-oss-120b",
                 },
             },
         ]
diff --git a/tests/local_testing/test_stream_chunk_builder.py b/tests/local_testing/test_stream_chunk_builder.py
index 38e04b93f18..664fd936205 100644
--- a/tests/local_testing/test_stream_chunk_builder.py
+++ b/tests/local_testing/test_stream_chunk_builder.py
@@ -871,7 +871,7 @@ def load_env():
     }
     LLAMA3_3 = {
         "messages": messages,
-        "model": "groq/llama-3.3-70b-versatile",
+        "model": "groq/openai/gpt-oss-120b",
         "api_base": "https://api.groq.com/openai/v1",
         "temperature": 0.0,
         "tools": tools,
diff --git a/tests/logging_callback_tests/test_logging_redaction_e2e_test.py b/tests/logging_callback_tests/test_logging_redaction_e2e_test.py
index d56d5e51b04..3b42595b959 100644
--- a/tests/logging_callback_tests/test_logging_redaction_e2e_test.py
+++ b/tests/logging_callback_tests/test_logging_redaction_e2e_test.py
@@ -317,110 +317,69 @@ async def test_redaction_responses_api_stream():
 @pytest.mark.asyncio
 async def test_redaction_responses_api_with_reasoning_summary():
     """Test that reasoning summary in ResponsesAPIResponse output is properly redacted"""
+    import litellm
     from litellm.litellm_core_utils.redact_messages import perform_redaction
 
-    # Create a simple mock object with output items that have reasoning summaries
-    class MockResponsesAPIResponse:
-        def __init__(self):
-            self.output = [
-                # Reasoning item with summary
-                type(
-                    "obj",
-                    (object,),
+    response = litellm.ResponsesAPIResponse(
+        id="resp_123",
+        created_at=1234567890,
+        output=[
+            {
+                "type": "reasoning",
+                "id": "rs_123",
+                "summary": [
                     {
-                        "type": "reasoning",
-                        "id": "rs_123",
-                        "summary": [
-                            type(
-                                "obj",
-                                (object,),
-                                {
-                                    "text": "This is a detailed reasoning summary that should be redacted",
-                                    "type": "summary_text",
-                                },
-                            )()
-                        ],
-                    },
-                )(),
-                # Message item with content
-                type(
-                    "obj",
-                    (object,),
+                        "type": "summary_text",
+                        "text": "This is a detailed reasoning summary that should be redacted",
+                    }
+                ],
+            },
+            {
+                "type": "message",
+                "id": "msg_123",
+                "status": "completed",
+                "role": "assistant",
+                "content": [
                     {
-                        "type": "message",
-                        "id": "msg_123",
-                        "content": [
-                            type(
-                                "obj",
-                                (object,),
-                                {
-                                    "text": "This is the actual message content",
-                                    "type": "output_text",
-                                },
-                            )()
-                        ],
-                    },
-                )(),
-            ]
-            self.reasoning = {"effort": "low", "summary": "auto"}
+                        "type": "output_text",
+                        "text": "This is the actual message content",
+                        "annotations": [],
+                    }
+                ],
+            },
+        ],
+        reasoning={"effort": "low", "summary": "auto"},
+    )
 
-    # Mock as ResponsesAPIResponse so perform_redaction recognizes it
-    mock_response = MockResponsesAPIResponse()
-    mock_response.__class__.__name__ = "ResponsesAPIResponse"
+    model_call_details = {
+        "messages": [{"role": "user", "content": "test"}],
+        "prompt": "test prompt",
+        "input": "test input",
+    }
 
-    # Patch isinstance to recognize our mock as ResponsesAPIResponse
-    import litellm
+    redacted_result = perform_redaction(model_call_details, response)
 
-    original_isinstance = isinstance
+    assert isinstance(
+        redacted_result, litellm.ResponsesAPIResponse
+    ), "Redaction should preserve the ResponsesAPIResponse type"
 
-    def patched_isinstance(obj, cls):
-        if (
-            cls == litellm.ResponsesAPIResponse
-            and obj.__class__.__name__ == "ResponsesAPIResponse"
-        ):
-            return True
-        return original_isinstance(obj, cls)
+    reasoning_item = redacted_result.output[0]
+    assert (
+        reasoning_item.summary[0].text == "redacted-by-litellm"
+    ), "Reasoning summary text should be redacted"
 
-    import builtins
+    message_item = redacted_result.output[1]
+    assert (
+        message_item.content[0].text == "redacted-by-litellm"
+    ), "Message content text should be redacted"
 
-    builtins.isinstance = patched_isinstance
+    assert (
+        redacted_result.reasoning is None
+    ), "Top-level reasoning field should be None"
 
-    try:
-        model_call_details = {
-            "messages": [{"role": "user", "content": "test"}],
-            "prompt": "test prompt",
-            "input": "test input",
-        }
-
-        # Perform redaction
-        redacted_result = perform_redaction(model_call_details, mock_response)
-
-        # Verify reasoning summary text is redacted
-        reasoning_item = redacted_result.output[0]
-        assert (
-            reasoning_item.summary[0].text == "redacted-by-litellm"
-        ), "Reasoning summary text should be redacted"
-
-        # Verify message content is also redacted
-        message_item = redacted_result.output[1]
-        assert (
-            message_item.content[0].text == "redacted-by-litellm"
-        ), "Message content text should be redacted"
-
-        # Verify top-level reasoning field is removed
-        assert (
-            redacted_result.reasoning is None
-        ), "Top-level reasoning field should be None"
-
-        # Verify input messages are redacted
-        assert (
-            model_call_details["messages"][0]["content"] == "redacted-by-litellm"
-        ), "Input messages should be redacted"
-
-        print("✓ Reasoning summary redaction test passed")
-    finally:
-        # Restore original isinstance
-        builtins.isinstance = original_isinstance
+    assert (
+        model_call_details["messages"][0]["content"] == "redacted-by-litellm"
+    ), "Input messages should be redacted"
 
 
 @pytest.mark.asyncio
diff --git a/tests/ocr_tests/test_ocr_azure_document_intelligence.py b/tests/ocr_tests/test_ocr_azure_document_intelligence.py
index 09c21842ad7..5736bd797e3 100644
--- a/tests/ocr_tests/test_ocr_azure_document_intelligence.py
+++ b/tests/ocr_tests/test_ocr_azure_document_intelligence.py
@@ -62,7 +62,7 @@ class TestAzureDocumentIntelligencePagesParam:
         return AzureDocumentIntelligenceOCRConfig()
 
     def test_get_supported_ocr_params_includes_pages_and_features(self, cfg):
-        assert cfg.get_supported_ocr_params("prebuilt-layout") == ["pages", "features"]
+        assert cfg.get_supported_ocr_params("prebuilt-layout") == ["pages", "features", "req_format"]
 
     def test_map_ocr_params_mistral_zero_based_int_list(self, cfg):
         mapped = cfg.map_ocr_params({"pages": [0, 1, 2]}, {}, "prebuilt-layout")
diff --git a/tests/pass_through_unit_tests/test_pass_through_unit_tests.py b/tests/pass_through_unit_tests/test_pass_through_unit_tests.py
index c263b8ce381..77fb924c085 100644
--- a/tests/pass_through_unit_tests/test_pass_through_unit_tests.py
+++ b/tests/pass_through_unit_tests/test_pass_through_unit_tests.py
@@ -413,35 +413,54 @@ async def test_pass_through_request_logging_failure_with_stream(
             assert response.body == b'{"mock": "response"}'
 
 
+PROTOCOL_CONSTRAINED_PASS_THROUGH_ROUTES = {
+    "/comprehendmedical": {"POST"},
+    "/comprehendmedical/{operation}": {"POST"},
+}
+
+
 def test_pass_through_routes_support_all_methods():
     """
-    Test that all pass-through routes support GET, POST, PUT, DELETE, PATCH methods
+    A pass-through route fronts a whole provider API, so narrowing its method
+    set turns a request the upstream would have accepted into a 405. The
+    exceptions are providers whose wire protocol admits only one method: Amazon
+    Comprehend Medical speaks AWS JSON 1.1, which is POST-only, so there is no
+    other method to forward.
     """
-    # Import the routers
     from litellm.proxy.pass_through_endpoints.llm_passthrough_endpoints import (
         router as llm_router,
     )
 
-    # Expected HTTP methods
     expected_methods = {"GET", "POST", "PUT", "DELETE", "PATCH"}
 
-    # Function to check routes in a router
     def check_router_methods(router):
         for route in router.routes:
             if isinstance(route, APIRoute):
-                # Get path and methods for this route
                 path = route.path
                 methods = set(route.methods)
-                print("supported methods for route", path, "are", methods)
-                # Assert all expected methods are supported
+                allowed = PROTOCOL_CONSTRAINED_PASS_THROUGH_ROUTES.get(path, expected_methods)
                 assert (
-                    methods == expected_methods
-                ), f"Route {path} does not support all methods. Supported: {methods}, Expected: {expected_methods}"
+                    methods == allowed
+                ), f"Route {path} does not support all methods. Supported: {methods}, Expected: {allowed}"
 
-    # Check both routers
     check_router_methods(llm_router)
 
 
+def test_protocol_constrained_pass_through_exemptions_are_not_stale():
+    """
+    The exemption list above weakens the method contract, so it must not
+    outlive the routes it covers: a renamed or deleted route has to fail here
+    rather than sit in the list silently exempting nothing.
+    """
+    from litellm.proxy.pass_through_endpoints.llm_passthrough_endpoints import (
+        router as llm_router,
+    )
+
+    registered_paths = {route.path for route in llm_router.routes if isinstance(route, APIRoute)}
+    unmatched = set(PROTOCOL_CONSTRAINED_PASS_THROUGH_ROUTES) - registered_paths
+    assert not unmatched, f"Exempted pass-through routes no longer exist: {sorted(unmatched)}"
+
+
 def test_is_bedrock_agent_runtime_route():
     """
     Test that _is_bedrock_agent_runtime_route correctly identifies bedrock agent runtime endpoints
diff --git a/tests/search_tests/test_tinyfish_search.py b/tests/search_tests/test_tinyfish_search.py
index aca28544513..becb8287a29 100644
--- a/tests/search_tests/test_tinyfish_search.py
+++ b/tests/search_tests/test_tinyfish_search.py
@@ -35,11 +35,16 @@ MOCK_TINYFISH_RESPONSE = {
 
 
 def _make_mock_response(
-    json_data: dict, status_code: int = 200, request_url: str | None = None
+    json_data: dict,
+    status_code: int = 200,
+    request_url: str | None = None,
+    headers: dict | None = None,
 ) -> MagicMock:
     mock = MagicMock()
     mock.status_code = status_code
     mock.json.return_value = json_data
+    # httpx.Headers normalizes keys to lowercase — mirror production behavior.
+    mock.headers = httpx.Headers(headers or {})
     if request_url:
         mock.request = MagicMock()
         mock.request.url = httpx.URL(request_url)
@@ -163,7 +168,7 @@ class TestTinyfishSearch:
 
     @pytest.mark.asyncio
     async def test_fetch_param_round_trip(self):
-        # End-to-end check: caller passes `fetch=...` (JSON-encoded tf-fetch
+        # End-to-end check: caller passes `fetch=...` (JSON-encoded fetch
         # config); param reaches TinyFish on the request side and the nested
         # `fetch` object on each result surfaces back to the SearchResult on the
         # response side. No LiteLLM-side support code is required.
@@ -235,6 +240,58 @@ class TestTinyfishSearch:
         assert result.results[0].title == "Result 0"
         assert result.results[2].title == "Result 2"
 
+    @pytest.mark.asyncio
+    async def test_top_level_extras_surface_end_to_end(self):
+        # Envelope extras (`query`, `total_results`, `page`) must survive the
+        # full asearch dispatch — proves LiteLLM's entry-point plumbing outside
+        # our transformer doesn't accidentally strip them.
+        os.environ["TINYFISH_API_KEY"] = "sk-tinyfish-test"
+
+        mock_response = _make_mock_response(MOCK_TINYFISH_RESPONSE)
+
+        with patch(
+            "litellm.llms.custom_httpx.http_handler.AsyncHTTPHandler.get",
+            new_callable=AsyncMock,
+        ) as mock_get:
+            mock_get.return_value = mock_response
+
+            response = await litellm.asearch(
+                query="web automation tools",
+                search_provider="tinyfish",
+            )
+
+            assert getattr(response, "query", None) == "web automation tools"
+            assert getattr(response, "total_results", None) == 2
+            assert getattr(response, "page", None) == 0
+
+    @pytest.mark.asyncio
+    async def test_response_headers_surface_end_to_end(self):
+        # Response headers must land on `_hidden_params` after the full
+        # asearch dispatch (both raw and sanitized channels).
+        os.environ["TINYFISH_API_KEY"] = "sk-tinyfish-test"
+
+        mock_response = _make_mock_response(
+            MOCK_TINYFISH_RESPONSE,
+            headers={"X-Request-ID": "req-e2e-1"},
+        )
+
+        with patch(
+            "litellm.llms.custom_httpx.http_handler.AsyncHTTPHandler.get",
+            new_callable=AsyncMock,
+        ) as mock_get:
+            mock_get.return_value = mock_response
+
+            response = await litellm.asearch(
+                query="test",
+                search_provider="tinyfish",
+            )
+
+            raw = response._hidden_params["headers"]
+            add = response._hidden_params["additional_headers"]
+            # httpx lowercases; both channels agree on the value.
+            assert raw["x-request-id"] == "req-e2e-1"
+            assert add["llm_provider-x-request-id"] == "req-e2e-1"
+
     @pytest.mark.asyncio
     async def test_empty_results(self):
         os.environ["TINYFISH_API_KEY"] = "sk-tinyfish-test"
diff --git a/tests/test_litellm/batches/test_batch_utils.py b/tests/test_litellm/batches/test_batch_utils.py
index 64b3df4180b..f7067053acb 100644
--- a/tests/test_litellm/batches/test_batch_utils.py
+++ b/tests/test_litellm/batches/test_batch_utils.py
@@ -959,8 +959,14 @@ async def test_handle_completed_vertex_batch_computes_cost_usage_and_models(monk
         litellm_params={"vertex_project": "proj-1", "vertex_location": "us-central1"},
     )
 
+    pricing = litellm.model_cost["vertex_ai/gemini-3.6-flash"]
+    batch_input = pricing["input_cost_per_token_batches"]
+    batch_output = pricing["output_cost_per_token_batches"]
+
+    assert batch_input < pricing["input_cost_per_token"]
+    assert batch_output < pricing["output_cost_per_token"]
     assert result.cost > 0
-    assert result.cost == pytest.approx(30 * 7.5e-07 + 15 * 3.75e-06)
+    assert result.cost == pytest.approx(30 * batch_input + 15 * batch_output)
     assert (result.usage.prompt_tokens, result.usage.completion_tokens, result.usage.total_tokens) == (30, 15, 45)
     assert result.models == ["gemini-3.6-flash", "gemini-3.6-flash"]
     assert result.successful_requests == 2
diff --git a/tests/test_litellm/conftest.py b/tests/test_litellm/conftest.py
index 0dc8f56f3ce..c0644c88291 100644
--- a/tests/test_litellm/conftest.py
+++ b/tests/test_litellm/conftest.py
@@ -100,6 +100,12 @@ def isolate_host_aws_config(monkeypatch, isolated_aws_credentials_dir):
     monkeypatch.delenv("AWS_DEFAULT_REGION", raising=False)
 
 
+@pytest.fixture(scope="function", autouse=True)
+def isolate_host_proxy_base_url(monkeypatch):
+    """Prevent a host PROXY_BASE_URL from outranking request-derived URLs during unit tests."""
+    monkeypatch.delenv("PROXY_BASE_URL", raising=False)
+
+
 def _run_coroutine_if_needed(result):
     if not asyncio.iscoroutine(result):
         return
diff --git a/tests/test_litellm/integrations/otel/test_db_endpoint.py b/tests/test_litellm/integrations/otel/test_db_endpoint.py
new file mode 100644
index 00000000000..5ab0a927b52
--- /dev/null
+++ b/tests/test_litellm/integrations/otel/test_db_endpoint.py
@@ -0,0 +1,312 @@
+"""Tests for litellm/integrations/otel/model/db_endpoint.py
+
+Prisma talks to PostgreSQL through a loopback query engine, so a DB span with no
+``server.address`` gets attributed to ``localhost`` by the backend. These cover
+the endpoint derivation that names the real server, for the local engine and for
+remote and read-replica deployments, and pin the rule that no credential is ever
+exported.
+"""
+
+import os
+from unittest.mock import patch
+
+import pytest
+
+from litellm.integrations.otel.model.db_endpoint import (
+    DatabaseEndpoint,
+    db_span_attributes,
+    parse_database_endpoint,
+    postgres_endpoint,
+)
+
+LOCAL_DSN = "postgresql://llmproxy:dbpassword9090@localhost:5432/litellm"
+REMOTE_DSN = "postgresql://llmproxy:s3cr3t@litellm-prod.abc123.us-east-1.rds.amazonaws.com:6432/litellm?schema=reporting&sslmode=require"
+REPLICA_DSN = "postgresql://reader:r3ad0nly@litellm-prod-ro.abc123.us-east-1.rds.amazonaws.com/litellm_replica"
+
+
+def _resolve(service, call_type=None, database_url=None, read_replica_url=None):
+    """Resolve attributes with the two DB env vars set, as the proxy sets them."""
+    env = {k: v for k, v in (("DATABASE_URL", database_url), ("DATABASE_URL_READ_REPLICA", read_replica_url)) if v}
+    with patch.dict(os.environ, env, clear=False):
+        for absent in {"DATABASE_URL", "DATABASE_URL_READ_REPLICA"} - set(env):
+            os.environ.pop(absent, None)
+        return dict(db_span_attributes(service, call_type))
+
+
+def test_local_prisma_engine_endpoint_is_the_postgres_server_not_the_engine():
+    assert parse_database_endpoint(LOCAL_DSN) == DatabaseEndpoint(
+        address="localhost", port=5432, namespace="litellm"
+    )
+
+
+def test_remote_endpoint_keeps_host_port_and_schema_qualified_namespace():
+    assert parse_database_endpoint(REMOTE_DSN) == DatabaseEndpoint(
+        address="litellm-prod.abc123.us-east-1.rds.amazonaws.com",
+        port=6432,
+        namespace="litellm|reporting",
+    )
+
+
+def test_read_replica_dsn_parses_to_the_replica_host_and_database():
+    assert parse_database_endpoint(REPLICA_DSN) == DatabaseEndpoint(
+        address="litellm-prod-ro.abc123.us-east-1.rds.amazonaws.com",
+        port=5432,
+        namespace="litellm_replica",
+    )
+
+
+def test_default_schema_is_not_spelled_out_in_the_namespace():
+    """``?schema=public`` and no schema at all are the same deployment, so they
+    must not split a group-by on db.namespace."""
+    assert parse_database_endpoint("postgresql://u:p@db.internal/litellm?schema=public") == parse_database_endpoint(
+        "postgresql://u:p@db.internal/litellm"
+    )
+
+
+def test_unix_socket_host_parameter_wins_over_the_netloc():
+    """libpq and the Cloud SQL connector both put the real target in ``host=``
+    behind a localhost netloc, which is the attribution this module removes."""
+    assert parse_database_endpoint(
+        "postgresql://u:p@localhost:5432/litellm?host=/cloudsql/proj:us-east1:inst"
+    ) == DatabaseEndpoint(address="/cloudsql/proj:us-east1:inst", port=5432, namespace="litellm")
+
+
+def test_socket_only_dsn_without_a_netloc_host_still_resolves():
+    assert parse_database_endpoint("postgresql:///litellm?host=/var/run/postgresql") == DatabaseEndpoint(
+        address="/var/run/postgresql", port=5432, namespace="litellm"
+    )
+
+
+def test_percent_encoded_database_name_is_decoded():
+    endpoint = parse_database_endpoint("postgresql://u:p@db.internal/litellm%20prod")
+    assert endpoint is not None and endpoint.namespace == "litellm prod"
+
+
+MISPARSED_AUTHORITY_DSNS = (
+    ("postgresql://litellm:/kJ8xQz+9wT@db.internal:5432/litellm", "kJ8xQz+9wT"),
+    ("postgresql://litellm:12345/aBcD@db.internal:5432/litellm", "aBcD"),
+    # '#' sends the tail to the fragment and '?' to the query, so the path is
+    # empty and only the stranded userinfo '@' reveals the mis-split.
+    ("postgresql://litellm:12345#aBcD@db.internal/litellm", "aBcD"),
+    ("postgresql://litellm:12345?aBcD@db.internal/litellm", "aBcD"),
+    # A '?'-stranded tail that happens to parse as parameters, including one
+    # that hijacks the host= parameter into server.address.
+    ("postgresql://litellm:12345?a=aBcD@db.internal/litellm", "aBcD"),
+    ("postgresql://litellm:12345?host=aBcD@db.internal/litellm", "aBcD"),
+    # Both '/' and '?key=value' together: the slash leaves a clean path holding
+    # the password remainder and the query still parses, so only the stranded
+    # at-sign gives it away.
+    ("postgresql://litellm:12345/aBcD?x=1@db.internal/litellm", "aBcD"),
+)
+
+
+@pytest.mark.parametrize(("dsn", "secret"), MISPARSED_AUTHORITY_DSNS)
+def test_unencoded_slash_in_password_never_yields_an_endpoint(dsn, secret):
+    """An unencoded '/' truncates the authority, so urlparse reports the username
+    as the host and the password tail as the database. Postgres drivers reject
+    such a DSN outright, so the only safe reading is no endpoint at all."""
+    assert parse_database_endpoint(dsn) is None
+
+
+@pytest.mark.parametrize(("dsn", "secret"), MISPARSED_AUTHORITY_DSNS)
+def test_unencoded_slash_in_password_never_reaches_a_span(dsn, secret):
+    attrs = _resolve("postgres", "get_data", database_url=dsn)
+    exported = " ".join(str(value) for value in attrs.values())
+    assert secret not in exported
+    assert "db.namespace" not in attrs
+    assert "server.address" not in attrs
+
+
+def test_extra_path_segment_yields_no_endpoint():
+    """A database name cannot hold an unencoded '/', so a second path segment
+    means the authority was mis-split even when no '@' survived into the path."""
+    assert parse_database_endpoint("postgresql://db.internal:5432/litellm/extra") is None
+
+
+@pytest.mark.parametrize("dsn", [d for d, _ in MISPARSED_AUTHORITY_DSNS])
+def test_a_mis_split_authority_never_exports_the_database_username(dsn):
+    """The username lands in ``parsed.hostname`` when the authority truncates, so
+    a span would name the DB user as the server."""
+    attrs = _resolve("postgres", "get_data", database_url=dsn)
+    assert "server.address" not in attrs
+    assert "litellm" not in " ".join(str(v) for v in attrs.values())
+
+
+@pytest.mark.parametrize(
+    "dsn",
+    [
+        "postgresql://db.internal:5432/litellm?application_name=svc@prod",
+        "postgresql://db.internal:5432/litellm?user=admin@company.com",
+    ],
+)
+def test_an_unencoded_at_sign_in_a_query_forfeits_the_endpoint(dsn):
+    """This shape is byte-for-byte indistinguishable from a mis-split password,
+    so it resolves to no endpoint rather than risking a credential fragment.
+    Percent-encoding the at-sign restores the attributes."""
+    assert parse_database_endpoint(dsn) is None
+    assert parse_database_endpoint(dsn.replace("@", "%40")) is not None
+
+
+def test_host_and_port_query_parameters_are_honoured_together():
+    assert parse_database_endpoint("postgresql://ignored/litellm?host=real.internal&port=6543") == DatabaseEndpoint(
+        address="real.internal", port=6543, namespace="litellm"
+    )
+
+
+def test_percent_encoded_password_still_resolves_the_endpoint():
+    """The encoded spelling is the one a driver accepts, so it must keep working."""
+    assert parse_database_endpoint("postgresql://litellm:pa%2Fssw0rd@db.internal:5432/litellm") == DatabaseEndpoint(
+        address="db.internal", port=5432, namespace="litellm"
+    )
+
+
+def test_hostless_socket_dsn_still_names_the_database():
+    """``postgresql:///litellm`` is a valid local-socket DSN that Prisma accepts,
+    so the database is knowable even though no server address is."""
+    assert parse_database_endpoint("postgresql:///litellm") == DatabaseEndpoint(
+        address=None, port=None, namespace="litellm"
+    )
+
+
+def test_hostless_socket_dsn_emits_namespace_without_a_server():
+    attrs = _resolve("postgres", "get_data", database_url="postgresql:///litellm")
+    assert attrs["db.namespace"] == "litellm"
+    assert "server.address" not in attrs
+    assert "server.port" not in attrs
+
+
+def test_dsn_with_neither_host_nor_database_yields_no_endpoint():
+    assert parse_database_endpoint("postgresql://") is None
+
+
+def test_prisma_default_schema_is_left_implicit():
+    endpoint = parse_database_endpoint("postgresql://u:p@db.internal/litellm?schema=public")
+    assert endpoint is not None and endpoint.namespace == "litellm"
+
+
+@pytest.mark.parametrize("spelling", ["PUBLIC", "Public", "reporting"])
+def test_a_non_default_schema_stays_in_the_namespace(spelling):
+    """Prisma quotes the schema name, so ``?schema=PUBLIC`` provisions a second
+    schema alongside ``public`` with its own tables. Case-folding them into one
+    namespace would report two different schemas as the same database."""
+    endpoint = parse_database_endpoint(f"postgresql://u:p@db.internal/litellm?schema={spelling}")
+    assert endpoint is not None and endpoint.namespace == f"litellm|{spelling}"
+
+
+def test_postgres_scheme_alias_is_accepted():
+    assert parse_database_endpoint("postgres://u:p@db.internal/litellm") == DatabaseEndpoint(
+        address="db.internal", port=5432, namespace="litellm"
+    )
+
+
+@pytest.mark.parametrize(
+    "dsn",
+    [
+        None,
+        "",
+        "mysql://u:p@db.internal:3306/litellm",
+        "postgresql://u:p@db.internal:not-a-port/litellm",
+        "not a url at all",
+    ],
+)
+def test_unusable_dsn_degrades_to_no_endpoint(dsn):
+    assert parse_database_endpoint(dsn) is None
+
+
+def test_database_without_name_or_schema_has_no_namespace():
+    assert parse_database_endpoint("postgresql://u:p@db.internal:5432/") == DatabaseEndpoint(
+        address="db.internal", port=5432, namespace=None
+    )
+
+
+def test_postgres_service_span_carries_system_operation_and_endpoint():
+    assert _resolve("postgres", "get_data", database_url=REMOTE_DSN) == {
+        "db.system.name": "postgresql",
+        "db.system": "postgresql",
+        "db.operation.name": "get_data",
+        "server.address": "litellm-prod.abc123.us-east-1.rds.amazonaws.com",
+        "server.port": 6432,
+        "db.namespace": "litellm|reporting",
+    }
+
+
+def test_legacy_db_system_is_dual_emitted_for_datadog():
+    """Datadog's OTLP intake infers the database span type from ``db.system``,
+    not from the semconv-current ``db.system.name``."""
+    assert _resolve("postgres", "get_data", database_url=LOCAL_DSN)["db.system"] == "postgresql"
+    assert _resolve("redis", "set")["db.system"] == "redis"
+
+
+def test_batch_write_service_is_also_attributed_to_postgres():
+    attrs = _resolve("batch_write_to_db", "_PROXY_track_cost_callback", database_url=REMOTE_DSN)
+    assert attrs["db.system.name"] == "postgresql"
+    assert attrs["server.address"] == "litellm-prod.abc123.us-east-1.rds.amazonaws.com"
+
+
+def test_redis_service_never_borrows_the_postgres_endpoint():
+    assert _resolve("redis", "set", database_url=REMOTE_DSN) == {
+        "db.system.name": "redis",
+        "db.system": "redis",
+        "db.operation.name": "set",
+    }
+
+
+def test_non_datastore_service_gets_no_db_attributes():
+    assert _resolve("reset_budget_job", "reset_budget", database_url=REMOTE_DSN) == {}
+
+
+def test_configured_read_replica_suppresses_the_endpoint_rather_than_naming_the_primary():
+    """Reads are routed to the replica per Prisma call, underneath the span, so
+    naming the writer would pin replica latency onto the primary."""
+    attrs = _resolve("postgres", "get_data", database_url=REMOTE_DSN, read_replica_url=REPLICA_DSN)
+    assert attrs == {
+        "db.system.name": "postgresql",
+        "db.system": "postgresql",
+        "db.operation.name": "get_data",
+    }
+
+
+def test_endpoint_attributes_are_omitted_when_database_url_is_unset():
+    assert _resolve("postgres", "get_data") == {
+        "db.system.name": "postgresql",
+        "db.system": "postgresql",
+        "db.operation.name": "get_data",
+    }
+
+
+def test_blank_call_type_does_not_emit_an_empty_operation_attribute():
+    assert "db.operation.name" not in _resolve("postgres", "")
+    assert "db.operation.name" not in _resolve("postgres", None)
+
+
+@pytest.mark.parametrize(
+    ("dsn", "secrets"),
+    [
+        (LOCAL_DSN, ("dbpassword9090", "llmproxy")),
+        (REMOTE_DSN, ("s3cr3t", "llmproxy", "sslmode")),
+        (REPLICA_DSN, ("r3ad0nly", "reader")),
+    ],
+)
+def test_no_credential_reaches_any_exported_attribute(dsn, secrets):
+    attrs = _resolve("postgres", "get_data", database_url=dsn)
+    assert attrs["server.address"]
+    exported = " ".join(str(value) for value in attrs.values())
+    for secret in secrets:
+        assert secret not in exported
+
+
+def test_a_runtime_endpoint_change_is_reflected_on_the_next_span():
+    """The RDS IAM refresh, the reconnect path and the DB-backed
+    environment_variables overlay can all rewrite DATABASE_URL after startup, so
+    a value cached for the process lifetime would report a server the process no
+    longer talks to."""
+    first = _resolve("postgres", "get_data", database_url=LOCAL_DSN)
+    assert first["server.address"] == "localhost"
+    moved = _resolve("postgres", "get_data", database_url=REMOTE_DSN)
+    assert moved["server.address"] == "litellm-prod.abc123.us-east-1.rds.amazonaws.com"
+
+
+def test_a_replica_configured_after_the_first_span_suppresses_the_endpoint():
+    assert _resolve("postgres", "get_data", database_url=REMOTE_DSN)["server.address"]
+    later = _resolve("postgres", "get_data", database_url=REMOTE_DSN, read_replica_url=REPLICA_DSN)
+    assert "server.address" not in later
diff --git a/tests/test_litellm/integrations/otel/test_otel_v2_logger.py b/tests/test_litellm/integrations/otel/test_otel_v2_logger.py
index 82b074220fa..bb2d970e9c7 100644
--- a/tests/test_litellm/integrations/otel/test_otel_v2_logger.py
+++ b/tests/test_litellm/integrations/otel/test_otel_v2_logger.py
@@ -8,6 +8,8 @@ hooks, proxy SERVER span lifecycle (start + setters), parent-context resolution
 
 import asyncio
 import contextlib
+import os
+from unittest.mock import patch
 from datetime import datetime, timedelta, timezone
 
 import pytest
@@ -1521,6 +1523,36 @@ def test_async_service_success_hook_emits_service_span():
     assert span.status.status_code is StatusCode.UNSET
 
 
+def test_postgres_db_span_names_the_database_server_not_the_prisma_engine():
+    """Prisma reaches Postgres over loopback, so without server.address the
+    backend attributes the wait to localhost."""
+    dsn = "postgresql://llmproxy:dbpassword9090@litellm-prod.abc123.us-east-1.rds.amazonaws.com:6432/litellm?schema=reporting"
+    logger, exporter = _logger()
+    parent = _service_parent(logger)
+    try:
+        with patch.dict(os.environ, {"DATABASE_URL": dsn}, clear=False):
+            os.environ.pop("DATABASE_URL_READ_REPLICA", None)
+            asyncio.run(
+                logger.async_service_success_hook(
+                    payload=_ServicePayload("postgres", "get_data"),
+                    parent_otel_span=parent,
+                )
+            )
+    finally:
+        parent.end()
+    span = {s.name: s for s in exporter.get_finished_spans()}["postgres get_data"]
+    assert span.kind is SpanKind.CLIENT
+    assert span.attributes["db.system.name"] == "postgresql"
+    assert span.attributes["db.operation.name"] == "get_data"
+    assert span.attributes["server.address"] == "litellm-prod.abc123.us-east-1.rds.amazonaws.com"
+    assert span.attributes["server.port"] == 6432
+    assert span.attributes["db.namespace"] == "litellm|reporting"
+    assert span.attributes["db.system"] == "postgresql"
+    exported = " ".join(str(value) for value in span.attributes.values())
+    assert "dbpassword9090" not in exported
+    assert "llmproxy" not in exported
+
+
 def test_async_service_failure_hook_marks_error_status():
     logger, exporter = _logger()
     parent = _service_parent(logger)
diff --git a/tests/test_litellm/integrations/test_opentelemetry.py b/tests/test_litellm/integrations/test_opentelemetry.py
index fa1c9fa8a79..28d2cb22e7c 100644
--- a/tests/test_litellm/integrations/test_opentelemetry.py
+++ b/tests/test_litellm/integrations/test_opentelemetry.py
@@ -34,6 +34,7 @@ from litellm.integrations.opentelemetry import (
     _normalize_team_metadata_keys,
 )
 from litellm.litellm_core_utils.safe_json_dumps import safe_dumps
+from litellm.types.services import ServiceLoggerPayload, ServiceTypes
 
 
 class TestOpenTelemetryGuardrails(unittest.TestCase):
@@ -6212,3 +6213,110 @@ class TestDynamicTracerProviderCache(unittest.TestCase):
 
         self.assertTrue(entry.owns_exporter)
         self.assertIsNotNone(entry.provider._atexit_handler)
+class TestOpenTelemetryDatabaseSemconvAttributes(unittest.TestCase):
+    """A Postgres service span must name the PostgreSQL server it reached.
+
+    Without ``db.system`` and ``server.address``, the only host in the trace is
+    the loopback address of Prisma's local query engine, so the backend
+    attributes the wait to ``localhost`` and it cannot be correlated with the
+    database's own metrics.
+    """
+
+    DSN = "postgresql://llmproxy:dbpassword9090@litellm-prod.abc123.us-east-1.rds.amazonaws.com:6432/litellm?schema=reporting"
+    REPLICA_DSN = "postgresql://reader:r3ad0nly@litellm-prod-ro.abc123.us-east-1.rds.amazonaws.com/litellm"
+
+    def _service_span(self, service, call_type, dsn, error=None, replica_dsn=None):
+        exporter = InMemorySpanExporter()
+        provider = TracerProvider()
+        provider.add_span_processor(SimpleSpanProcessor(exporter))
+        otel = OpenTelemetry()
+        otel.tracer = provider.get_tracer(__name__)
+        parent = otel.tracer.start_span("Received Proxy Server Request")
+        payload = ServiceLoggerPayload(
+            is_error=error is not None,
+            error=error,
+            service=service,
+            duration=0.25,
+            call_type=call_type,
+            event_metadata=None,
+        )
+        hook = otel.async_service_failure_hook if error else otel.async_service_success_hook
+        kwargs = {"error": error} if error else {}
+        env = {k: v for k, v in (("DATABASE_URL", dsn), ("DATABASE_URL_READ_REPLICA", replica_dsn)) if v}
+        with patch.dict(os.environ, env, clear=False):
+            for absent in {"DATABASE_URL", "DATABASE_URL_READ_REPLICA"} - set(env):
+                os.environ.pop(absent, None)
+            asyncio.run(
+                hook(
+                    payload=payload,
+                    parent_otel_span=parent,
+                    start_time=datetime.now(),
+                    end_time=datetime.now(),
+                    **kwargs,
+                )
+            )
+        parent.end()
+        return next(s for s in exporter.get_finished_spans() if s.name == service.value)
+
+    def test_postgres_span_names_the_database_server(self):
+        span = self._service_span(ServiceTypes.DB, "get_data", self.DSN)
+        self.assertEqual(span.attributes["db.system.name"], "postgresql")
+        self.assertEqual(span.attributes["db.operation.name"], "get_data")
+        self.assertEqual(
+            span.attributes["server.address"],
+            "litellm-prod.abc123.us-east-1.rds.amazonaws.com",
+        )
+        self.assertEqual(span.attributes["server.port"], 6432)
+        self.assertEqual(span.attributes["db.namespace"], "litellm|reporting")
+
+    def test_datastore_span_is_a_client_span_carrying_the_legacy_db_system(self):
+        """Datadog types a span as a database call from CLIENT kind plus
+        ``db.system``; an INTERNAL span is classified as custom work."""
+        span = self._service_span(ServiceTypes.DB, "get_data", self.DSN)
+        self.assertEqual(span.kind, trace.SpanKind.CLIENT)
+        self.assertEqual(span.attributes["db.system"], "postgresql")
+
+    def test_internal_service_span_stays_internal(self):
+        span = self._service_span(ServiceTypes.RESET_BUDGET_JOB, "reset_budget", self.DSN)
+        self.assertEqual(span.kind, trace.SpanKind.INTERNAL)
+        self.assertNotIn("db.system.name", span.attributes)
+        self.assertNotIn("server.address", span.attributes)
+
+    def test_existing_service_and_call_type_attributes_are_unchanged(self):
+        span = self._service_span(ServiceTypes.DB, "get_data", self.DSN)
+        self.assertEqual(span.attributes["service"], "postgres")
+        self.assertEqual(span.attributes["call_type"], "get_data")
+
+    def test_failed_postgres_span_also_names_the_database_server(self):
+        span = self._service_span(ServiceTypes.DB, "get_data", self.DSN, error="connection refused")
+        self.assertEqual(span.attributes["db.system.name"], "postgresql")
+        self.assertEqual(span.kind, trace.SpanKind.CLIENT)
+        self.assertEqual(
+            span.attributes["server.address"],
+            "litellm-prod.abc123.us-east-1.rds.amazonaws.com",
+        )
+        self.assertEqual(span.attributes["error"], "connection refused")
+
+    def test_no_credential_from_the_dsn_lands_on_the_span(self):
+        span = self._service_span(ServiceTypes.DB, "get_data", self.DSN)
+        exported = " ".join(str(value) for value in span.attributes.values())
+        self.assertIn("litellm-prod.abc123.us-east-1.rds.amazonaws.com", exported)
+        self.assertNotIn("dbpassword9090", exported)
+        self.assertNotIn("llmproxy", exported)
+
+    def test_redis_span_does_not_borrow_the_postgres_endpoint(self):
+        span = self._service_span(ServiceTypes.REDIS, "async_set_cache", self.DSN)
+        self.assertEqual(span.attributes["db.system.name"], "redis")
+        self.assertEqual(span.kind, trace.SpanKind.CLIENT)
+        self.assertNotIn("server.address", span.attributes)
+
+    def test_configured_read_replica_suppresses_the_endpoint(self):
+        span = self._service_span(ServiceTypes.DB, "get_data", self.DSN, replica_dsn=self.REPLICA_DSN)
+        self.assertEqual(span.attributes["db.system.name"], "postgresql")
+        self.assertNotIn("server.address", span.attributes)
+        self.assertNotIn("db.namespace", span.attributes)
+
+    def test_unset_database_url_leaves_the_span_without_endpoint_attributes(self):
+        span = self._service_span(ServiceTypes.DB, "get_data", None)
+        self.assertEqual(span.attributes["db.system.name"], "postgresql")
+        self.assertNotIn("server.address", span.attributes)
diff --git a/tests/test_litellm/litellm_core_utils/prompt_templates/test_litellm_core_utils_prompt_templates_common_utils.py b/tests/test_litellm/litellm_core_utils/prompt_templates/test_litellm_core_utils_prompt_templates_common_utils.py
index af40245ebfa..f9311497729 100644
--- a/tests/test_litellm/litellm_core_utils/prompt_templates/test_litellm_core_utils_prompt_templates_common_utils.py
+++ b/tests/test_litellm/litellm_core_utils/prompt_templates/test_litellm_core_utils_prompt_templates_common_utils.py
@@ -241,10 +241,32 @@ def test_split_concatenated_json_non_dict_value():
     assert result == [{}]
 
 
-def test_split_concatenated_json_invalid_raises():
-    """Completely invalid JSON raises JSONDecodeError."""
-    with pytest.raises(json.JSONDecodeError):
-        split_concatenated_json_objects("not json at all")
+def test_split_concatenated_json_wholly_invalid_returns_empty():
+    """
+    Wholly unparseable JSON degrades to an empty list instead of raising.
+
+    Regression for https://github.com/BerriAI/litellm/issues/18667: a raise
+    here propagated out of `_convert_to_bedrock_tool_call_invoke` and turned
+    every replayed conversation into a 500.
+    """
+    assert split_concatenated_json_objects("not json at all") == []
+
+
+def test_split_concatenated_json_malformed_object_returns_empty():
+    """
+    A single malformed object (missing comma between keys) degrades to an
+    empty list rather than raising `Expecting ',' delimiter`.
+    """
+    assert split_concatenated_json_objects('{"location": "Boston" "unit": "celsius"}') == []
+
+
+def test_split_concatenated_json_salvages_prefix_before_truncated_tail():
+    """
+    Complete objects parsed before an unparseable/truncated tail are kept;
+    only the bad tail is discarded.
+    """
+    result = split_concatenated_json_objects('{"a": 1}{"b": 2}{"c":')
+    assert result == [{"a": 1}, {"b": 2}]
 
 
 # ---------------------------------------------------------------------------
diff --git a/tests/test_litellm/litellm_core_utils/prompt_templates/test_litellm_core_utils_prompt_templates_factory.py b/tests/test_litellm/litellm_core_utils/prompt_templates/test_litellm_core_utils_prompt_templates_factory.py
index de5d0a180c6..fffbc884782 100644
--- a/tests/test_litellm/litellm_core_utils/prompt_templates/test_litellm_core_utils_prompt_templates_factory.py
+++ b/tests/test_litellm/litellm_core_utils/prompt_templates/test_litellm_core_utils_prompt_templates_factory.py
@@ -2287,6 +2287,116 @@ def test_bedrock_tool_call_invoke_non_dict_arguments():
     assert result[0]["toolUse"]["input"] == {}
 
 
+def test_bedrock_tool_call_invoke_malformed_json_does_not_raise():
+    """
+    Regression for https://github.com/BerriAI/litellm/issues/18667.
+
+    When the model emits malformed JSON in tool-call arguments (here a
+    missing comma between keys), replaying that history must NOT raise
+    `Unable to convert openai tool calls ... Expecting ',' delimiter`.
+    It degrades to an empty-object input so the conversation can continue.
+    """
+    tool_calls = [
+        {
+            "id": "toolu_abc123",
+            "type": "function",
+            "function": {
+                "name": "get_weather",
+                "arguments": '{"location": "Boston" "unit": "celsius"}',
+            },
+        }
+    ]
+    result = _convert_to_bedrock_tool_call_invoke(tool_calls)
+    assert len(result) == 1
+    assert result[0]["toolUse"]["toolUseId"] == "toolu_abc123"
+    assert result[0]["toolUse"]["name"] == "get_weather"
+    assert result[0]["toolUse"]["input"] == {}
+
+
+def test_bedrock_tool_call_invoke_salvages_valid_prefix_before_truncated_tail():
+    """
+    A valid leading object followed by a truncated tail keeps the valid
+    object rather than dropping everything or raising.
+    """
+    tool_calls = [
+        {
+            "id": "call_partial",
+            "type": "function",
+            "function": {"name": "shell", "arguments": '{"cmd": "ls"}{"cmd":'},
+        }
+    ]
+    result = _convert_to_bedrock_tool_call_invoke(tool_calls)
+    assert len(result) == 1
+    assert result[0]["toolUse"]["input"] == {"cmd": "ls"}
+
+
+def test_bedrock_tool_call_invoke_mixed_turn_survives_one_malformed_call():
+    """
+    Regression for LIT-4574: an assistant turn with several tool calls where only one
+    has malformed/truncated arguments must keep the valid calls intact and degrade just
+    the bad one to empty input, instead of killing the entire turn.
+    """
+    tool_calls = [
+        {
+            "id": "t_good",
+            "type": "function",
+            "function": {
+                "name": "good_tool",
+                "arguments": '{"item_type": "email", "item_id": "AAMkAD=="}',
+            },
+        },
+        {
+            "id": "t_bad",
+            "type": "function",
+            "function": {"name": "bad_tool", "arguments": '{"item_type": "email"'},
+        },
+    ]
+    result = _convert_to_bedrock_tool_call_invoke(tool_calls)
+    tool_uses = [block["toolUse"] for block in result if "toolUse" in block]
+    assert len(tool_uses) == 2
+    by_name = {tool_use["name"]: tool_use for tool_use in tool_uses}
+    assert by_name["good_tool"]["input"] == {"item_type": "email", "item_id": "AAMkAD=="}
+    assert by_name["bad_tool"]["input"] == {}
+
+
+def test_bedrock_tool_call_invoke_truncated_json_arguments():
+    """
+    Truncated tool call arguments (issue #35303) must not raise. A client replaying a
+    partially streamed tool call would otherwise trigger a pre-network exception that the
+    router maps to a retryable APIConnectionError and retries through the fallback graph.
+    """
+    tool_calls = [
+        {
+            "id": "tooluse_MAh2QLVjBRkvi5QJkLQ08V",
+            "type": "function",
+            "function": {
+                "name": "replace_note_content",
+                "arguments": '{"note_id": "999af35c-4061-4ece-8581-7d43fc988ba4", "title": "WG"',
+            },
+        }
+    ]
+    result = _convert_to_bedrock_tool_call_invoke(tool_calls)
+    assert len(result) == 1
+    assert result[0]["toolUse"]["toolUseId"] == "tooluse_MAh2QLVjBRkvi5QJkLQ08V"
+    assert result[0]["toolUse"]["input"] == {}
+
+
+def test_bedrock_tool_call_invoke_unconvertible_raises_non_retryable_bad_request():
+    """
+    Conversion failures are client input errors, so they must surface as a non-retryable
+    BadRequestError instead of a bare Exception that maps to APIConnectionError, and the
+    message must not embed the tool call payload (issue #35303).
+    """
+    tool_calls = [{"id": "call_bad", "type": "function", "function": None}]
+
+    with pytest.raises(litellm.BadRequestError) as exc_info:
+        _convert_to_bedrock_tool_call_invoke(tool_calls)
+
+    assert exc_info.value.status_code == 400
+    assert "call_bad" in str(exc_info.value)
+    assert "function" not in str(exc_info.value).split("Received error=")[0]
+
+
 def test_make_valid_bedrock_tool_name_preserves_hyphens():
     assert make_valid_bedrock_tool_name("my-tool") == "my-tool"
     assert (
diff --git a/tests/test_litellm/litellm_core_utils/test_litellm_logging.py b/tests/test_litellm/litellm_core_utils/test_litellm_logging.py
index e46057fe11a..99781a2f211 100644
--- a/tests/test_litellm/litellm_core_utils/test_litellm_logging.py
+++ b/tests/test_litellm/litellm_core_utils/test_litellm_logging.py
@@ -4918,3 +4918,51 @@ def test_payload_without_guardrail_cost_is_unchanged(logging_obj):
     assert payload is not None
     assert payload["response_cost"] == pytest.approx(0.0000429)
     assert payload["cost_breakdown"] is None
+
+
+_AWS_SECRET = "wJalrXUtnFEMIK7MDENGbPxRfiCYEXAMPLEKEY"
+_GEMINI_KEY = "AIzaSyC0000000000000000000000000000000"
+
+
+def test_empty_api_base_does_not_dump_call_state(logging_obj):
+    """Direct (non-HTTP) providers pass api_base='', which used to echo model_call_details."""
+    logging_obj.model_call_details["litellm_params"] = {
+        "api_key": "sk-proj-hunter2hunter2hunter2hunter2",
+        "aws_secret_access_key": _AWS_SECRET,
+    }
+
+    curl_command = logging_obj._get_request_curl_command(
+        api_base="",
+        headers={},
+        additional_args={},
+        data={"model": "some-model"},
+    )
+
+    assert "litellm_call_id" not in curl_command
+    assert _AWS_SECRET not in curl_command
+    assert "hunter2" not in curl_command
+
+
+def test_pre_call_redacts_and_masks_raw_request(logging_obj):
+    """log_raw_request_response echoes the request body and api_base back to loggers/UI."""
+    metadata = {"user_api_key_alias": "qa-key"}
+    logging_obj.model_call_details["litellm_params"] = {"metadata": metadata}
+    logging_obj.log_raw_request_response = True
+
+    logging_obj.pre_call(
+        input="hi",
+        api_key="",
+        additional_args={
+            "api_base": f"https://generativelanguage.googleapis.com/v1beta/models/x:generateContent?key={_GEMINI_KEY}",
+            "headers": {},
+            "complete_input_dict": {"aws_secret_access_key": _AWS_SECRET},
+        },
+    )
+
+    raw_request = metadata["raw_request"]
+    assert _AWS_SECRET not in raw_request
+    assert "REDACTED" in raw_request
+
+    raw_api_base = logging_obj.model_call_details["raw_request_typed_dict"]["raw_request_api_base"]
+    assert _GEMINI_KEY not in raw_api_base
+    assert "key=*****" in raw_api_base
diff --git a/tests/test_litellm/llms/bedrock/chat/test_converse_transformation.py b/tests/test_litellm/llms/bedrock/chat/test_converse_transformation.py
index 2509f6480d5..298360789eb 100644
--- a/tests/test_litellm/llms/bedrock/chat/test_converse_transformation.py
+++ b/tests/test_litellm/llms/bedrock/chat/test_converse_transformation.py
@@ -6043,3 +6043,12 @@ def test_streaming_usage_chunk_is_transformed():
     assert chunk.usage.prompt_tokens == 11
     assert chunk.usage.completion_tokens == 4
     assert chunk.usage.total_tokens == 15
+
+
+def test_update_optional_params_with_thinking_tokens_bool_thinking_does_not_crash():
+    config = AmazonConverseConfig()
+    optional_params = {"thinking": True}
+    config.update_optional_params_with_thinking_tokens(
+        non_default_params={"thinking": True}, optional_params=optional_params
+    )
+    assert "maxTokens" not in optional_params
diff --git a/tests/test_litellm/llms/custom_httpx/test_llm_http_handler.py b/tests/test_litellm/llms/custom_httpx/test_llm_http_handler.py
index 2dda8bf722a..69f2312f203 100644
--- a/tests/test_litellm/llms/custom_httpx/test_llm_http_handler.py
+++ b/tests/test_litellm/llms/custom_httpx/test_llm_http_handler.py
@@ -1,7 +1,9 @@
 import asyncio
 import json
+import logging
 import os
 import sys
+import time
 from unittest.mock import AsyncMock, Mock, patch
 
 import httpx
@@ -9,6 +11,7 @@ import pytest
 
 sys.path.insert(0, os.path.abspath("../../../.."))  # Adds the parent directory to the system path
 import litellm
+from litellm._logging import verbose_logger
 from litellm.integrations.code_interpreter_interception.handler import (
     CodeInterpreterInterceptionLogger,
     LITELLM_CODE_EXECUTION_TOOL_NAME,
@@ -2158,3 +2161,68 @@ async def test_vector_store_search_handler_direct_config_async_skips_http():
     pre_call_args = logging_obj.pre_call.call_args.kwargs["additional_args"]
     assert pre_call_args["query"] == ["q1", "q2"]
     assert pre_call_args["vector_store_id"] == "vs_direct"
+
+
+def _direct_vector_store_debug_logging_obj():
+    from litellm.litellm_core_utils.litellm_logging import Logging as LitellmLogging
+
+    logging_obj = LitellmLogging(
+        model="valkey",
+        messages=[{"role": "user", "content": "q"}],
+        stream=False,
+        call_type="vector_store_search",
+        start_time=time.time(),
+        litellm_call_id="vs-debug-call-id",
+        function_id="vs-debug-function-id",
+        log_raw_request_response=True,
+    )
+    logging_obj.update_environment_variables(
+        model="valkey",
+        optional_params={"vector_store_id": "vs_direct", "query": "q"},
+        litellm_params={
+            "litellm_call_id": "vs-debug-call-id",
+            "vector_store_id": "vs_direct",
+            "litellm_request_debug": True,
+            "metadata": {"user_api_key_alias": "vs-test-key"},
+            "valkey_host": "valkey.internal",
+            "valkey_password": "sup3r-s3cret-valkey-pw",
+            "litellm_embedding_config": {"api_key": "sk-embedding-s3cret"},
+        },
+    )
+    return logging_obj
+
+
+@pytest.mark.parametrize("is_async", [False, True])
+def test_direct_vector_store_search_debug_log_omits_stored_credentials(caplog, is_async):
+    """Regression: an empty api_base made pre_call dump the whole model_call_details, so every
+    search shipped the stored valkey_password / embedding api_key into the raw_request metadata."""
+    handler = BaseLLMHTTPHandler()
+    stub_response = {"object": "vector_store.search_results.page", "search_query": "q", "data": []}
+    config = _make_stub_direct_vector_store_config(stub_response)
+    logging_obj = _direct_vector_store_debug_logging_obj()
+
+    with caplog.at_level(logging.DEBUG, logger=verbose_logger.name):
+        result = handler.vector_store_search_handler(
+            vector_store_id="vs_direct",
+            query="q",
+            vector_store_search_optional_params={"max_num_results": 4},
+            vector_store_provider_config=config,
+            custom_llm_provider="valkey",
+            litellm_params=GenericLiteLLMParams(
+                valkey_host="valkey.internal",
+                valkey_password="sup3r-s3cret-valkey-pw",
+            ),
+            logging_obj=logging_obj,
+            _is_async=is_async,
+        )
+        if is_async:
+            result = asyncio.run(result)
+
+    assert result is stub_response
+    raw_request = logging_obj.model_call_details["litellm_params"]["metadata"]["raw_request"]
+    assert "sup3r-s3cret-valkey-pw" not in raw_request
+    assert "sk-embedding-s3cret" not in raw_request
+    assert "valkey://vs_direct" in raw_request
+    logged = "\n".join(record.getMessage() for record in caplog.records)
+    assert "sup3r-s3cret-valkey-pw" not in logged
+    assert "sk-embedding-s3cret" not in logged
diff --git a/tests/test_litellm/llms/dashscope/test_dashscope_cost_calculator.py b/tests/test_litellm/llms/dashscope/test_dashscope_cost_calculator.py
index 6f5aaabae06..510776ddfdf 100644
--- a/tests/test_litellm/llms/dashscope/test_dashscope_cost_calculator.py
+++ b/tests/test_litellm/llms/dashscope/test_dashscope_cost_calculator.py
@@ -271,6 +271,47 @@ class TestDashscopeCostCalculator:
 
         assert math.isclose(prompt_cost, expected_prompt_cost, rel_tol=1e-10)
 
+    def test_dashscope_nested_cache_creation_input_tokens_bill_at_cache_write_rate(self):
+        """
+        Regression (LIT-5757): DashScope nests cache_creation_input_tokens inside
+        prompt_tokens_details; those tokens must bill at the tier's cache-creation
+        rate instead of being folded into text tokens at the input rate.
+        """
+        self._register_tiered_model(
+            "dashscope/qwen-nested-cache-write-test",
+            [
+                {
+                    "range": [0, 128000],
+                    "input_cost_per_token": 4e-07,
+                    "cache_read_input_token_cost": 1.6e-07,
+                    "cache_creation_input_token_cost": 5e-07,
+                    "output_cost_per_token": 1.6e-06,
+                }
+            ],
+        )
+
+        usage = Usage(
+            prompt_tokens=2059,
+            completion_tokens=201,
+            total_tokens=2260,
+            prompt_tokens_details={
+                "cached_tokens": 0,
+                "text_tokens": 2059,
+                "cache_type": "ephemeral",
+                "cache_creation_input_tokens": 2048,
+                "cache_creation": {"ephemeral_5m_input_tokens": 2048},
+            },
+            completion_tokens_details={"reasoning_tokens": 170},
+        )
+
+        prompt_cost, _ = dashscope_cost_per_token(
+            model="qwen-nested-cache-write-test", usage=usage
+        )
+
+        assert math.isclose(
+            prompt_cost, (2048 * 5e-07) + (11 * 4e-07), rel_tol=1e-10
+        )
+
     def test_dashscope_tiered_cache_creation_falls_back_to_tier_input_rate(self):
         """
         Tiers without a cache_creation_input_token_cost bill cache-creation tokens at
diff --git a/tests/test_litellm/llms/deepseek/chat/test_deepseek_chat_transformation.py b/tests/test_litellm/llms/deepseek/chat/test_deepseek_chat_transformation.py
index ec51e5d303d..d5783e3567f 100644
--- a/tests/test_litellm/llms/deepseek/chat/test_deepseek_chat_transformation.py
+++ b/tests/test_litellm/llms/deepseek/chat/test_deepseek_chat_transformation.py
@@ -101,3 +101,8 @@ async def test_async_transform_request_strips_unsupported_tools_from_body():
 
     assert [tool["type"] for tool in body["tools"]] == ["function"]
     assert body["tools"][0]["function"]["name"] == "shell"
+
+
+def test_thinking_mode_active_bool_thinking_returns_false_without_crashing():
+    config = DeepSeekChatConfig()
+    assert config._thinking_mode_active(model="deepseek-reasoner", optional_params={"thinking": True}) is False
diff --git a/tests/test_litellm/llms/tinyfish/test_tinyfish_search.py b/tests/test_litellm/llms/tinyfish/test_tinyfish_search.py
index 58363e3baea..2dcccb8ea7e 100644
--- a/tests/test_litellm/llms/tinyfish/test_tinyfish_search.py
+++ b/tests/test_litellm/llms/tinyfish/test_tinyfish_search.py
@@ -47,7 +47,9 @@ def _make_mock_response(
 
     mock = MagicMock()
     mock.status_code = status_code
-    mock.headers = headers or {}
+    # httpx.Headers normalizes keys to lowercase — mirror production so tests
+    # assert what callers actually see.
+    mock.headers = httpx.Headers(headers or {})
     if json_data is not None:
         mock.json.return_value = json_data
         mock.text = text if text is not None else _json.dumps(json_data)
@@ -222,7 +224,7 @@ class TestTransformSearchRequest:
             assert param not in result["_tinyfish_params"]
 
     def test_arbitrary_param_passed_through(self):
-        # `fetch` is a TinyFish-specific param (JSON-encoded tf-fetch config).
+        # `fetch` is a TinyFish-specific param (JSON-encoded fetch config).
         # The passthrough loop should forward it verbatim without LiteLLM needing
         # to know about it.
         config = TinyfishSearchConfig()
@@ -237,26 +239,49 @@ class TestTransformSearchRequest:
         config = TinyfishSearchConfig()
         result = config.transform_search_request(
             query="test",
-            optional_params={"fetch": {"format": "html", "fetch_path": "fast"}},
-        )
-        assert (
-            result["_tinyfish_params"]["fetch"]
-            == '{"format":"html","fetch_path":"fast"}'
+            optional_params={"fetch": {"format": "html"}},
         )
+        assert result["_tinyfish_params"]["fetch"] == '{"format":"html"}'
 
     def test_bool_param_serialized_as_lowercase(self):
-        # urlencode renders Python bool as capitalized "True"/"False"; ux-labs
-        # rejects those (e.g. include_thumbnail must be literal "true"/"false").
-        # Normalize before passing through.
+        # urlencode renders Python bool as capitalized "True"/"False"; TinyFish
+        # Search's bool params require lowercase "true"/"false" strings on the
+        # wire. Normalize before passing through.
         config = TinyfishSearchConfig()
         true_result = config.transform_search_request(
-            query="test", optional_params={"include_thumbnail": True}
+            query="test", optional_params={"some_bool_param": True}
         )
         false_result = config.transform_search_request(
-            query="test", optional_params={"include_thumbnail": False}
+            query="test", optional_params={"some_bool_param": False}
         )
-        assert true_result["_tinyfish_params"]["include_thumbnail"] == "true"
-        assert false_result["_tinyfish_params"]["include_thumbnail"] == "false"
+        assert true_result["_tinyfish_params"]["some_bool_param"] == "true"
+        assert false_result["_tinyfish_params"]["some_bool_param"] == "false"
+
+    def test_float_param_passes_through(self):
+        # Float values pass the urlencode adapter and land on the wire as
+        # their decimal string form. If TinyFish's server rejects a float
+        # for a param it expects as int, the server's 400 response is
+        # attributed via _wrap_error (`TinyFish Search: ...`) — better than
+        # a client-side pydantic ValidationError with no context.
+        config = TinyfishSearchConfig()
+        result = config.transform_search_request(
+            query="test",
+            optional_params={"some_float_param": 0.5},
+        )
+        assert result["_tinyfish_params"]["some_float_param"] == 0.5
+
+    def test_list_param_auto_json_encoded(self):
+        # TinyFish Search's JSON-array params arrive on the wire as JSON-
+        # encoded strings. Accept the natural Python list form and serialize
+        # so the caller doesn't have to pre-stringify. Params whose wire
+        # format is a plain comma-separated string are the caller's
+        # responsibility to pass as a Python str.
+        config = TinyfishSearchConfig()
+        result = config.transform_search_request(
+            query="test",
+            optional_params={"some_list_param": ["a.example", "b.example"]},
+        )
+        assert result["_tinyfish_params"]["some_list_param"] == '["a.example","b.example"]'
 
     def test_pre_stringified_param_passed_unchanged(self):
         # If the caller already JSON-encoded, don't re-encode.
@@ -422,10 +447,104 @@ class TestTransformSearchResponse:
         assert getattr(first, "position", None) == 1
         assert getattr(first, "site_name", None) == "tinyfish.ai"
 
+    def test_top_level_extras_flow_through(self):
+        # TinyFish returns `query`, `total_results`, `page` at the envelope
+        # level. These must ride through to the caller via SearchResponse's
+        # extra="allow" so pagination logic, echo checks, etc. work.
+        config = TinyfishSearchConfig()
+        mock_response = _make_mock_response(MOCK_TINYFISH_RESPONSE)
+        result = config.transform_search_response(
+            raw_response=mock_response, logging_obj=None
+        )
+        assert getattr(result, "query", None) == "web automation tools"
+        assert getattr(result, "total_results", None) == 2
+        assert getattr(result, "page", None) == 0
+
+    def test_top_level_future_extras_flow_through(self):
+        # Any future TinyFish top-level field must ride through unchanged
+        # (design contract: no LiteLLM code change needed for new fields).
+        config = TinyfishSearchConfig()
+        body = {
+            "results": [
+                {"title": "x", "url": "https://x", "snippet": "x"},
+            ],
+            "query": "test",
+            "example_int_extra": 123,  # hypothetical future field
+            "example_str_extra": "value",  # hypothetical future field
+            "example_id_extra": "abc-def",  # hypothetical future field
+        }
+        result = config.transform_search_response(
+            raw_response=_make_mock_response(body), logging_obj=None
+        )
+        assert getattr(result, "example_int_extra", None) == 123
+        assert getattr(result, "example_str_extra", None) == "value"
+        assert getattr(result, "example_id_extra", None) == "abc-def"
+
+    def test_response_headers_stashed_on_hidden_params(self):
+        # TinyFish Search sets X-Request-ID on every success response. Confirm it
+        # lands on both `_hidden_params["headers"]` (raw) and
+        # `_hidden_params["additional_headers"]` (sanitized/prefixed).
+        # httpx.Headers lowercases every key, so assertions use lowercase.
+        config = TinyfishSearchConfig()
+        mock_response = _make_mock_response(
+            MOCK_TINYFISH_RESPONSE,
+            headers={"X-Request-ID": "req-abc-123", "Content-Type": "application/json"},
+        )
+        result = config.transform_search_response(
+            raw_response=mock_response, logging_obj=None
+        )
+        # Raw copy — httpx has normalized keys to lowercase.
+        assert result._hidden_params["headers"]["x-request-id"] == "req-abc-123"
+        # process_response_headers prefixes non-OpenAI-standard keys with "llm_provider-".
+        assert result._hidden_params["additional_headers"]["llm_provider-x-request-id"] == "req-abc-123"
+
+    def test_response_headers_future_headers_flow_through(self):
+        # "Accept extra": any header TinyFish Search adds later must ride
+        # through without a LiteLLM code change.
+        config = TinyfishSearchConfig()
+        mock_response = _make_mock_response(
+            MOCK_TINYFISH_RESPONSE,
+            headers={
+                "X-Request-ID": "req-1",
+                "X-Example-Header-A": "value-a",  # hypothetical future header
+                "X-Example-Header-B": "value-b",  # hypothetical future header
+            },
+        )
+        result = config.transform_search_response(
+            raw_response=mock_response, logging_obj=None
+        )
+        raw = result._hidden_params["headers"]
+        # httpx lowercases header names on read.
+        assert raw["x-example-header-a"] == "value-a"
+        assert raw["x-example-header-b"] == "value-b"
+
+    def test_response_headers_strips_x_litellm_spoof(self):
+        # A provider setting `x-litellm-*` in its response must not be able to
+        # spoof LiteLLM-internal markers via _hidden_params["additional_headers"].
+        # The raw copy preserves the header (opt-in debug view); the sanitized
+        # copy prefixes it with `llm_provider-` so bare `x-litellm-*` markers
+        # can't be spoofed (values still survive under the prefixed key for
+        # observability).
+        config = TinyfishSearchConfig()
+        mock_response = _make_mock_response(
+            MOCK_TINYFISH_RESPONSE,
+            headers={"x-litellm-attempted-fallbacks": "spoofed", "X-Request-ID": "r1"},
+        )
+        result = config.transform_search_response(
+            raw_response=mock_response, logging_obj=None
+        )
+        # Raw view still has the spoof.
+        assert result._hidden_params["headers"]["x-litellm-attempted-fallbacks"] == "spoofed"
+        # Sanitized view: the spoof survives only under the llm_provider- prefix
+        # (never under the bare x-litellm-* key that LiteLLM downstream trusts).
+        additional = result._hidden_params["additional_headers"]
+        assert "x-litellm-attempted-fallbacks" not in additional
+        assert additional.get("llm_provider-x-litellm-attempted-fallbacks") == "spoofed"
+
     def test_fetch_field_rides_through_to_search_result(self):
-        # Mirrors browser-search's per-result `fetch` nested object (see
-        # api/src/parser.rs SearchResult.fetch). Confirms `fetch=...` requests
-        # surface their content to LiteLLM callers without provider changes.
+        # Mirrors TinyFish Search's per-result `fetch` nested object.
+        # Confirms `fetch=...` requests surface their content to LiteLLM
+        # callers without provider changes.
         config = TinyfishSearchConfig()
         fetched = {
             "results": [
@@ -568,7 +687,7 @@ class TestTransformSearchResponse:
 
 class TestErrorHandling:
     def test_4xx_response_raises_with_attribution_and_unwrapped_message(self):
-        # Reproduces ux-labs' error envelope shape for an INVALID_INPUT response.
+        # Reproduces TinyFish Search's error envelope shape for an INVALID_INPUT response.
         config = TinyfishSearchConfig()
         body = {
             "error": {
@@ -590,7 +709,7 @@ class TestErrorHandling:
 
     def test_429_preserves_status_code_and_headers(self):
         config = TinyfishSearchConfig()
-        body = {"error": {"code": "RATE_LIMIT_EXCEEDED", "message": "60 rpm"}}
+        body = {"error": {"code": "RATE_LIMIT_EXCEEDED", "message": "rate limit exceeded"}}
         mock_response = _make_mock_response(
             body, status_code=429, headers={"Retry-After": "60"}
         )
@@ -600,10 +719,12 @@ class TestErrorHandling:
             )
         assert getattr(exc_info.value, "status_code", None) == 429
         headers = getattr(exc_info.value, "headers", {}) or {}
-        assert headers.get("Retry-After") == "60"
+        # httpx lowercases; the exception carries the same dict shape.
+        assert headers.get("retry-after") == "60"
 
-    def test_5xx_with_non_ux_labs_body_falls_back_to_raw_text(self):
-        # Cloudflare-style JSON or any other envelope: unwrap fails, fall back to raw.
+    def test_5xx_with_non_tinyfish_envelope_shape_falls_back_to_raw_text(self):
+        # A JSON body that doesn't match TinyFish Search's error envelope shape:
+        # unwrap fails, fall back to the raw body text.
         config = TinyfishSearchConfig()
         body = {"errors": [{"code": "10000", "message": "Internal"}]}
         mock_response = _make_mock_response(body, status_code=502)
diff --git a/tests/test_litellm/proxy/_experimental/mcp_server/test_mcp_server.py b/tests/test_litellm/proxy/_experimental/mcp_server/test_mcp_server.py
index 3392203dbab..051df30dfcb 100644
--- a/tests/test_litellm/proxy/_experimental/mcp_server/test_mcp_server.py
+++ b/tests/test_litellm/proxy/_experimental/mcp_server/test_mcp_server.py
@@ -6406,7 +6406,7 @@ async def test_execute_mcp_tool_rest_server_id_injects_requested_server_credenti
     with (
         patch.dict(
             mcp_module.global_mcp_server_manager.tool_name_to_mcp_server_name_mapping,
-            {"echo": collision_server.name},
+            {"echo": collision_server.name, "echo_requested-echo": requested_server.name},
         ),
         patch.object(
             mcp_module.global_mcp_server_manager,
@@ -8430,3 +8430,72 @@ class TestListFiltersHonorThePrefixBoundary:
 
         assert listed == callable_, f"grants={grants!r} listed={listed} callable={callable_}"
         assert listed is expected, f"grants={grants!r} expected={expected} got={listed}"
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize(
+    "auth_type",
+    [MCPAuth.authorization, MCPAuth.bearer_token, MCPAuth.api_key, MCPAuth.basic, MCPAuth.token],
+)
+async def test_list_tools_injects_byok_credential_for_non_oauth2_auth_types(auth_type):
+    """Regression for BYOK servers on a non-oauth2 auth_type: the stored per-user credential must be
+    attached when listing tools, otherwise the upstream 401 is absorbed and the server lists nothing."""
+    try:
+        from litellm.proxy._experimental.mcp_server.server import (
+            _get_tools_from_mcp_servers,
+            set_auth_context,
+        )
+    except ImportError:
+        pytest.skip("MCP server not available")
+
+    user_api_key_auth = UserAPIKeyAuth(api_key="test_key", user_id="byok_user")
+    set_auth_context(user_api_key_auth)
+
+    server = MagicMock()
+    server.server_id = "byok_server"
+    server.name = "byok"
+    server.alias = "byok"
+    server.server_name = "byok"
+    server.auth_type = auth_type
+    server.is_byok = True
+    server.allowed_tools = None
+    server.disallowed_tools = None
+    server.extra_headers = None
+    server.tool_name_to_display_name = None
+    server.tool_name_to_description = None
+
+    seen_auth_headers = []
+
+    async def mock_get_tools_from_server(server, mcp_auth_header=None, add_prefix=False, **kwargs):
+        seen_auth_headers.append(mcp_auth_header)
+        tool = MagicMock()
+        tool.name = f"{server.alias}-toolA" if add_prefix else "toolA"
+        tool.description = "desc"
+        tool.inputSchema = {}
+        return [tool]
+
+    mock_manager = MagicMock()
+    mock_manager.get_allowed_mcp_servers = AsyncMock(return_value=[server.server_id])
+    mock_manager.get_mcp_server_by_id = MagicMock(return_value=server)
+    mock_manager.filter_server_ids_by_ip_with_info = lambda server_ids, client_ip: (server_ids, 0)
+    mock_manager._get_tools_from_server = mock_get_tools_from_server
+
+    with (
+        patch(
+            "litellm.proxy._experimental.mcp_server.server.global_mcp_server_manager",
+            mock_manager,
+        ),
+        patch(
+            "litellm.proxy._experimental.mcp_server.server._get_byok_credential",
+            AsyncMock(return_value="personal-api-key"),
+        ),
+    ):
+        listing = await _get_tools_from_mcp_servers(
+            user_api_key_auth=user_api_key_auth,
+            mcp_auth_header=None,
+            mcp_servers=None,
+            mcp_server_auth_headers=None,
+        )
+
+    assert seen_auth_headers == ["personal-api-key"]
+    assert [tool.name for tool in listing.tools] == ["byok-toolA"]
diff --git a/tests/test_litellm/proxy/_experimental/mcp_server/test_mcp_server_manager.py b/tests/test_litellm/proxy/_experimental/mcp_server/test_mcp_server_manager.py
index cd1ef7320dd..9064312fd6d 100644
--- a/tests/test_litellm/proxy/_experimental/mcp_server/test_mcp_server_manager.py
+++ b/tests/test_litellm/proxy/_experimental/mcp_server/test_mcp_server_manager.py
@@ -42,6 +42,7 @@ from litellm.proxy._experimental.mcp_server.mcp_server_manager import (
     _deserialize_json_list,
     _normalize_mcp_server_cost_info,
     _obo_retry_applies,
+    _resolve_openapi_tool_auth,
     _should_strip_caller_authorization,
     _without_authorization,
 )
@@ -4833,6 +4834,74 @@ class TestMCPServerManager:
         with pytest.raises(ValueError, match="Tool missing_tool not found"):
             manager._resolve_mcp_server_for_tool_call("github", "missing_tool")
 
+    @staticmethod
+    def _manager_with_deepwiki_and_huggingface() -> MCPServerManager:
+        manager = MCPServerManager()
+        deepwiki = MCPServer(server_id="deepwiki-id", name="deepwiki", server_name="deepwiki", transport=MCPTransport.http)
+        huggingface = MCPServer(
+            server_id="huggingface-id", name="huggingface", server_name="huggingface", transport=MCPTransport.http
+        )
+        manager.registry = {"deepwiki-id": deepwiki, "huggingface-id": huggingface}
+        manager.tool_name_to_mcp_server_name_mapping = {
+            "read_wiki_structure": "deepwiki",
+            "deepwiki-read_wiki_structure": "deepwiki",
+            "hub_repo_search": "huggingface",
+            "huggingface-hub_repo_search": "huggingface",
+        }
+        return manager
+
+    def test_resolve_mcp_server_for_tool_call_rejects_tool_exposed_only_by_another_server(self):
+        manager = self._manager_with_deepwiki_and_huggingface()
+
+        with pytest.raises(ValueError, match="Tool read_wiki_structure not found"):
+            manager._resolve_mcp_server_for_tool_call("huggingface", "read_wiki_structure")
+        with pytest.raises(ValueError, match="Tool hub_repo_search not found"):
+            manager._resolve_mcp_server_for_tool_call("deepwiki", "hub_repo_search")
+
+        assert manager._resolve_mcp_server_for_tool_call("deepwiki", "read_wiki_structure") is manager.registry["deepwiki-id"]
+        assert manager._resolve_mcp_server_for_tool_call("huggingface", "hub_repo_search") is manager.registry["huggingface-id"]
+
+    def test_get_mcp_server_from_tool_name_rejects_other_servers_prefix(self):
+        manager = self._manager_with_deepwiki_and_huggingface()
+
+        assert manager._get_mcp_server_from_tool_name("huggingface-read_wiki_structure") is None
+        assert manager._get_mcp_server_from_tool_name("deepwiki-hub_repo_search") is None
+        assert manager._get_mcp_server_from_tool_name("deepwiki-read_wiki_structure") is manager.registry["deepwiki-id"]
+        assert manager._get_mcp_server_from_tool_name("huggingface-hub_repo_search") is manager.registry["huggingface-id"]
+
+    def test_resolve_mcp_server_for_tool_call_shared_bare_name_resolves_via_own_prefixed_spelling(self):
+        manager = MCPServerManager()
+        zapier = MCPServer(server_id="zapier-id", name="zapier", alias="zapier-alias", transport=MCPTransport.http)
+        other = MCPServer(server_id="other-id", name="other", server_name="other", transport=MCPTransport.http)
+        manager.registry = {"zapier-id": zapier, "other-id": other}
+        manager.tool_name_to_mcp_server_name_mapping = {
+            "create_zap": "other",
+            "other-create_zap": "other",
+            "zapier-alias-create_zap": "zapier-alias",
+        }
+
+        assert manager._resolve_mcp_server_for_tool_call("zapier", "create_zap") is zapier
+        assert manager._resolve_mcp_server_for_tool_call("other", "create_zap") is other
+
+    def test_remove_server_drops_only_its_own_tool_mapping_rows(self):
+        manager = self._manager_with_deepwiki_and_huggingface()
+
+        manager.remove_server(
+            LiteLLM_MCPServerTable(
+                server_id="huggingface-id",
+                alias="huggingface",
+                url="https://huggingface.co/mcp",
+                transport=MCPTransport.http,
+                created_at=datetime.now(),
+                updated_at=datetime.now(),
+            )
+        )
+
+        assert manager.tool_name_to_mcp_server_name_mapping == {
+            "read_wiki_structure": "deepwiki",
+            "deepwiki-read_wiki_structure": "deepwiki",
+        }
+
     @pytest.mark.asyncio
     async def test_resolve_oauth2_headers_skipped_when_not_user_oauth(self):
         """Returns input headers unchanged when server does not need user OAuth."""
@@ -10457,3 +10526,242 @@ class TestSessionResourceScopeIntersect:
         ):
             fallback = await manager.get_allowed_mcp_servers(auth)
         assert fallback == ["granted-id"]
+
+
+class TestClientForwardedDiscoveryFailureIsNotFatal:
+    """A failed OAuth metadata discovery may only brick the flows the gateway runs itself.
+
+    ``true_passthrough`` / ``oauth_delegate`` forward the caller's own bearer and mint nothing, so an
+    upstream that publishes no RFC 9728 metadata (an internal API, or any IdP unreachable from the
+    pod) must still serve sessions instead of 503-ing before the upstream is ever contacted.
+    """
+
+    @staticmethod
+    def _config(auth_type: MCPAuthType, dcr_bridge: bool | None) -> dict[str, dict[str, object]]:
+        entry: Final[dict[str, object]] = {
+            "url": "https://up.example.com/mcp",
+            "transport": MCPTransport.http,
+            "auth_type": auth_type,
+            **({"oauth2_flow": "authorization_code"} if auth_type == MCPAuth.oauth2 else {}),
+            **({"dcr_bridge": dcr_bridge} if dcr_bridge is not None else {}),
+        }
+        return {"upstream": entry}
+
+    async def _registered(self, manager: MCPServerManager, auth_type: MCPAuthType, dcr_bridge: bool | None):
+        with (
+            patch.object(manager, "_discover_oauth_metadata_for_server", new=AsyncMock(return_value=None)),
+            patch.object(manager, "initialize_tool_name_to_mcp_server_name_mapping"),
+        ):
+            await manager.load_servers_from_config(self._config(auth_type, dcr_bridge))
+        return next(iter(manager.config_mcp_servers.values()))
+
+    @pytest.mark.parametrize(
+        "auth_type, dcr_bridge, serves_without_endpoints",
+        [
+            (MCPAuth.true_passthrough, None, True),
+            (MCPAuth.true_passthrough, True, True),
+            (MCPAuth.oauth_delegate, None, True),
+            (MCPAuth.oauth_delegate, True, True),
+            (MCPAuth.oauth2, None, False),
+            (MCPAuth.oauth2_token_exchange, None, False),
+        ],
+    )
+    @pytest.mark.parametrize("failure", ["incomplete", "timed_out"])
+    @pytest.mark.asyncio
+    async def test_discovery_failure_blocks_only_gateway_run_flows(
+        self,
+        auth_type: MCPAuthType,
+        dcr_bridge: bool | None,
+        serves_without_endpoints: bool,
+        failure: str,
+    ):
+        manager = MCPServerManager()
+        server = await self._registered(manager, auth_type, dcr_bridge)
+        manager._set_oauth_discovery_deferred(server.server_id, True)
+
+        async def never_returns(_server):
+            await asyncio.Future()
+
+        discovery_patch: Final = (
+            {"new": AsyncMock(return_value=None)} if failure == "incomplete" else {"side_effect": never_returns}
+        )
+        with (
+            patch("litellm.proxy._experimental.mcp_server.mcp_server_manager.MCP_METADATA_TIMEOUT", 0.01),
+            patch.object(manager, "_discover_oauth_metadata_for_server", **discovery_patch),
+        ):
+            if not serves_without_endpoints:
+                with pytest.raises(HTTPException) as exc:
+                    await manager.ensure_oauth_metadata_discovered(server)
+                assert exc.value.status_code == 503
+                return
+
+            resolved = await manager.ensure_oauth_metadata_discovered(server)
+
+        assert resolved is manager.config_mcp_servers[server.server_id]
+        assert resolved.authorization_url is None
+        assert resolved.token_url is None
+        assert manager._oauth_discovery_slot(server.server_id) is not None
+
+    @pytest.mark.parametrize(
+        "auth_type, serves_the_listing",
+        [(MCPAuth.true_passthrough, True), (MCPAuth.oauth_delegate, True), (MCPAuth.oauth2, False)],
+    )
+    @pytest.mark.asyncio
+    async def test_listing_leg_serves_a_forwarding_server_whose_discovery_failed(
+        self, auth_type: MCPAuthType, serves_the_listing: bool
+    ):
+        """The listing leg is where the 503 became an empty tool list, so pin the fix there too.
+
+        ``_get_tools_from_server`` is the per-server leg the aggregate absorbs: a failure here is what
+        the fan-out turns into HTTP 200 with ``tools: []``, which is why the outage carried no
+        diagnostic. A forwarding server must now reach its upstream, and a gateway-run flow must still
+        surface the fault rather than be silently listed as empty.
+        """
+        manager = MCPServerManager()
+        server = await self._registered(manager, auth_type, None)
+        manager._set_oauth_discovery_deferred(server.server_id, True)
+        manager._fetch_tools_with_timeout = AsyncMock(
+            return_value=[MCPTool(name="list_reports", description="d", inputSchema={"type": "object"})]
+        )
+
+        with patch.object(manager, "_discover_oauth_metadata_for_server", new=AsyncMock(return_value=None)):
+            if not serves_the_listing:
+                with pytest.raises(MCPServerListError):
+                    await manager._get_tools_from_server(server=server)
+                return
+            tools = await manager._get_tools_from_server(server=server)
+
+        assert [tool.name for tool in tools] == ["upstream-list_reports"]
+        manager._fetch_tools_with_timeout.assert_awaited_once()
+
+    @pytest.mark.parametrize("auth_type", [MCPAuth.true_passthrough, MCPAuth.oauth_delegate])
+    @pytest.mark.asyncio
+    async def test_client_forwarded_servers_keep_discovering_their_front_door_endpoints(
+        self, auth_type: MCPAuthType
+    ):
+        """Exempting these modes from the FAILURE must not exempt them from discovery itself.
+
+        ``/authorize``, ``/token`` and ``/register`` read the discovered endpoints for these servers
+        (``_resolve_ephemeral_dcr_client`` mints for ``true_passthrough`` whatever ``dcr_bridge``
+        says), so an exemption written into the unresolved-endpoints predicate would disarm the slot
+        and silently drop a working front door.
+        """
+        manager = MCPServerManager()
+        metadata: Final = MCPOAuthMetadata(
+            authorization_url="https://idp.example.com/authorize",
+            token_url="https://idp.example.com/token",
+            registration_url="https://idp.example.com/register",
+        )
+        with (
+            patch.object(manager, "_discover_oauth_metadata_for_server", new=AsyncMock(return_value=metadata)),
+            patch.object(manager, "initialize_tool_name_to_mcp_server_name_mapping"),
+        ):
+            await manager.load_servers_from_config(self._config(auth_type, None))
+            server = next(iter(manager.config_mcp_servers.values()))
+            resolved = await manager.ensure_oauth_metadata_discovered(server)
+
+        assert resolved.authorization_url == "https://idp.example.com/authorize"
+        assert resolved.token_url == "https://idp.example.com/token"
+        assert resolved.registration_url == "https://idp.example.com/register"
+        assert manager.config_mcp_servers[server.server_id].authorization_url == "https://idp.example.com/authorize"
+        assert manager._oauth_discovery_slot(server.server_id) is None
+
+
+class TestResolveOpenapiToolAuth:
+    """The credential matrix for a ``spec_path`` server's two OpenAPI dispatch arms.
+
+    A per-server ``x-mcp-{alias}-authorization`` is already a complete header value and is forwarded
+    verbatim; a BYOK credential is a raw secret that takes the auth-type prefix. Conflating them
+    ships ``Bearer Bearer <token>``, so every cell pins which of the two a value came from.
+    """
+
+    @staticmethod
+    def _server(auth_type: MCPAuthType = MCPAuth.oauth_delegate) -> MCPServer:
+        return MCPServer(
+            server_id="srv-openapi",
+            name="report_api",
+            server_name="report_api",
+            alias="report_api",
+            url="https://api.internal.example.com",
+            transport=MCPTransport.http,
+            auth_type=auth_type,
+            spec_path="https://api.internal.example.com/openapi.json",
+            extra_headers=["X-Tenant"],
+        )
+
+    @pytest.mark.parametrize(
+        "per_server, byok, expected_auth, expected_extra_keys, expected_credential",
+        [
+            (
+                {"report_api": "Bearer caller-token"},
+                None,
+                "Bearer caller-token",
+                {"X-Tenant"},
+                "Bearer caller-token",
+            ),
+            (
+                {"report_api": {"Authorization": "Bearer caller-token", "X-Trace": "abc"}},
+                None,
+                "Bearer caller-token",
+                {"X-Tenant", "X-Trace"},
+                {"Authorization": "Bearer caller-token", "X-Trace": "abc"},
+            ),
+            (
+                {"report_api": {"X-Api-Key": "k1"}},
+                "byok-secret",
+                "Bearer byok-secret",
+                {"X-Tenant", "X-Api-Key"},
+                "byok-secret",
+            ),
+            ({"report_api": {"X-Api-Key": "k1"}}, None, None, {"X-Tenant", "X-Api-Key"}, None),
+            (None, "byok-secret", "Bearer byok-secret", {"X-Tenant"}, "byok-secret"),
+            (None, None, None, {"X-Tenant"}, None),
+            ({"other_server": "Bearer wrong"}, None, None, {"X-Tenant"}, None),
+        ],
+    )
+    def test_credential_matrix(
+        self,
+        per_server: dict | None,
+        byok: str | None,
+        expected_auth: str | None,
+        expected_extra_keys: set,
+        expected_credential: object,
+    ):
+        auth_value, forwarded, credential = _resolve_openapi_tool_auth(
+            mcp_server=self._server(),
+            mcp_auth_header=byok,
+            mcp_server_auth_headers=per_server,
+            raw_headers={"x-tenant": "acme", "authorization": "Bearer admission-key"},
+            user_api_key_auth=None,
+        )
+
+        assert auth_value == expected_auth
+        assert set(forwarded or {}) == expected_extra_keys
+        assert credential == expected_credential
+
+    def test_per_server_value_is_never_re_prefixed(self):
+        """The regression that a naive wiring produces: the caller already sent ``Bearer <token>``."""
+        auth_value, _, credential = _resolve_openapi_tool_auth(
+            mcp_server=self._server(auth_type=MCPAuth.api_key),
+            mcp_auth_header="byok-secret",
+            mcp_server_auth_headers={"report_api": "Bearer caller-token"},
+            raw_headers=None,
+            user_api_key_auth=None,
+        )
+
+        assert auth_value == "Bearer caller-token"
+        assert credential == "Bearer caller-token"
+        assert not auth_value.startswith("ApiKey ")
+
+    def test_per_server_authorization_is_not_also_left_in_forwarded_headers(self):
+        """``resolve_openapi_upstream_auth`` pops Authorization out of the forwarded headers, so a
+        second copy there would give the passthrough arm two sources to reconcile."""
+        _, forwarded, _ = _resolve_openapi_tool_auth(
+            mcp_server=self._server(),
+            mcp_auth_header=None,
+            mcp_server_auth_headers={"report_api": {"Authorization": "Bearer caller-token"}},
+            raw_headers={"x-tenant": "acme"},
+            user_api_key_auth=None,
+        )
+
+        assert "Authorization" not in (forwarded or {})
diff --git a/tests/test_litellm/proxy/_experimental/mcp_server/test_openapi_tool_auth.py b/tests/test_litellm/proxy/_experimental/mcp_server/test_openapi_tool_auth.py
index 63473bf3cf5..7bd846aeda4 100644
--- a/tests/test_litellm/proxy/_experimental/mcp_server/test_openapi_tool_auth.py
+++ b/tests/test_litellm/proxy/_experimental/mcp_server/test_openapi_tool_auth.py
@@ -189,9 +189,11 @@ async def test_openapi_local_tool_denied_when_server_not_resolvable():
 
     pre_call = AsyncMock(return_value={})
     handle_local = AsyncMock(return_value=[])
+    resolve_auth = MagicMock()
 
     # `_get_mcp_server_from_tool_name` returns None — no server context.
     with (
+        patch.object(mcp_module, "_resolve_openapi_tool_auth", new=resolve_auth),
         patch.object(
             mcp_module.global_mcp_server_manager,
             "_get_mcp_server_from_tool_name",
@@ -228,6 +230,9 @@ async def test_openapi_local_tool_denied_when_server_not_resolvable():
     assert exc.value.status_code == 503
     pre_call.assert_not_awaited()
     handle_local.assert_not_awaited()
+    # The credential resolver takes a non-optional server, so the 503 guard above it is what keeps
+    # a missing server from ever reaching it. Pinned here so moving the guard reds this test.
+    resolve_auth.assert_not_called()
 
 
 @pytest.mark.asyncio
@@ -549,3 +554,101 @@ async def test_unknown_tool_name_still_reports_not_found():
 
     assert exc.value.status_code == 404
     assert "not found" in str(exc.value.detail)
+
+
+OPENAPI_PER_SERVER_TOKEN = "Bearer per-server-upstream-token"
+
+
+def _spec_path_server() -> MCPServer:
+    return MCPServer(
+        server_id="srv-reports",
+        name="report_api",
+        server_name="report_api",
+        alias="report_api",
+        url="https://api.internal.example.com",
+        transport=MCPTransport.http,
+        auth_type=MCPAuth.oauth_delegate,
+        spec_path="https://api.internal.example.com/openapi.json",
+    )
+
+
+@pytest.mark.parametrize("dispatch_arm", ["local_registry", "call_tool"])
+@pytest.mark.asyncio
+async def test_per_server_auth_header_reaches_both_openapi_dispatch_arms(dispatch_arm: str):
+    """`x-mcp-{alias}-authorization` must survive on BOTH OpenAPI dispatch arms.
+
+    OpenAPI tools live in the local tool registry, so `execute_mcp_tool` serves MCP-protocol and REST
+    tool calls while `MCPServerManager.call_tool` serves the responses-API handler. Both arms sourced
+    the upstream credential only from the deprecated global / BYOK `mcp_auth_header`, so the
+    per-server header was dropped and the upstream API saw no Authorization at all.
+
+    Asserting on the resolver kwarg as well as the ContextVar is deliberate: for the client-forwarded
+    modes the credential has to reach `resolve_openapi_upstream_auth`, whose passthrough arm outranks
+    the ContextVar when it materializes a header.
+    """
+    from litellm.proxy._experimental.mcp_server import server as mcp_module
+    from litellm.proxy._experimental.mcp_server.openapi_to_mcp_generator import (
+        _request_auth_header,
+    )
+
+    server = _spec_path_server()
+    auth_headers = {"report_api": {"Authorization": OPENAPI_PER_SERVER_TOKEN}}
+    user = UserAPIKeyAuth(api_key="sk-user", user_id="alice", user_role=LitellmUserRoles.INTERNAL_USER.value)
+    captured: dict = {}
+
+    async def fake_resolver(**kwargs):
+        captured["resolver_credential"] = kwargs["mcp_auth_header"]
+        return None, kwargs["forwarded_headers"]
+
+    async def capture_local(_name, _arguments):
+        captured["injected"] = _request_auth_header.get()
+        return []
+
+    async def capture_openapi_handler(_server, _name, _arguments):
+        captured["injected"] = _request_auth_header.get()
+        return []
+
+    manager = mcp_module.global_mcp_server_manager
+    with (
+        patch.object(manager, "resolve_openapi_upstream_auth", new=fake_resolver),
+        patch.object(manager, "pre_call_tool_check", new=AsyncMock(return_value={})),
+    ):
+        if dispatch_arm == "local_registry":
+            fake_tool = MagicMock()
+            fake_tool.name = "list_reports"
+            with (
+                patch.object(manager, "_get_mcp_server_from_tool_name", return_value=server),
+                patch.object(mcp_module.global_mcp_tool_registry, "get_tool", return_value=fake_tool),
+                patch(
+                    "litellm.proxy._experimental.mcp_server.server._handle_local_mcp_tool",
+                    new=capture_local,
+                ),
+                patch(
+                    "litellm.proxy._experimental.mcp_server.server.MCPRequestHandler.is_tool_allowed",
+                    return_value=True,
+                ),
+            ):
+                await mcp_module.execute_mcp_tool(
+                    name="list_reports",
+                    arguments={},
+                    allowed_mcp_servers=[server],
+                    start_time=datetime.now(timezone.utc),
+                    user_api_key_auth=user,
+                    mcp_server_auth_headers=auth_headers,
+                )
+        else:
+            with (
+                patch.object(manager, "_resolve_mcp_server_for_tool_call", return_value=server),
+                patch.object(manager, "_call_openapi_tool_handler", new=capture_openapi_handler),
+            ):
+                await manager.call_tool(
+                    server_name="report_api",
+                    name="list_reports",
+                    arguments={},
+                    user_api_key_auth=user,
+                    mcp_server_auth_headers=auth_headers,
+                )
+
+    assert captured["resolver_credential"] == {"Authorization": OPENAPI_PER_SERVER_TOKEN}
+    assert captured["injected"] == OPENAPI_PER_SERVER_TOKEN
+    assert _request_auth_header.get() is None
diff --git a/tests/test_litellm/proxy/anthropic_endpoints/test_endpoints.py b/tests/test_litellm/proxy/anthropic_endpoints/test_endpoints.py
index 0a427df0cb7..9a90daeccb7 100644
--- a/tests/test_litellm/proxy/anthropic_endpoints/test_endpoints.py
+++ b/tests/test_litellm/proxy/anthropic_endpoints/test_endpoints.py
@@ -164,6 +164,41 @@ class TestProxyExceptionPassthrough:
         mock_logging.post_call_failure_hook.assert_awaited_once()
 
 
+class TestFailureHookRequestData:
+    @pytest.mark.asyncio
+    async def test_failure_hook_gets_post_setup_data_with_logging_obj(self):
+        """Request setup replaces the processor's data dict (adding the logging
+        object the failure hook needs to lift token usage from); the exception
+        handler must pass that replaced dict, not the raw request body dict."""
+        import litellm.proxy.anthropic_endpoints.endpoints as ep
+        import litellm.proxy.proxy_server as proxy_server
+        from litellm.proxy._types import ProxyException, UserAPIKeyAuth
+
+        captured = {}
+
+        async def fake_process(self, **kwargs):
+            self.data = {**self.data, "litellm_logging_obj": "logging-obj-sentinel"}
+            captured["processor_data"] = self.data
+            raise RuntimeError("provider timeout")
+
+        with (
+            patch.object(ep, "_read_request_body", new=AsyncMock(return_value={"model": "claude-sonnet"})),
+            patch.object(ep.ProxyBaseLLMRequestProcessing, "base_process_llm_request", new=fake_process),
+            patch.object(proxy_server, "proxy_logging_obj") as mock_logging,
+        ):
+            mock_logging.post_call_failure_hook = AsyncMock()
+            with pytest.raises(ProxyException):
+                await ep.anthropic_response(
+                    fastapi_response=MagicMock(),
+                    request=MagicMock(),
+                    user_api_key_dict=UserAPIKeyAuth(),
+                )
+
+        hook_request_data = mock_logging.post_call_failure_hook.await_args.kwargs["request_data"]
+        assert hook_request_data is captured["processor_data"]
+        assert hook_request_data["litellm_logging_obj"] == "logging-obj-sentinel"
+
+
 class TestEventLoggingBatchEndpoint:
     """Test the stubbed event logging batch endpoint"""
 
diff --git a/tests/test_litellm/proxy/common_utils/test_registry_read_through.py b/tests/test_litellm/proxy/common_utils/test_registry_read_through.py
new file mode 100644
index 00000000000..f0fbdea4e85
--- /dev/null
+++ b/tests/test_litellm/proxy/common_utils/test_registry_read_through.py
@@ -0,0 +1,476 @@
+import asyncio
+from typing import Final
+
+import pytest
+
+from litellm.proxy.common_utils.registry_read_through import RegistryReadThrough
+
+
+class ResyncSpy:
+    def __init__(self, found: bool = True, error: Exception | None = None) -> None:
+        self.found = found
+        self.error = error
+        self.calls: list[str] = []
+
+    async def __call__(self, key: str) -> bool:
+        self.calls.append(key)
+        if self.error is not None:
+            raise self.error
+        return self.found
+
+
+@pytest.mark.asyncio
+async def test_attempt_returns_true_when_resync_finds_object():
+    spy: Final = ResyncSpy(found=True)
+    read_through: Final = RegistryReadThrough(resync=spy)
+
+    assert await read_through.attempt("new-model") is True
+    assert spy.calls == ["new-model"]
+
+
+@pytest.mark.asyncio
+async def test_attempt_found_key_is_not_negative_cached():
+    spy: Final = ResyncSpy(found=True)
+    read_through: Final = RegistryReadThrough(resync=spy)
+
+    assert await read_through.attempt("new-model") is True
+    assert await read_through.attempt("new-model") is True
+    assert spy.calls == ["new-model", "new-model"]
+
+
+@pytest.mark.asyncio
+async def test_missing_key_is_negative_cached_within_ttl():
+    spy: Final = ResyncSpy(found=False)
+    read_through: Final = RegistryReadThrough(resync=spy, miss_ttl_seconds=60.0)
+
+    assert await read_through.attempt("ghost-model") is False
+    assert await read_through.attempt("ghost-model") is False
+    assert spy.calls == ["ghost-model"]
+
+
+@pytest.mark.asyncio
+async def test_negative_cache_expires_and_resync_runs_again():
+    spy: Final = ResyncSpy(found=False)
+    read_through: Final = RegistryReadThrough(resync=spy, miss_ttl_seconds=0.05)
+
+    assert await read_through.attempt("ghost-model") is False
+    await asyncio.sleep(0.1)
+    assert await read_through.attempt("ghost-model") is False
+    assert spy.calls == ["ghost-model", "ghost-model"]
+
+
+@pytest.mark.asyncio
+async def test_resync_exception_returns_false_without_negative_caching():
+    spy: Final = ResyncSpy(error=RuntimeError("db down"))
+    read_through: Final = RegistryReadThrough(resync=spy)
+
+    assert await read_through.attempt("new-model") is False
+    assert await read_through.attempt("new-model") is False
+    assert spy.calls == ["new-model", "new-model"]
+
+
+@pytest.mark.asyncio
+async def test_concurrent_attempts_for_missing_key_resync_once():
+    class SlowResyncSpy(ResyncSpy):
+        async def __call__(self, key: str) -> bool:
+            await asyncio.sleep(0.05)
+            return await super().__call__(key)
+
+    spy: Final = SlowResyncSpy(found=False)
+    read_through: Final = RegistryReadThrough(resync=spy, miss_ttl_seconds=60.0)
+
+    results: Final = await asyncio.gather(*(read_through.attempt("ghost-model") for _ in range(5)))
+    assert results == [False] * 5
+    assert spy.calls == ["ghost-model"]
+
+
+@pytest.mark.asyncio
+async def test_distinct_keys_do_not_share_negative_cache():
+    spy: Final = ResyncSpy(found=False)
+    read_through: Final = RegistryReadThrough(resync=spy, miss_ttl_seconds=60.0)
+
+    assert await read_through.attempt("ghost-a") is False
+    assert await read_through.attempt("ghost-b") is False
+    assert spy.calls == ["ghost-a", "ghost-b"]
+
+
+@pytest.mark.asyncio
+async def test_resync_budget_exhausted_blocks_resync_without_negative_caching():
+    spy: Final = ResyncSpy(found=False)
+    read_through: Final = RegistryReadThrough(
+        resync=spy, miss_ttl_seconds=60.0, max_resyncs_per_window=2, resync_window_seconds=60.0
+    )
+
+    assert await read_through.attempt("ghost-a") is False
+    assert await read_through.attempt("ghost-b") is False
+    assert await read_through.attempt("ghost-c") is False
+    assert spy.calls == ["ghost-a", "ghost-b"]
+    assert read_through._recent_misses.get_cache("ghost-c") is None
+
+
+@pytest.mark.asyncio
+async def test_resync_budget_replenishes_after_window():
+    spy: Final = ResyncSpy(found=True)
+    read_through: Final = RegistryReadThrough(resync=spy, max_resyncs_per_window=1, resync_window_seconds=0.05)
+
+    assert await read_through.attempt("model-a") is True
+    assert await read_through.attempt("model-b") is False
+    await asyncio.sleep(0.1)
+    assert await read_through.attempt("model-b") is True
+    assert spy.calls == ["model-a", "model-b"]
+
+
+class FakeAgentRow:
+    def __init__(self, agent_id: str, agent_name: str) -> None:
+        self.agent_id = agent_id
+        self.agent_name = agent_name
+        self.object_permission = None
+        self.spend = 0.0
+
+    def model_dump(self):
+        return {
+            "agent_id": self.agent_id,
+            "agent_name": self.agent_name,
+            "agent_card_params": {"name": self.agent_name, "url": "http://db-agent"},
+            "litellm_params": {},
+            "object_permission": None,
+            "spend": self.spend,
+        }
+
+
+@pytest.fixture
+def clean_agent_registry():
+    from litellm.proxy.agent_endpoints.agent_registry import global_agent_registry
+
+    original_agents: Final = list(global_agent_registry.agent_list)
+    original_config_agents: Final = getattr(global_agent_registry, "config_agents", ())
+    global_agent_registry.agent_list = []
+    global_agent_registry.config_agents = ()
+    try:
+        yield global_agent_registry
+    finally:
+        global_agent_registry.agent_list = original_agents
+        global_agent_registry.config_agents = original_config_agents
+
+
+@pytest.mark.asyncio
+async def test_get_agent_with_read_through_recovers_agent_created_on_sibling_replica(
+    clean_agent_registry, monkeypatch
+):
+    from unittest.mock import AsyncMock, MagicMock
+
+    import litellm.proxy.proxy_server as proxy_server
+    from litellm.proxy.common_utils.registry_read_through import get_agent_with_read_through
+
+    agent_id: Final = "read-through-db-agent-id"
+    prisma_client: Final = MagicMock()
+    prisma_client.db.litellm_agentstable.find_unique = AsyncMock(
+        return_value=FakeAgentRow(agent_id, "read-through-db-agent")
+    )
+    monkeypatch.setattr(proxy_server, "prisma_client", prisma_client)
+    monkeypatch.setattr(proxy_server, "store_model_in_db", True)
+
+    assert clean_agent_registry.get_agent_by_id(agent_id=agent_id) is None
+    agent: Final = await get_agent_with_read_through(agent_id)
+
+    assert agent is not None
+    assert agent.agent_id == agent_id
+    prisma_client.db.litellm_agentstable.find_unique.assert_awaited_once_with(
+        where={"agent_id": agent_id},
+        include={"object_permission": True},
+    )
+
+
+@pytest.mark.asyncio
+async def test_get_agent_with_read_through_recovers_agent_by_name(clean_agent_registry, monkeypatch):
+    from unittest.mock import AsyncMock, MagicMock
+
+    import litellm.proxy.proxy_server as proxy_server
+    from litellm.proxy.common_utils.registry_read_through import get_agent_with_read_through
+
+    agent_name: Final = "read-through-db-agent-by-name"
+    prisma_client: Final = MagicMock()
+    prisma_client.db.litellm_agentstable.find_unique = AsyncMock(
+        side_effect=[None, FakeAgentRow("read-through-name-lookup-id", agent_name)]
+    )
+    monkeypatch.setattr(proxy_server, "prisma_client", prisma_client)
+    monkeypatch.setattr(proxy_server, "store_model_in_db", True)
+
+    agent: Final = await get_agent_with_read_through(agent_name)
+
+    assert agent is not None
+    assert agent.agent_name == agent_name
+    prisma_client.db.litellm_agentstable.find_unique.assert_awaited_with(
+        where={"agent_name": agent_name},
+        include={"object_permission": True},
+    )
+
+
+@pytest.mark.asyncio
+async def test_get_agent_with_read_through_returns_none_for_unknown_agent(clean_agent_registry, monkeypatch):
+    from unittest.mock import AsyncMock, MagicMock
+
+    import litellm.proxy.proxy_server as proxy_server
+    from litellm.proxy.common_utils.registry_read_through import get_agent_with_read_through
+
+    prisma_client: Final = MagicMock()
+    prisma_client.db.litellm_agentstable.find_unique = AsyncMock(return_value=None)
+    monkeypatch.setattr(proxy_server, "prisma_client", prisma_client)
+    monkeypatch.setattr(proxy_server, "store_model_in_db", True)
+
+    assert await get_agent_with_read_through("agent-nobody-created") is None
+    assert prisma_client.db.litellm_agentstable.find_unique.await_count == 2
+
+
+@pytest.mark.asyncio
+async def test_resync_agents_already_registered_skips_db(clean_agent_registry, monkeypatch):
+    from unittest.mock import AsyncMock, MagicMock
+
+    import litellm.proxy.proxy_server as proxy_server
+    from litellm.proxy.common_utils.registry_read_through import _resync_agents
+
+    agent_id: Final = "read-through-dedup-agent-id"
+    prisma_client: Final = MagicMock()
+    prisma_client.db.litellm_agentstable.find_unique = AsyncMock(
+        return_value=FakeAgentRow(agent_id, "read-through-dedup-agent")
+    )
+    monkeypatch.setattr(proxy_server, "prisma_client", prisma_client)
+    monkeypatch.setattr(proxy_server, "store_model_in_db", True)
+
+    assert await _resync_agents(agent_id) is True
+    assert await _resync_agents(agent_id) is True
+    assert prisma_client.db.litellm_agentstable.find_unique.await_count == 1
+    assert len(clean_agent_registry.agent_list) == 1
+
+
+class FakeGuardrailRow:
+    def __init__(self, guardrail_id: str, guardrail_name: str) -> None:
+        self.guardrail_id = guardrail_id
+        self.guardrail_name = guardrail_name
+
+    def __iter__(self):
+        return iter(
+            {
+                "guardrail_id": self.guardrail_id,
+                "guardrail_name": self.guardrail_name,
+                "litellm_params": {
+                    "guardrail": "litellm_content_filter",
+                    "mode": "pre_call",
+                    "default_on": True,
+                    "blocked_words": [{"keyword": "secret", "action": "BLOCK"}],
+                },
+                "guardrail_info": {},
+                "status": "active",
+            }.items()
+        )
+
+
+@pytest.mark.asyncio
+async def test_get_guardrail_with_read_through_recovers_guardrail_created_on_sibling_replica(monkeypatch):
+    from unittest.mock import AsyncMock, MagicMock
+
+    import litellm.proxy.proxy_server as proxy_server
+    from litellm.proxy.common_utils.registry_read_through import (
+        get_initialized_guardrail_with_read_through,
+    )
+    from litellm.proxy.guardrails.guardrail_registry import IN_MEMORY_GUARDRAIL_HANDLER
+
+    guardrail_id: Final = "read-through-db-guardrail-id"
+    guardrail_name: Final = "read-through-db-guardrail"
+    prisma_client: Final = MagicMock()
+    prisma_client.db.litellm_guardrailstable.find_first = AsyncMock(
+        return_value=FakeGuardrailRow(guardrail_id, guardrail_name)
+    )
+    prisma_client.db.litellm_guardrailstable.find_many = AsyncMock(
+        side_effect=AssertionError("full-table guardrail scan on read-through miss")
+    )
+    monkeypatch.setattr(proxy_server, "prisma_client", prisma_client)
+    monkeypatch.setattr(proxy_server, "store_model_in_db", True)
+
+    try:
+        guardrail: Final = await get_initialized_guardrail_with_read_through(guardrail_name=guardrail_name)
+        assert guardrail is not None
+        assert guardrail.guardrail_name == guardrail_name
+        prisma_client.db.litellm_guardrailstable.find_first.assert_awaited_once_with(
+            where={"guardrail_name": guardrail_name, "status": "active"}
+        )
+    finally:
+        IN_MEMORY_GUARDRAIL_HANDLER.delete_in_memory_guardrail(guardrail_id)
+
+
+@pytest.mark.asyncio
+async def test_get_guardrail_with_read_through_returns_none_for_unknown_guardrail(monkeypatch):
+    from unittest.mock import AsyncMock, MagicMock
+
+    import litellm.proxy.proxy_server as proxy_server
+    from litellm.proxy.common_utils.registry_read_through import (
+        get_initialized_guardrail_with_read_through,
+    )
+
+    prisma_client: Final = MagicMock()
+    prisma_client.db.litellm_guardrailstable.find_first = AsyncMock(return_value=None)
+    monkeypatch.setattr(proxy_server, "prisma_client", prisma_client)
+    monkeypatch.setattr(proxy_server, "store_model_in_db", True)
+
+    assert await get_initialized_guardrail_with_read_through(guardrail_name="guardrail-nobody-created") is None
+
+
+@pytest.mark.asyncio
+async def test_resync_guardrails_never_loads_non_active_rows(monkeypatch):
+    from unittest.mock import AsyncMock, MagicMock
+
+    import litellm.proxy.proxy_server as proxy_server
+    from litellm.proxy.common_utils.registry_read_through import _resync_guardrails
+
+    pending_name: Final = "pending-review-guardrail"
+    prisma_client: Final = MagicMock()
+    prisma_client.db.litellm_guardrailstable.find_first = AsyncMock(return_value=None)
+    monkeypatch.setattr(proxy_server, "prisma_client", prisma_client)
+    monkeypatch.setattr(proxy_server, "store_model_in_db", True)
+
+    assert await _resync_guardrails(pending_name) is False
+    prisma_client.db.litellm_guardrailstable.find_first.assert_awaited_once_with(
+        where={"guardrail_name": pending_name, "status": "active"}
+    )
+
+
+@pytest.mark.asyncio
+async def test_resync_guardrails_syncs_under_guardrail_reconcile_lock(monkeypatch):
+    from unittest.mock import AsyncMock, MagicMock
+
+    import litellm.proxy.common_utils.registry_read_through as read_through_module
+    import litellm.proxy.proxy_server as proxy_server
+    from litellm.proxy.common_utils.registry_read_through import _resync_guardrails
+    from litellm.proxy.guardrails.guardrail_registry import (
+        GUARDRAIL_RECONCILE_LOCK,
+        IN_MEMORY_GUARDRAIL_HANDLER,
+    )
+
+    guardrail_name: Final = "lock-scope-guardrail"
+    prisma_client: Final = MagicMock()
+    prisma_client.db.litellm_guardrailstable.find_first = AsyncMock(
+        return_value=FakeGuardrailRow("lock-scope-guardrail-id", guardrail_name)
+    )
+    lock_states: list[bool] = []
+
+    def record_sync(guardrail) -> None:
+        lock_states.append(GUARDRAIL_RECONCILE_LOCK.locked())
+
+    monkeypatch.setattr(proxy_server, "prisma_client", prisma_client)
+    monkeypatch.setattr(proxy_server, "store_model_in_db", True)
+    monkeypatch.setattr(IN_MEMORY_GUARDRAIL_HANDLER, "sync_guardrail_from_db", record_sync)
+    monkeypatch.setattr(read_through_module, "_initialized_guardrail", lambda guardrail_name: MagicMock())
+
+    assert await _resync_guardrails(guardrail_name) is True
+    assert lock_states == [True]
+    assert not GUARDRAIL_RECONCILE_LOCK.locked()
+
+
+@pytest.mark.asyncio
+async def test_resync_model_deployments_mutates_router_under_model_reconcile_lock(monkeypatch):
+    from unittest.mock import AsyncMock, MagicMock
+
+    import litellm.proxy.proxy_server as proxy_server
+    from litellm.proxy.common_utils.registry_read_through import _resync_model_deployments
+
+    prisma_client: Final = MagicMock()
+    prisma_client.db.litellm_proxymodeltable.find_many = AsyncMock(return_value=[MagicMock()])
+    router: Final = MagicMock()
+    router.get_model_list.return_value = []
+    lock_states: list[bool] = []
+
+    def record_add_deployment(db_models) -> None:
+        lock_states.append(proxy_server.MODEL_RECONCILE_LOCK.locked())
+
+    monkeypatch.setattr(proxy_server, "prisma_client", prisma_client)
+    monkeypatch.setattr(proxy_server, "store_model_in_db", True)
+    monkeypatch.setattr(proxy_server, "llm_router", router)
+    monkeypatch.setattr(proxy_server, "llm_model_list", None)
+    monkeypatch.setattr(proxy_server.proxy_config, "_add_deployment", record_add_deployment)
+
+    assert await _resync_model_deployments("lock-scope-model") is True
+    assert lock_states == [True]
+    assert not proxy_server.MODEL_RECONCILE_LOCK.locked()
+
+
+@pytest.mark.asyncio
+async def test_resync_model_deployments_respects_supported_db_objects(monkeypatch):
+    from unittest.mock import AsyncMock, MagicMock
+
+    import litellm.proxy.proxy_server as proxy_server
+    from litellm.proxy.common_utils.registry_read_through import _resync_model_deployments
+
+    prisma_client: Final = MagicMock()
+    prisma_client.db.litellm_proxymodeltable.find_many = AsyncMock(
+        side_effect=AssertionError("db hit for an object type this replica does not load")
+    )
+    monkeypatch.setattr(proxy_server, "prisma_client", prisma_client)
+    monkeypatch.setattr(proxy_server, "store_model_in_db", True)
+    monkeypatch.setattr(proxy_server, "general_settings", {"supported_db_objects": ["guardrails"]})
+
+    assert await _resync_model_deployments("gated-out-model") is False
+
+
+@pytest.mark.asyncio
+async def test_resync_guardrails_respects_supported_db_objects(monkeypatch):
+    from unittest.mock import AsyncMock, MagicMock
+
+    import litellm.proxy.proxy_server as proxy_server
+    from litellm.proxy.common_utils.registry_read_through import _resync_guardrails
+
+    prisma_client: Final = MagicMock()
+    prisma_client.db.litellm_guardrailstable.find_unique = AsyncMock(
+        side_effect=AssertionError("db hit for an object type this replica does not load")
+    )
+    monkeypatch.setattr(proxy_server, "prisma_client", prisma_client)
+    monkeypatch.setattr(proxy_server, "store_model_in_db", True)
+    monkeypatch.setattr(proxy_server, "general_settings", {"supported_db_objects": ["models"]})
+
+    assert await _resync_guardrails("gated-out-guardrail") is False
+
+
+@pytest.mark.asyncio
+async def test_resync_agents_respects_supported_db_objects(clean_agent_registry, monkeypatch):
+    from unittest.mock import AsyncMock, MagicMock
+
+    import litellm.proxy.proxy_server as proxy_server
+    from litellm.proxy.common_utils.registry_read_through import _resync_agents
+
+    prisma_client: Final = MagicMock()
+    prisma_client.db.litellm_agentstable.find_unique = AsyncMock(
+        side_effect=AssertionError("db hit for an object type this replica does not load")
+    )
+    monkeypatch.setattr(proxy_server, "prisma_client", prisma_client)
+    monkeypatch.setattr(proxy_server, "store_model_in_db", True)
+    monkeypatch.setattr(proxy_server, "general_settings", {"supported_db_objects": ["models"]})
+
+    assert await _resync_agents("gated-out-agent") is False
+
+
+@pytest.mark.asyncio
+async def test_resync_agents_waits_for_agent_reload_and_skips_duplicate_registration(clean_agent_registry, monkeypatch):
+    from unittest.mock import AsyncMock, MagicMock
+
+    import litellm.proxy.proxy_server as proxy_server
+    from litellm.proxy.agent_endpoints.agent_registry import AGENT_RECONCILE_LOCK
+    from litellm.proxy.common_utils.registry_read_through import _resync_agents
+    from litellm.types.agents import AgentResponse
+
+    agent_id: Final = "reload-race-agent-id"
+    prisma_client: Final = MagicMock()
+    prisma_client.db.litellm_agentstable.find_unique = AsyncMock(
+        side_effect=AssertionError("db hit while the agent reload held the reconcile lock")
+    )
+    monkeypatch.setattr(proxy_server, "prisma_client", prisma_client)
+    monkeypatch.setattr(proxy_server, "store_model_in_db", True)
+
+    async with AGENT_RECONCILE_LOCK:
+        resync_task: Final = asyncio.ensure_future(_resync_agents(agent_id))
+        await asyncio.sleep(0.05)
+        assert not resync_task.done()
+        clean_agent_registry.register_agent(
+            agent_config=AgentResponse.model_validate(FakeAgentRow(agent_id, "reload-race-agent").model_dump())
+        )
+
+    assert await resync_task is True
+    assert len(clean_agent_registry.agent_list) == 1
diff --git a/tests/test_litellm/proxy/hooks/test_batch_file_validation.py b/tests/test_litellm/proxy/hooks/test_batch_file_validation.py
index 7ff1bc11d81..1ce1a2f3e51 100644
--- a/tests/test_litellm/proxy/hooks/test_batch_file_validation.py
+++ b/tests/test_litellm/proxy/hooks/test_batch_file_validation.py
@@ -1382,6 +1382,315 @@ async def test_check_and_increment_computes_descriptors_when_not_passed():
     parallel_request_limiter._create_rate_limit_descriptors.assert_called_once()
 
 
+@pytest.mark.asyncio
+async def test_pre_call_enforces_project_otpm_limit_for_batch():
+    """VERIA regression: ``_create_batch_rate_limit_descriptors`` only asked
+    for the generic key/user/team/model descriptors, so a project caller
+    could submit a batch that consumed none of its configured project OTPM
+    quota. The project OTPM descriptor must now be present and charged with
+    the batch's estimated *output* tokens, not its input tokens."""
+    from litellm import DualCache
+    from litellm.proxy.hooks.batch_rate_limiter import _PROXY_BatchRateLimiter
+    from litellm.proxy.hooks.parallel_request_limiter_v3 import (
+        _PROXY_MaxParallelRequestsHandler_v3,
+    )
+    from litellm.proxy.utils import InternalUsageCache
+
+    local_cache = DualCache()
+    parallel_request_limiter = _PROXY_MaxParallelRequestsHandler_v3(
+        internal_usage_cache=InternalUsageCache(local_cache)
+    )
+    rate_limiter = _PROXY_BatchRateLimiter(
+        internal_usage_cache=InternalUsageCache(local_cache),
+        parallel_request_limiter=parallel_request_limiter,
+    )
+
+    user = UserAPIKeyAuth(
+        api_key="sk-project-batch-otpm",
+        models=["*"],
+        project_id="proj-mantle-batch",
+        project_metadata={"model_otpm_limit": {"gpt-4o-mini": 50}},
+    )
+
+    # Two rows each declaring max_tokens=40: 80 output tokens total, over the
+    # configured 50-token project OTPM limit but negligible input tokens.
+    mock_content = MagicMock()
+    mock_content.content = (
+        b'{"body": {"model": "gpt-4o-mini", "max_tokens": 40, '
+        b'"messages": [{"role": "user", "content": "hi"}]}}\n'
+        b'{"body": {"model": "gpt-4o-mini", "max_tokens": 40, '
+        b'"messages": [{"role": "user", "content": "hi"}]}}\n'
+    )
+
+    with (
+        patch("litellm.proxy.proxy_server.general_settings", {}),
+        patch("litellm.proxy.proxy_server.llm_router", MagicMock()),
+        patch(
+            "litellm.proxy.openai_files_endpoints.common_utils.get_credentials_for_model",
+            return_value={"custom_llm_provider": "openai"},
+        ),
+        patch("litellm.afile_content", new=AsyncMock(return_value=mock_content)),
+    ):
+        with pytest.raises(HTTPException) as exc:
+            await rate_limiter.async_pre_call_hook(
+                user_api_key_dict=user,
+                cache=local_cache,
+                data={"input_file_id": "file-abc123", "model": "gpt-4o-mini"},
+                call_type="acreate_batch",
+            )
+
+    assert exc.value.status_code == 429
+    assert "model_per_project_otpm" in str(exc.value.detail)
+
+
+@pytest.mark.asyncio
+async def test_pre_call_enforces_project_itpm_limit_for_batch():
+    """Companion to the OTPM regression above: a project's ITPM quota must
+    also apply to batch submissions."""
+    from litellm import DualCache
+    from litellm.proxy.hooks.batch_rate_limiter import _PROXY_BatchRateLimiter
+    from litellm.proxy.hooks.parallel_request_limiter_v3 import (
+        _PROXY_MaxParallelRequestsHandler_v3,
+    )
+    from litellm.proxy.utils import InternalUsageCache
+
+    local_cache = DualCache()
+    parallel_request_limiter = _PROXY_MaxParallelRequestsHandler_v3(
+        internal_usage_cache=InternalUsageCache(local_cache)
+    )
+    rate_limiter = _PROXY_BatchRateLimiter(
+        internal_usage_cache=InternalUsageCache(local_cache),
+        parallel_request_limiter=parallel_request_limiter,
+    )
+
+    user = UserAPIKeyAuth(
+        api_key="sk-project-batch-itpm",
+        models=["*"],
+        project_id="proj-mantle-batch",
+        project_metadata={"model_itpm_limit": {"gpt-4o-mini": 1}},
+    )
+
+    mock_content = MagicMock()
+    mock_content.content = (
+        b'{"body": {"model": "gpt-4o-mini", "max_tokens": 1, '
+        b'"messages": [{"role": "user", "content": "well over one token of input"}]}}\n'
+    )
+
+    with (
+        patch("litellm.proxy.proxy_server.general_settings", {}),
+        patch("litellm.proxy.proxy_server.llm_router", MagicMock()),
+        patch(
+            "litellm.proxy.openai_files_endpoints.common_utils.get_credentials_for_model",
+            return_value={"custom_llm_provider": "openai"},
+        ),
+        patch("litellm.afile_content", new=AsyncMock(return_value=mock_content)),
+    ):
+        with pytest.raises(HTTPException) as exc:
+            await rate_limiter.async_pre_call_hook(
+                user_api_key_dict=user,
+                cache=local_cache,
+                data={"input_file_id": "file-abc123", "model": "gpt-4o-mini"},
+                call_type="acreate_batch",
+            )
+
+    assert exc.value.status_code == 429
+    assert "model_per_project_itpm" in str(exc.value.detail)
+
+
+@pytest.mark.asyncio
+async def test_pre_call_enforces_project_otpm_limit_for_non_routing_row_model():
+    """VERIA regression: project ITPM/OTPM descriptors were built only for the
+    file-bound/top-level routing model, so a caller could bind the batch file
+    to an unlimited model while a JSONL row's own `body.model` named a
+    different, quota-limited model. That row's tokens must still be charged
+    against its own model's project OTPM quota."""
+    from litellm import DualCache
+    from litellm.proxy.hooks.batch_rate_limiter import _PROXY_BatchRateLimiter
+    from litellm.proxy.hooks.parallel_request_limiter_v3 import (
+        _PROXY_MaxParallelRequestsHandler_v3,
+    )
+    from litellm.proxy.utils import InternalUsageCache
+
+    local_cache = DualCache()
+    parallel_request_limiter = _PROXY_MaxParallelRequestsHandler_v3(
+        internal_usage_cache=InternalUsageCache(local_cache)
+    )
+    rate_limiter = _PROXY_BatchRateLimiter(
+        internal_usage_cache=InternalUsageCache(local_cache),
+        parallel_request_limiter=parallel_request_limiter,
+    )
+
+    # The routing model ("unlimited-model") has no configured quota; only
+    # "quota-limited-model" -- named inside the JSONL row, not the routing
+    # model -- has a project OTPM limit.
+    user = UserAPIKeyAuth(
+        api_key="sk-project-batch-cross-model",
+        models=["*"],
+        project_id="proj-mantle-batch",
+        project_metadata={"model_otpm_limit": {"quota-limited-model": 50}},
+    )
+
+    mock_content = MagicMock()
+    mock_content.content = (
+        b'{"body": {"model": "quota-limited-model", "max_tokens": 80, '
+        b'"messages": [{"role": "user", "content": "hi"}]}}\n'
+    )
+
+    with (
+        patch("litellm.proxy.proxy_server.general_settings", {}),
+        patch("litellm.proxy.proxy_server.llm_router", MagicMock()),
+        patch(
+            "litellm.proxy.openai_files_endpoints.common_utils.get_credentials_for_model",
+            return_value={"custom_llm_provider": "openai"},
+        ),
+        patch("litellm.afile_content", new=AsyncMock(return_value=mock_content)),
+    ):
+        with pytest.raises(HTTPException) as exc:
+            await rate_limiter.async_pre_call_hook(
+                user_api_key_dict=user,
+                cache=local_cache,
+                data={"input_file_id": "file-abc123", "model": "unlimited-model"},
+                call_type="acreate_batch",
+            )
+
+    assert exc.value.status_code == 429
+    assert "model_per_project_otpm" in str(exc.value.detail)
+    assert "quota-limited-model" in str(exc.value.detail)
+
+
+@pytest.mark.asyncio
+async def test_pre_call_charges_each_row_model_against_its_own_project_quota():
+    """A batch whose rows target two different project-quota-limited models
+    must charge each row's tokens only against its own model's quota, never
+    the other model's or the whole batch's combined total. The under-limit
+    model's request must succeed even though the over-limit model's row
+    would fail on its own."""
+    from litellm import DualCache
+    from litellm.proxy.hooks.batch_rate_limiter import _PROXY_BatchRateLimiter
+    from litellm.proxy.hooks.parallel_request_limiter_v3 import (
+        PROJECT_OTPM_DESCRIPTOR_KEY,
+        _PROXY_MaxParallelRequestsHandler_v3,
+    )
+    from litellm.proxy.utils import InternalUsageCache
+
+    local_cache = DualCache()
+    parallel_request_limiter = _PROXY_MaxParallelRequestsHandler_v3(
+        internal_usage_cache=InternalUsageCache(local_cache)
+    )
+    rate_limiter = _PROXY_BatchRateLimiter(
+        internal_usage_cache=InternalUsageCache(local_cache),
+        parallel_request_limiter=parallel_request_limiter,
+    )
+
+    user = UserAPIKeyAuth(
+        api_key="sk-project-batch-two-models",
+        models=["*"],
+        project_id="proj-mantle-batch",
+        project_metadata={
+            "model_otpm_limit": {"model-a": 1000, "model-b": 10},
+        },
+    )
+
+    # model-a stays comfortably under its 1000 OTPM limit; model-b's single
+    # row alone exceeds its 10 OTPM limit. If the two were combined into one
+    # counter (the pre-fix behavior for the routing model), model-a's ample
+    # headroom would mask model-b's overage.
+    mock_content = MagicMock()
+    mock_content.content = (
+        b'{"body": {"model": "model-a", "max_tokens": 5, '
+        b'"messages": [{"role": "user", "content": "hi"}]}}\n'
+        b'{"body": {"model": "model-b", "max_tokens": 40, '
+        b'"messages": [{"role": "user", "content": "hi"}]}}\n'
+    )
+
+    with (
+        patch("litellm.proxy.proxy_server.general_settings", {}),
+        patch("litellm.proxy.proxy_server.llm_router", MagicMock()),
+        patch(
+            "litellm.proxy.openai_files_endpoints.common_utils.get_credentials_for_model",
+            return_value={"custom_llm_provider": "openai"},
+        ),
+        patch("litellm.afile_content", new=AsyncMock(return_value=mock_content)),
+    ):
+        with pytest.raises(HTTPException) as exc:
+            await rate_limiter.async_pre_call_hook(
+                user_api_key_dict=user,
+                cache=local_cache,
+                data={"input_file_id": "file-abc123", "model": "model-a"},
+                call_type="acreate_batch",
+            )
+
+    assert exc.value.status_code == 429
+    assert "model-b" in str(exc.value.detail)
+
+    # model-a's own counter was not touched by model-b's rejection: a
+    # follow-up model-a-only batch well within its own limit must still pass.
+    model_a_status = await parallel_request_limiter.should_rate_limit(
+        descriptors=[
+            {
+                "key": PROJECT_OTPM_DESCRIPTOR_KEY,
+                "value": "proj-mantle-batch:model-a",
+                "rate_limit": {
+                    "requests_per_unit": None,
+                    "tokens_per_unit": 1000,
+                    "window_size": parallel_request_limiter.window_size,
+                },
+            }
+        ],
+        read_only=True,
+    )
+    assert model_a_status["overall_code"] == "OK"
+
+
+def test_should_not_skip_when_project_has_io_limit_for_non_routing_model():
+    """The no-limits skip must not fire just because the file-bound/top-level
+    routing model itself has no configured quota: a JSONL row can name a
+    different model that the project *does* quota, and that isn't knowable
+    without downloading and parsing the file."""
+    rate_limiter = _make_rate_limiter()
+    # No key/team/model-level limits at all -- only a project OTPM limit for a
+    # model unrelated to the routing model below.
+    rate_limiter.parallel_request_limiter._create_rate_limit_descriptors.return_value = [
+        {"rate_limit": {}}
+    ]
+    user = UserAPIKeyAuth(
+        api_key="sk",
+        models=["*"],
+        project_id="proj-mantle-batch",
+        project_metadata={"model_otpm_limit": {"some-other-model": 50}},
+    )
+    with patch("litellm.proxy.proxy_server.general_settings", {}):
+        should_skip, descriptors = rate_limiter._should_skip_batch_input_file_processing(
+            data={"model": "unlimited-model", "input_file_id": "file-abc"},
+            user_api_key_dict=user,
+        )
+    assert should_skip is False
+    assert descriptors is not None
+
+
+def test_should_skip_when_project_has_no_io_limits_and_no_other_limits():
+    """Sanity check for the new project-limits carve-out: a project caller
+    with no ITPM/OTPM configuration anywhere must still get the fast-path
+    skip when no other rate limits apply, exactly as before this fix."""
+    rate_limiter = _make_rate_limiter()
+    rate_limiter.parallel_request_limiter._create_rate_limit_descriptors.return_value = [
+        {"rate_limit": {}}
+    ]
+    user = UserAPIKeyAuth(
+        api_key="sk",
+        models=["*"],
+        project_id="proj-mantle-batch",
+        project_metadata={},
+    )
+    with patch("litellm.proxy.proxy_server.general_settings", {}):
+        should_skip, descriptors = rate_limiter._should_skip_batch_input_file_processing(
+            data={"model": "unlimited-model", "input_file_id": "file-abc"},
+            user_api_key_dict=user,
+        )
+    assert should_skip is True
+    assert descriptors is None
+
+
 @pytest.mark.asyncio
 async def test_count_input_file_usage_raises_on_non_bytes_content():
     from litellm.proxy.hooks.batch_rate_limiter import _PROXY_BatchRateLimiter
@@ -1671,3 +1980,117 @@ async def test_count_input_file_usage_collects_models_after_malformed_line():
             )
 
     assert exc.value.status_code == 403
+
+
+# ---------------------------------------------------------------------------
+# VERIA-Low regression: Responses batch rows must not bypass project OTPM
+# ---------------------------------------------------------------------------
+
+
+def _output_estimator():
+    """A `_PROXY_BatchRateLimiter` whose output-token floor is observable:
+    the no-`max_tokens` floor mock returns a distinctive sentinel so tests can
+    tell "floor was used" apart from "an explicit cap was read"."""
+    from litellm.proxy.hooks.batch_rate_limiter import _PROXY_BatchRateLimiter
+    from litellm.proxy.hooks.parallel_request_limiter_v3 import (
+        _PROXY_MaxParallelRequestsHandler_v3,
+    )
+
+    limiter = MagicMock()
+    limiter.no_max_tokens_output_floor.return_value = 999
+    limiter.get_output_candidate_count = _PROXY_MaxParallelRequestsHandler_v3.get_output_candidate_count
+    return _PROXY_BatchRateLimiter(
+        internal_usage_cache=MagicMock(),
+        parallel_request_limiter=limiter,
+    )
+
+
+def test_estimate_entry_output_tokens_zero_for_embeddings_url():
+    """A real `/v1/embeddings` row reserves zero output tokens."""
+    rate_limiter = _output_estimator()
+    entry = {
+        "url": "/v1/embeddings",
+        "body": {"model": "text-embedding-3-small", "input": "hello world"},
+    }
+
+    assert rate_limiter._estimate_entry_output_tokens(entry, None) == 0
+
+
+def test_estimate_entry_output_tokens_does_not_zero_responses_row_with_input():
+    """Pre-fix: a `/v1/responses` row carries `body.input` with no `messages`/
+    `prompt`, so the old body-shape heuristic misclassified it as embeddings
+    and reserved zero output tokens -- a project caller could submit large
+    Responses generations against a quota-limited model without consuming
+    OTPM. The row's own `url` (not body shape) must decide this."""
+    rate_limiter = _output_estimator()
+    entry = {
+        "url": "/v1/responses",
+        "body": {"model": "gpt-4o", "input": "write me an essay"},
+    }
+
+    # No explicit cap on the row, so it must fall back to the no-max-tokens
+    # floor -- never straight to zero.
+    assert rate_limiter._estimate_entry_output_tokens(entry, None) == 999
+    rate_limiter.parallel_request_limiter.no_max_tokens_output_floor.assert_called_once_with(None)
+
+
+def test_estimate_entry_output_tokens_uses_max_output_tokens_for_responses():
+    """`/v1/responses` caps output with `max_output_tokens`, not `max_tokens`/
+    `max_completion_tokens`. Pre-fix this field was never inspected, so a
+    capped Responses row still fell through to the (possibly larger) floor
+    estimate instead of the caller's own declared cap."""
+    rate_limiter = _output_estimator()
+    entry = {
+        "url": "/v1/responses",
+        "body": {"model": "gpt-4o", "input": "hi", "max_output_tokens": 123},
+    }
+
+    assert rate_limiter._estimate_entry_output_tokens(entry, None) == 123
+    rate_limiter.parallel_request_limiter.no_max_tokens_output_floor.assert_not_called()
+
+
+def test_estimate_entry_output_tokens_prefers_max_tokens_over_max_output_tokens():
+    """When a row somehow carries both fields, the chat-style cap wins first --
+    `max_output_tokens` is only consulted once the chat-style caps are absent."""
+    rate_limiter = _output_estimator()
+    entry = {
+        "url": "/v1/chat/completions",
+        "body": {
+            "model": "gpt-4o",
+            "messages": [],
+            "max_tokens": 50,
+            "max_output_tokens": 500,
+        },
+    }
+
+    assert rate_limiter._estimate_entry_output_tokens(entry, None) == 50
+
+
+@pytest.mark.parametrize(
+    ("body_extra", "expected"),
+    [
+        ({"max_tokens": 40, "n": 10}, 400),
+        ({"max_tokens": 40, "best_of": 5}, 200),
+        ({"max_tokens": 40, "n": 3, "best_of": 5}, 200),
+        ({"max_tokens": 40, "n": 0}, 40),
+        ({"max_tokens": 40, "n": -2}, 40),
+        ({"max_tokens": 40, "n": 5.0}, 200),
+        ({"max_tokens": 40, "n": "10"}, 400),
+        ({"max_tokens": 40, "n": "not-a-number"}, 40),
+        ({"max_tokens": 40, "n": 1e309}, 40),
+        ({"max_tokens": 1e309, "n": 3}, 2997),
+        ({"n": 3}, 2997),
+    ],
+)
+def test_estimate_entry_output_tokens_multiplies_candidate_count(body_extra, expected):
+    """A row generating n / best_of candidates consumes that many completions'
+    worth of output tokens, so the OTPM reservation must scale with the
+    effective candidate count. Pre-fix a `max_tokens: 40, n: 10` row consumed
+    up to 400 output tokens while reserving only 40."""
+    rate_limiter = _output_estimator()
+    entry = {
+        "url": "/v1/chat/completions",
+        "body": {"model": "gpt-4o", "messages": [], **body_extra},
+    }
+
+    assert rate_limiter._estimate_entry_output_tokens(entry, None) == expected
diff --git a/tests/test_litellm/proxy/hooks/test_parallel_request_limiter_v3.py b/tests/test_litellm/proxy/hooks/test_parallel_request_limiter_v3.py
index 194b9dcb217..54366226dfb 100644
--- a/tests/test_litellm/proxy/hooks/test_parallel_request_limiter_v3.py
+++ b/tests/test_litellm/proxy/hooks/test_parallel_request_limiter_v3.py
@@ -3116,6 +3116,192 @@ async def test_project_model_rate_limits_not_triggered_for_other_model_v3():
     ), f"model_per_project should not be added for unrelated model, got: {descriptor_keys}"
 
 
+@pytest.mark.asyncio
+async def test_project_model_itpm_otpm_limits_enforced_v3():
+    """
+    Project-level model_itpm_limit/model_otpm_limit must produce distinct
+    Bedrock Mantle-style input and output token descriptors.
+    """
+    _api_key = hash_token("sk-project-io-test")
+    local_cache = DualCache()
+    parallel_request_handler = _PROXY_MaxParallelRequestsHandler(
+        internal_usage_cache=InternalUsageCache(local_cache)
+    )
+
+    captured_descriptors = []
+
+    async def mock_should_rate_limit(descriptors, **kwargs):
+        captured_descriptors.extend(descriptors)
+        return {"overall_code": "OK", "statuses": []}
+
+    parallel_request_handler.should_rate_limit = mock_should_rate_limit
+
+    user_api_key_dict = UserAPIKeyAuth(
+        api_key=_api_key,
+        project_id="proj-mantle",
+        project_metadata={
+            "model_itpm_limit": {"bedrock_mantle/claude-opus": 20000000},
+            "model_otpm_limit": {"bedrock_mantle/claude-opus": 4000000},
+        },
+    )
+
+    await parallel_request_handler.async_pre_call_hook(
+        user_api_key_dict=user_api_key_dict,
+        cache=local_cache,
+        data={"model": "bedrock_mantle/claude-opus"},
+        call_type="",
+    )
+
+    descriptor_keys = [d["key"] for d in captured_descriptors]
+    assert "model_per_project_itpm" in descriptor_keys
+    assert "model_per_project_otpm" in descriptor_keys
+    assert "model_per_project" not in descriptor_keys
+
+    itpm_descriptor = next(
+        d for d in captured_descriptors if d["key"] == "model_per_project_itpm"
+    )
+    otpm_descriptor = next(
+        d for d in captured_descriptors if d["key"] == "model_per_project_otpm"
+    )
+    assert itpm_descriptor["value"] == "proj-mantle:bedrock_mantle/claude-opus"
+    assert itpm_descriptor["rate_limit"]["tokens_per_unit"] == 20000000
+    assert otpm_descriptor["value"] == "proj-mantle:bedrock_mantle/claude-opus"
+    assert otpm_descriptor["rate_limit"]["tokens_per_unit"] == 4000000
+
+
+@pytest.mark.asyncio
+async def test_project_model_itpm_otpm_limits_not_triggered_for_other_model_v3():
+    """Split project limits must not apply to an unrelated model."""
+    _api_key = hash_token("sk-project-io-test-2")
+    local_cache = DualCache()
+    parallel_request_handler = _PROXY_MaxParallelRequestsHandler(
+        internal_usage_cache=InternalUsageCache(local_cache)
+    )
+
+    captured_descriptors = []
+
+    async def mock_should_rate_limit(descriptors, **kwargs):
+        captured_descriptors.extend(descriptors)
+        return {"overall_code": "OK", "statuses": []}
+
+    parallel_request_handler.should_rate_limit = mock_should_rate_limit
+
+    user_api_key_dict = UserAPIKeyAuth(
+        api_key=_api_key,
+        project_id="proj-mantle",
+        project_metadata={
+            "model_itpm_limit": {"bedrock_mantle/claude-opus": 20000000},
+        },
+    )
+
+    await parallel_request_handler.async_pre_call_hook(
+        user_api_key_dict=user_api_key_dict,
+        cache=local_cache,
+        data={"model": "gpt-4"},
+        call_type="",
+    )
+
+    descriptor_keys = [d["key"] for d in captured_descriptors]
+    assert "model_per_project_itpm" not in descriptor_keys
+    assert "model_per_project_otpm" not in descriptor_keys
+
+
+@pytest.mark.asyncio
+async def test_project_model_itpm_and_tpm_limits_coexist_v3():
+    """Combined project TPM and split ITPM/OTPM limits are enforced together."""
+    _api_key = hash_token("sk-project-io-test-3")
+    local_cache = DualCache()
+    parallel_request_handler = _PROXY_MaxParallelRequestsHandler(
+        internal_usage_cache=InternalUsageCache(local_cache)
+    )
+
+    captured_descriptors = []
+
+    async def mock_should_rate_limit(descriptors, **kwargs):
+        captured_descriptors.extend(descriptors)
+        return {"overall_code": "OK", "statuses": []}
+
+    parallel_request_handler.should_rate_limit = mock_should_rate_limit
+
+    user_api_key_dict = UserAPIKeyAuth(
+        api_key=_api_key,
+        project_id="proj-mantle",
+        project_metadata={
+            "model_tpm_limit": {"bedrock_mantle/claude-opus": 1000},
+            "model_itpm_limit": {"bedrock_mantle/claude-opus": 20000000},
+            "model_otpm_limit": {"bedrock_mantle/claude-opus": 4000000},
+        },
+    )
+
+    await parallel_request_handler.async_pre_call_hook(
+        user_api_key_dict=user_api_key_dict,
+        cache=local_cache,
+        data={"model": "bedrock_mantle/claude-opus"},
+        call_type="",
+    )
+
+    descriptor_keys = [d["key"] for d in captured_descriptors]
+    assert "model_per_project" in descriptor_keys
+    assert "model_per_project_itpm" in descriptor_keys
+    assert "model_per_project_otpm" in descriptor_keys
+
+
+@pytest.mark.asyncio
+async def test_enforce_project_io_token_quota_for_frame_blocks_over_limit_otpm():
+    """VERIA regression: the Responses WebSocket connection-level pre-call
+    hook only runs once, but a connection accepts many response.create
+    frames. enforce_project_io_token_quota_for_frame is the per-frame check
+    that closes that gap; it must reserve against the caller's project OTPM
+    limit and reject once a frame's estimated output tokens exceed it."""
+    _api_key = hash_token("sk-ws-frame-otpm")
+    local_cache = DualCache()
+    handler = _PROXY_MaxParallelRequestsHandler(
+        internal_usage_cache=InternalUsageCache(local_cache)
+    )
+    user_api_key_dict = UserAPIKeyAuth(
+        api_key=_api_key,
+        project_id="proj-mantle-ws",
+        project_metadata={"model_otpm_limit": {"gpt-4o": 50}},
+    )
+
+    await handler.enforce_project_io_token_quota_for_frame(
+        user_api_key_dict=user_api_key_dict,
+        requested_model="gpt-4o",
+        estimated_input_tokens=1,
+        estimated_output_tokens=30,
+    )
+
+    with pytest.raises(HTTPException) as exc:
+        await handler.enforce_project_io_token_quota_for_frame(
+            user_api_key_dict=user_api_key_dict,
+            requested_model="gpt-4o",
+            estimated_input_tokens=1,
+            estimated_output_tokens=30,
+        )
+
+    assert exc.value.status_code == 429
+    assert "model_per_project_otpm" in str(exc.value.detail)
+
+
+@pytest.mark.asyncio
+async def test_enforce_project_io_token_quota_for_frame_noop_without_project_limits():
+    """A key with no project ITPM/OTPM configured must never be blocked by
+    the per-frame check (no descriptors to reserve against)."""
+    _api_key = hash_token("sk-ws-frame-no-limits")
+    local_cache = DualCache()
+    handler = _PROXY_MaxParallelRequestsHandler(
+        internal_usage_cache=InternalUsageCache(local_cache)
+    )
+    user_api_key_dict = UserAPIKeyAuth(api_key=_api_key)
+
+    await handler.enforce_project_io_token_quota_for_frame(
+        user_api_key_dict=user_api_key_dict,
+        requested_model="gpt-4o",
+        estimated_input_tokens=10_000_000,
+        estimated_output_tokens=10_000_000,
+    )
+
+
 @pytest.mark.asyncio
 async def test_pre_call_hook_keeps_internal_stash_out_of_request_body():
     """Regression for #27001 / #35197: the limiter's per-request bookkeeping
@@ -3192,7 +3378,7 @@ async def test_responses_route_body_untouched_by_pre_call_hook(caller_metadata):
     _api_key = hash_token("sk-responses-regression")
     user_api_key_dict = UserAPIKeyAuth(
         api_key=_api_key,
-        tpm_limit=1000,
+        tpm_limit=100000,
         rpm_limit=5,
     )
     local_cache = DualCache()
@@ -5264,7 +5450,7 @@ async def test_configured_estimate_does_not_apply_to_embeddings(monkeypatch):
         local_cache,
         user_api_key_dict,
         {"model": "text-embedding-3-small", "input": "hello"},
-        call_type="embeddings",
+        call_type="embedding",
     )
 
     assert reserved == ONE_TOKEN_PROMPT_INPUT_ESTIMATE
diff --git a/tests/test_litellm/proxy/hooks/test_tpm_concurrent.py b/tests/test_litellm/proxy/hooks/test_tpm_concurrent.py
index f7bd37b412a..8d03857c917 100644
--- a/tests/test_litellm/proxy/hooks/test_tpm_concurrent.py
+++ b/tests/test_litellm/proxy/hooks/test_tpm_concurrent.py
@@ -15,7 +15,7 @@ Redis.
 """
 
 import asyncio
-from datetime import datetime
+from datetime import datetime, timedelta
 from typing import Any, Dict
 
 import pytest
@@ -23,15 +23,25 @@ import pytest
 from litellm.caching.caching import DualCache
 from litellm.proxy._types import UserAPIKeyAuth
 from litellm.proxy.hooks.parallel_request_limiter_v3 import (
+    PROJECT_ITPM_DESCRIPTOR_KEY,
+    PROJECT_OTPM_DESCRIPTOR_KEY,
+    _AUDIO_BYTES_PER_TOKEN,
     _PROXY_MaxParallelRequestsHandler_v3 as RateLimitHandler,
 )
 from litellm.proxy.hooks.parallel_request_limiter_v3 import (
+    _call_id_from_callback_kwargs,
     _request_stash,
     get_or_create_request_stash,
     get_request_stash,
 )
 from litellm.proxy.utils import InternalUsageCache, hash_token
-from litellm.types.utils import ModelResponse, Usage
+from litellm.types.llms.openai import (
+    InputTokensDetails,
+    ResponseAPIUsage,
+    ResponsesAPIResponse,
+)
+from litellm.types.rerank import RerankResponse
+from litellm.types.utils import ModelResponse, PromptTokensDetailsWrapper, Usage
 
 
 @pytest.fixture
@@ -582,6 +592,47 @@ async def test_estimate_tokens_uses_max_tokens_when_explicit(rate_limiter):
     assert estimate == 4 + 25
 
 
+@pytest.mark.asyncio
+async def test_estimate_tokens_honors_explicit_zero_max_tokens(rate_limiter):
+    """
+    Regression for a Greptile finding: explicit_max_tokens was resolved via
+    `data.get("max_tokens") or data.get("max_completion_tokens") or
+    data.get("max_output_tokens")`, so an explicit 0 in the first field was
+    falsy and fell through to the next field (or the no-max_tokens floor),
+    silently discarding a caller's explicit zero-output request.
+    """
+    handler, _cache = rate_limiter
+
+    estimate = handler._estimate_tokens_for_request(
+        data={
+            "messages": [
+                {"role": "user", "content": "abcd" * 4}
+            ],  # 16 chars ~ 4 tokens
+            "max_tokens": 0,
+        }
+    )
+    assert estimate == 4, (
+        f"expected input-only reservation (4) for an explicit max_tokens=0, got {estimate}"
+    )
+
+
+@pytest.mark.asyncio
+async def test_estimate_tokens_honors_explicit_zero_max_output_tokens_for_responses(
+    rate_limiter,
+):
+    handler, _cache = rate_limiter
+
+    estimate = handler._estimate_tokens_for_request(
+        data={
+            "input": "describe this image in detail",  # 29 chars ~ 7 tokens
+            "max_output_tokens": 0,
+        },
+        min_configured_tpm_limit=40,
+        call_type="aresponses",
+    )
+    assert estimate == 23
+
+
 @pytest.mark.asyncio
 async def test_estimate_tokens_zero_for_empty_embeddings(rate_limiter):
     """Embeddings have no output budget — reservation should equal input only."""
@@ -1197,5 +1248,2427 @@ async def test_small_tpm_cap_preserves_explicit_max_tokens(rate_limiter):
     assert data["max_tokens"] == 500
 
 
+@pytest.mark.asyncio
+async def test_project_otpm_reservation_prevents_concurrent_bypass(rate_limiter):
+    """
+    Bedrock Mantle-style OTPM: with a 100 OTPM limit and 5 concurrent
+    requests each reserving 50+ output tokens, upfront reservation must
+    reject the late arrivals -- not let all 5 through. Exercises the
+    in-memory fallback in ``atomic_check_and_increment_by_n`` for the
+    project-scoped ITPM/OTPM descriptors specifically.
+    """
+    handler, cache = rate_limiter
+
+    user_api_key_dict = UserAPIKeyAuth(
+        api_key=hash_token("sk-otpm-bypass"),
+        project_id="proj-mantle-bypass",
+        project_metadata={
+            "model_otpm_limit": {"bedrock_mantle/claude-opus": 100},
+        },
+    )
+
+    request_data = {
+        "model": "bedrock_mantle/claude-opus",
+        "messages": [{"role": "user", "content": "hello"}],
+        "max_tokens": 50,
+    }
+
+    async def make_request(request_id: int) -> Dict[str, Any]:
+        data = request_data.copy()
+        try:
+            await handler.async_pre_call_hook(
+                user_api_key_dict=user_api_key_dict,
+                cache=cache,
+                data=data,
+                call_type="",
+            )
+            return {"request_id": request_id, "success": True}
+        except Exception as e:
+            return {
+                "request_id": request_id,
+                "success": False,
+                "status_code": getattr(e, "status_code", None),
+            }
+
+    results = await asyncio.gather(*[make_request(i) for i in range(5)])
+
+    successful = [r for r in results if r["success"]]
+    rate_limited = [
+        r for r in results if not r["success"] and r.get("status_code") == 429
+    ]
+
+    assert len(rate_limited) > 0, (
+        f"Expected some OTPM-rate-limited requests but all {len(successful)} succeeded."
+    )
+
+
+@pytest.mark.asyncio
+async def test_project_otpm_rejects_multiple_completion_candidates(rate_limiter):
+    handler, cache = rate_limiter
+    user_api_key_dict = UserAPIKeyAuth(
+        api_key=hash_token("sk-otpm-multiple-candidates"),
+        project_id="proj-multiple-candidates",
+        project_metadata={
+            "model_otpm_limit": {"bedrock_mantle/claude-opus": 500},
+        },
+    )
+    data = {
+        "model": "bedrock_mantle/claude-opus",
+        "messages": [{"role": "user", "content": "hello"}],
+        "max_tokens": 100,
+        "n": 10,
+    }
+
+    with pytest.raises(Exception) as exc_info:
+        await handler.async_pre_call_hook(
+            user_api_key_dict=user_api_key_dict,
+            cache=cache,
+            data=data,
+            call_type="acompletion",
+        )
+
+    assert getattr(exc_info.value, "status_code", None) == 429
+
+
+@pytest.mark.asyncio
+async def test_project_otpm_reserves_largest_conflicting_output_cap(rate_limiter):
+    handler, cache = rate_limiter
+    user_api_key_dict = UserAPIKeyAuth(
+        api_key=hash_token("sk-otpm-conflicting-caps"),
+        project_id="proj-conflicting-caps",
+        project_metadata={
+            "model_otpm_limit": {"bedrock_mantle/claude-opus": 50},
+        },
+    )
+    data = {
+        "model": "bedrock_mantle/claude-opus",
+        "messages": [{"role": "user", "content": "hello"}],
+        "max_tokens": 1,
+        "max_completion_tokens": 100,
+    }
+
+    with pytest.raises(Exception) as exc_info:
+        await handler.async_pre_call_hook(
+            user_api_key_dict=user_api_key_dict,
+            cache=cache,
+            data=data,
+            call_type="acompletion",
+        )
+
+    assert getattr(exc_info.value, "status_code", None) == 429
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize(
+    "call_type",
+    ["agenerate_content", "agenerate_content_stream"],
+)
+@pytest.mark.parametrize("config_field", ["config", "generationConfig"])
+async def test_project_otpm_rejects_google_genai_native_output_cap(
+    rate_limiter,
+    call_type,
+    config_field,
+):
+    handler, cache = rate_limiter
+    model = "gemini/gemini-3-flash-preview"
+    user_api_key_dict = UserAPIKeyAuth(
+        api_key=hash_token("sk-google-genai-native-otpm"),
+        project_id="project-google-genai-native-otpm",
+        project_metadata={"model_otpm_limit": {model: 50}},
+    )
+
+    with pytest.raises(Exception) as exc_info:
+        await handler.async_pre_call_hook(
+            user_api_key_dict=user_api_key_dict,
+            cache=cache,
+            data={
+                "model": model,
+                "contents": [{"role": "user", "parts": [{"text": "Hello"}]}],
+                config_field: {"maxOutputTokens": 100},
+            },
+            call_type=call_type,
+        )
+
+    assert getattr(exc_info.value, "status_code", None) == 429
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize(
+    "call_type",
+    ["agenerate_content", "agenerate_content_stream"],
+)
+@pytest.mark.parametrize("candidate_count_field", ["candidateCount", "candidate_count"])
+async def test_project_otpm_rejects_google_genai_native_candidate_count(
+    rate_limiter,
+    call_type,
+    candidate_count_field,
+):
+    handler, cache = rate_limiter
+    model = "gemini/gemini-3-flash-preview"
+    user_api_key_dict = UserAPIKeyAuth(
+        api_key=hash_token("sk-google-genai-native-candidate-count"),
+        project_id="project-google-genai-native-candidate-count",
+        project_metadata={"model_otpm_limit": {model: 150}},
+    )
+
+    with pytest.raises(Exception) as exc_info:
+        await handler.async_pre_call_hook(
+            user_api_key_dict=user_api_key_dict,
+            cache=cache,
+            data={
+                "model": model,
+                "contents": [{"role": "user", "parts": [{"text": "Hello"}]}],
+                "config": {
+                    "maxOutputTokens": 50,
+                    candidate_count_field: 4,
+                },
+            },
+            call_type=call_type,
+        )
+
+    assert getattr(exc_info.value, "status_code", None) == 429
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize(
+    "call_type",
+    ["agenerate_content", "agenerate_content_stream"],
+)
+@pytest.mark.parametrize("config_field", [None, "config", "generationConfig"])
+async def test_project_otpm_injects_google_genai_native_output_cap(
+    rate_limiter,
+    call_type,
+    config_field,
+):
+    handler, cache = rate_limiter
+    model = "gemini/gemini-3-flash-preview"
+    user_api_key_dict = UserAPIKeyAuth(
+        api_key=hash_token("sk-google-genai-native-implicit-otpm"),
+        project_id="project-google-genai-native-implicit-otpm",
+        project_metadata={"model_otpm_limit": {model: 40}},
+    )
+    data = {
+        "model": model,
+        "contents": [{"role": "user", "parts": [{"text": "Hello"}]}],
+    }
+    if config_field is not None:
+        data[config_field] = {"temperature": 0}
+
+    await handler.async_pre_call_hook(
+        user_api_key_dict=user_api_key_dict,
+        cache=cache,
+        data=data,
+        call_type=call_type,
+    )
+
+    stash = get_request_stash()
+    assert stash is not None
+    assert stash.otpm_reserved_tokens == 10
+    expected_config_field = config_field or "config"
+    assert data[expected_config_field]["maxOutputTokens"] == 10
+    assert "max_tokens" not in data
+
+
+@pytest.mark.asyncio
+async def test_project_otpm_over_limit_rolls_back_itpm_reservation(rate_limiter):
+    """
+    When ITPM reserves fine but OTPM is then over limit, the ITPM
+    reservation this same pre-call already made must be rolled back --
+    otherwise it leaks until the window's TTL, silently shrinking the ITPM
+    budget for every other request in that minute.
+    """
+    handler, cache = rate_limiter
+
+    user_api_key_dict = UserAPIKeyAuth(
+        api_key=hash_token("sk-otpm-rollback"),
+        project_id="proj-mantle-rollback",
+        project_metadata={
+            "model_itpm_limit": {"bedrock_mantle/claude-opus": 1000000},
+            "model_otpm_limit": {"bedrock_mantle/claude-opus": 10},
+        },
+    )
+
+    itpm_counter_key = handler.create_rate_limit_keys(
+        key="model_per_project_itpm",
+        value="proj-mantle-rollback:bedrock_mantle/claude-opus",
+        rate_limit_type="tokens",
+    )
+
+    data = {
+        "model": "bedrock_mantle/claude-opus",
+        "messages": [{"role": "user", "content": "hello"}],
+        "max_tokens": 500,  # blows past the 10-token OTPM limit
+    }
+
+    with pytest.raises(Exception) as exc_info:
+        await handler.async_pre_call_hook(
+            user_api_key_dict=user_api_key_dict,
+            cache=cache,
+            data=data,
+            call_type="",
+        )
+    assert getattr(exc_info.value, "status_code", None) == 429
+
+    cached_value = await cache.async_get_cache(key=itpm_counter_key, local_only=True)
+    assert int(cached_value or 0) == 0, (
+        f"ITPM reservation leaked after OTPM rejection: counter={cached_value}"
+    )
+
+
+@pytest.mark.asyncio
+async def test_project_itpm_reconciled_on_success_excludes_cached_tokens(rate_limiter):
+    """
+    On success, ITPM reconciles to billable input tokens (prompt_tokens
+    minus cached_tokens) -- not raw prompt_tokens. Cached prompt-read tokens
+    are free under Bedrock Mantle and must not count against the ITPM quota,
+    even though they still appear in usage/cost logging elsewhere.
+    """
+    handler, _cache = rate_limiter
+
+    itpm_scope = ("model_per_project_itpm", "proj-mantle:model")
+    otpm_scope = ("model_per_project_otpm", "proj-mantle:model")
+
+    stash = get_or_create_request_stash()
+    stash.itpm_reserved_tokens = 100
+    stash.itpm_reserved_scopes = frozenset({itpm_scope})
+    stash.otpm_reserved_tokens = 60
+    stash.otpm_reserved_scopes = frozenset({otpm_scope})
+    mock_kwargs = {}
+
+    mock_response = ModelResponse(
+        id="test",
+        object="chat.completion",
+        created=int(datetime.now().timestamp()),
+        model="bedrock_mantle/claude-opus",
+        usage=Usage(
+            prompt_tokens=80,
+            completion_tokens=40,
+            total_tokens=120,
+            prompt_tokens_details=PromptTokensDetailsWrapper(cached_tokens=30),
+        ),
+        choices=[],
+    )
+
+    increments = []
+
+    async def mock_increment(increment_list, **kwargs):
+        for op in increment_list:
+            increments.append({"key": op["key"], "increment": op["increment_value"]})
+
+    handler.internal_usage_cache.dual_cache.async_increment_cache_pipeline = (
+        mock_increment
+    )
+
+    await handler.async_log_success_event(
+        kwargs=mock_kwargs,
+        response_obj=mock_response,
+        start_time=datetime.now(),
+        end_time=datetime.now(),
+    )
+
+    itpm_adjustments = [i for i in increments if "model_per_project_itpm" in i["key"]]
+    otpm_adjustments = [i for i in increments if "model_per_project_otpm" in i["key"]]
+
+    # billable_input = 80 - 30 cached = 50; delta = 50 - 100 reserved = -50
+    assert any(i["increment"] == -50 for i in itpm_adjustments), (
+        f"Expected a -50 ITPM adjustment (50 billable - 100 reserved), got: {itpm_adjustments}"
+    )
+    # delta = 40 actual completion - 60 reserved = -20
+    assert any(i["increment"] == -20 for i in otpm_adjustments), (
+        f"Expected a -20 OTPM adjustment (40 actual - 60 reserved), got: {otpm_adjustments}"
+    )
+
+
+@pytest.mark.asyncio
+async def test_project_reconciliation_does_not_decrement_later_window():
+    current_time = datetime(2026, 8, 5, 12, 0, 0)
+    cache = DualCache()
+    handler = RateLimitHandler(
+        internal_usage_cache=InternalUsageCache(cache),
+        time_provider=lambda: current_time,
+    )
+    handler.window_size = 60
+    scope = (PROJECT_ITPM_DESCRIPTOR_KEY, "project:model")
+    descriptor = {
+        "key": scope[0],
+        "value": scope[1],
+        "rate_limit": {"tokens_per_unit": 1000, "window_size": 60},
+    }
+
+    reservation = await handler.atomic_check_and_increment_by_n(
+        descriptors=[descriptor],
+        increments=[{"tokens": 100}],
+    )
+    counter_key = handler.create_rate_limit_keys(*scope, rate_limit_type="tokens")
+    window_identity = next(
+        identity
+        for identity in reservation["reservation_windows"]
+        if identity[0] == counter_key
+    )
+    stash = get_or_create_request_stash()
+    stash.itpm_reserved_tokens = 100
+    stash.itpm_reserved_scopes = frozenset({scope})
+    stash.itpm_reserved_window_identities = frozenset(
+        {window_identity}
+    )
+
+    current_time += timedelta(seconds=61)
+    later_reservation = await handler.atomic_check_and_increment_by_n(
+        descriptors=[descriptor],
+        increments=[{"tokens": 20}],
+    )
+    assert window_identity not in later_reservation["reservation_windows"]
+
+    await handler.async_log_success_event(
+        kwargs={},
+        response_obj=ModelResponse(
+            usage=Usage(prompt_tokens=10, completion_tokens=0, total_tokens=10)
+        ),
+        start_time=current_time,
+        end_time=current_time,
+    )
+
+    assert float(await cache.async_get_cache(key=counter_key, local_only=True) or 0) == 20
+
+
+@pytest.mark.asyncio
+async def test_project_reconciliation_decrements_its_active_window(rate_limiter):
+    handler, cache = rate_limiter
+    scope = (PROJECT_ITPM_DESCRIPTOR_KEY, "project:model")
+    descriptor = {
+        "key": scope[0],
+        "value": scope[1],
+        "rate_limit": {"tokens_per_unit": 1000, "window_size": 60},
+    }
+    reservation = await handler.atomic_check_and_increment_by_n(
+        descriptors=[descriptor],
+        increments=[{"tokens": 100}],
+    )
+    counter_key = handler.create_rate_limit_keys(*scope, rate_limit_type="tokens")
+    window_identity = next(
+        identity
+        for identity in reservation["reservation_windows"]
+        if identity[0] == counter_key
+    )
+    stash = get_or_create_request_stash()
+    stash.itpm_reserved_tokens = 100
+    stash.itpm_reserved_scopes = frozenset({scope})
+    stash.itpm_reserved_window_identities = frozenset(
+        {window_identity}
+    )
+
+    await handler.async_log_success_event(
+        kwargs={},
+        response_obj=ModelResponse(
+            usage=Usage(prompt_tokens=10, completion_tokens=0, total_tokens=10)
+        ),
+        start_time=datetime.now(),
+        end_time=datetime.now(),
+    )
+
+    assert float(await cache.async_get_cache(key=counter_key, local_only=True) or 0) == 10
+
+
+@pytest.mark.asyncio
+async def test_redis_window_guard_uses_reservation_identity_and_never_falls_back_negative(
+    rate_limiter,
+):
+    handler, _cache = rate_limiter
+    calls = []
+
+    async def failing_guard(*, keys, args):
+        calls.append((keys, args))
+        raise RuntimeError("redis unavailable")
+
+    unguarded_calls = []
+
+    async def capture_unguarded(pipeline_operations, **_kwargs):
+        unguarded_calls.extend(pipeline_operations)
+
+    handler.window_guarded_token_increment_script = failing_guard
+    handler.async_increment_tokens_with_ttl_preservation = capture_unguarded
+    await handler.async_increment_reservation_aware_tokens(
+        pipeline_operations=[
+            {
+                "key": "{model_per_project_itpm:project:model}:tokens",
+                "increment_value": -90,
+                "ttl": 60,
+                "window_key": "{model_per_project_itpm:project:model}:window",
+                "expected_window_start": "1234",
+                "reservation_backend": "redis",
+            }
+        ]
+    )
+
+    assert calls == [
+        (
+            [
+                "{model_per_project_itpm:project:model}:window",
+                "{model_per_project_itpm:project:model}:tokens",
+            ],
+            ["1234", -90, 60],
+        )
+    ]
+    assert unguarded_calls == []
+
+
+@pytest.mark.asyncio
+async def test_atomic_lua_response_carries_redis_window_identity(rate_limiter):
+    handler, _cache = rate_limiter
+    counter_key = "{model_per_project_itpm:project:model}:tokens"
+    meta = [
+        {
+            "descriptor_key": PROJECT_ITPM_DESCRIPTOR_KEY,
+            "descriptor_value": "project:model",
+            "current_limit": 100,
+            "rate_limit_type": "tokens",
+            "counter_key": counter_key,
+        }
+    ]
+
+    async def successful_reservation(*, keys, args):
+        return [0, 25, 1234]
+
+    handler.check_and_increment_by_n_script = successful_reservation
+    assert await handler._atomic_lua_per_descriptor([]) == {
+        "overall_code": "OK",
+        "statuses": [],
+    }
+
+    response = await handler._atomic_lua_per_descriptor(
+        descriptor_groups=[
+            (
+                [
+                    "{model_per_project_itpm:project:model}:window",
+                    counter_key,
+                ],
+                [100, 25, 60, 60],
+                meta,
+            )
+        ]
+    )
+
+    assert response["statuses"][0]["limit_remaining"] == 75
+    assert response["reservation_windows"] == frozenset(
+        {(counter_key, "1234", "redis")}
+    )
+
+
+@pytest.mark.asyncio
+async def test_project_itpm_otpm_released_on_failure(rate_limiter):
+    """On failure, the full ITPM and OTPM reservations must be refunded."""
+    handler, _cache = rate_limiter
+
+    itpm_scope = ("model_per_project_itpm", "proj-mantle:model")
+    otpm_scope = ("model_per_project_otpm", "proj-mantle:model")
+
+    stash = get_or_create_request_stash()
+    stash.itpm_reserved_tokens = 100
+    stash.itpm_reserved_scopes = frozenset({itpm_scope})
+    stash.otpm_reserved_tokens = 60
+    stash.otpm_reserved_scopes = frozenset({otpm_scope})
+    mock_kwargs = {}
+
+    increments = []
+
+    async def mock_increment(increment_list, **kwargs):
+        for op in increment_list:
+            increments.append({"key": op["key"], "increment": op["increment_value"]})
+
+    handler.internal_usage_cache.dual_cache.async_increment_cache_pipeline = (
+        mock_increment
+    )
+
+    await handler.async_log_failure_event(
+        kwargs=mock_kwargs,
+        response_obj=None,
+        start_time=datetime.now(),
+        end_time=datetime.now(),
+    )
+
+    itpm_releases = [i for i in increments if "model_per_project_itpm" in i["key"]]
+    otpm_releases = [i for i in increments if "model_per_project_otpm" in i["key"]]
+
+    assert any(i["increment"] == -100 for i in itpm_releases), itpm_releases
+    assert any(i["increment"] == -60 for i in otpm_releases), otpm_releases
+
+
+@pytest.mark.asyncio
+async def test_proxy_rejection_refunds_itpm_otpm_by_their_own_amount_not_combined(
+    rate_limiter,
+):
+    """
+    Regression for a Greptile-flagged bug: when a project configures both a
+    combined model_tpm_limit and split model_itpm_limit/model_otpm_limit for
+    the same model, async_post_call_failure_hook's proxy-side refund path
+    used to decrement every token descriptor -- including the ITPM/OTPM
+    ones -- by the flat combined reservation amount, instead of each
+    bucket's own reserved amount. That drives the split counters negative
+    (or under-refunds them) instead of returning them to exactly zero.
+    """
+    handler, cache = rate_limiter
+
+    api_key = hash_token("sk-mixed-tpm-io")
+    user_api_key_dict = UserAPIKeyAuth(
+        api_key=api_key,
+        project_id="proj-mixed",
+        project_metadata={
+            "model_tpm_limit": {"bedrock_mantle/claude-opus": 100000},
+            "model_itpm_limit": {"bedrock_mantle/claude-opus": 100000},
+            "model_otpm_limit": {"bedrock_mantle/claude-opus": 100000},
+        },
+    )
+
+    data = {
+        "model": "bedrock_mantle/claude-opus",
+        "messages": [
+            {"role": "user", "content": "hello there, this is a test message"}
+        ],
+        "max_tokens": 60,
+    }
+
+    await handler.async_pre_call_hook(
+        user_api_key_dict=user_api_key_dict,
+        cache=cache,
+        data=data,
+        call_type="",
+    )
+
+    tpm_counter_key = handler.create_rate_limit_keys(
+        key="model_per_project",
+        value="proj-mixed:bedrock_mantle/claude-opus",
+        rate_limit_type="tokens",
+    )
+    itpm_counter_key = handler.create_rate_limit_keys(
+        key="model_per_project_itpm",
+        value="proj-mixed:bedrock_mantle/claude-opus",
+        rate_limit_type="tokens",
+    )
+    otpm_counter_key = handler.create_rate_limit_keys(
+        key="model_per_project_otpm",
+        value="proj-mixed:bedrock_mantle/claude-opus",
+        rate_limit_type="tokens",
+    )
+
+    tpm_reserved = int(
+        await cache.async_get_cache(key=tpm_counter_key, local_only=True) or 0
+    )
+    itpm_reserved = int(
+        await cache.async_get_cache(key=itpm_counter_key, local_only=True) or 0
+    )
+    otpm_reserved = int(
+        await cache.async_get_cache(key=otpm_counter_key, local_only=True) or 0
+    )
+    assert tpm_reserved > 0 and itpm_reserved > 0 and otpm_reserved > 0
+
+    await handler.async_post_call_failure_hook(
+        request_data=data,
+        original_exception=Exception("guardrail rejected"),
+        user_api_key_dict=user_api_key_dict,
+    )
+
+    tpm_after = int(
+        await cache.async_get_cache(key=tpm_counter_key, local_only=True) or 0
+    )
+    itpm_after = int(
+        await cache.async_get_cache(key=itpm_counter_key, local_only=True) or 0
+    )
+    otpm_after = int(
+        await cache.async_get_cache(key=otpm_counter_key, local_only=True) or 0
+    )
+
+    assert tpm_after == 0, f"combined TPM counter leaked: {tpm_after}"
+    assert itpm_after == 0, (
+        f"ITPM counter corrupted by combined-amount refund: {itpm_after}"
+    )
+    assert otpm_after == 0, (
+        f"OTPM counter corrupted by combined-amount refund: {otpm_after}"
+    )
+
+
+@pytest.mark.asyncio
+async def test_proxy_rejection_refunds_itpm_otpm_only_reservation_with_no_combined_tpm(
+    rate_limiter,
+):
+    """
+    Regression for the second half of the same bug: with only
+    model_itpm_limit/model_otpm_limit configured (no model_tpm_limit), the
+    combined reserved_tokens is 0, and the proxy-side refund path used to
+    return immediately on that -- leaking the ITPM/OTPM reservations until
+    the rate-limit window's TTL expired.
+    """
+    handler, cache = rate_limiter
+
+    api_key = hash_token("sk-io-only")
+    user_api_key_dict = UserAPIKeyAuth(
+        api_key=api_key,
+        project_id="proj-io-only",
+        project_metadata={
+            "model_itpm_limit": {"bedrock_mantle/claude-opus": 100000},
+            "model_otpm_limit": {"bedrock_mantle/claude-opus": 100000},
+        },
+    )
+
+    data = {
+        "model": "bedrock_mantle/claude-opus",
+        "messages": [
+            {"role": "user", "content": "hello there, this is a test message"}
+        ],
+        "max_tokens": 60,
+    }
+
+    await handler.async_pre_call_hook(
+        user_api_key_dict=user_api_key_dict,
+        cache=cache,
+        data=data,
+        call_type="",
+    )
+
+    itpm_counter_key = handler.create_rate_limit_keys(
+        key="model_per_project_itpm",
+        value="proj-io-only:bedrock_mantle/claude-opus",
+        rate_limit_type="tokens",
+    )
+    otpm_counter_key = handler.create_rate_limit_keys(
+        key="model_per_project_otpm",
+        value="proj-io-only:bedrock_mantle/claude-opus",
+        rate_limit_type="tokens",
+    )
+    assert (
+        int(await cache.async_get_cache(key=itpm_counter_key, local_only=True) or 0) > 0
+    )
+    assert (
+        int(await cache.async_get_cache(key=otpm_counter_key, local_only=True) or 0) > 0
+    )
+
+    await handler.async_post_call_failure_hook(
+        request_data=data,
+        original_exception=Exception("guardrail rejected"),
+        user_api_key_dict=user_api_key_dict,
+    )
+
+    itpm_after = int(
+        await cache.async_get_cache(key=itpm_counter_key, local_only=True) or 0
+    )
+    otpm_after = int(
+        await cache.async_get_cache(key=otpm_counter_key, local_only=True) or 0
+    )
+    assert itpm_after == 0, (
+        f"ITPM-only reservation leaked on proxy rejection: {itpm_after}"
+    )
+    assert otpm_after == 0, (
+        f"OTPM-only reservation leaked on proxy rejection: {otpm_after}"
+    )
+
+
+@pytest.mark.asyncio
+async def test_otpm_rejection_does_not_double_refund_combined_tpm(rate_limiter):
+    """
+    Regression for a High-severity review finding: when the project ITPM
+    reservation succeeds but OTPM is then over limit,
+    _reserve_project_io_tokens_or_raise rolls back the combined-TPM
+    reservation that already succeeded earlier in the same pre-call, then
+    raises. If it doesn't also mark that reservation released,
+    async_post_call_failure_hook -- which fires next in the real request
+    lifecycle, since raising from async_pre_call_hook triggers it -- sees
+    the same still-stashed reservation and refunds it a second time,
+    driving the combined TPM counter negative and letting a caller push
+    past the project's real TPM budget by repeatedly triggering OTPM
+    rejections.
+    """
+    handler, cache = rate_limiter
+
+    api_key = hash_token("sk-double-refund")
+    user_api_key_dict = UserAPIKeyAuth(
+        api_key=api_key,
+        project_id="proj-double-refund",
+        project_metadata={
+            "model_tpm_limit": {"bedrock_mantle/claude-opus": 100000},
+            "model_itpm_limit": {"bedrock_mantle/claude-opus": 100000},
+            "model_otpm_limit": {"bedrock_mantle/claude-opus": 5},
+        },
+    )
+
+    data = {
+        "model": "bedrock_mantle/claude-opus",
+        "messages": [
+            {"role": "user", "content": "hello there, this is a test message"}
+        ],
+        "max_tokens": 60,  # blows past the 5-token OTPM limit
+    }
+
+    tpm_counter_key = handler.create_rate_limit_keys(
+        key="model_per_project",
+        value="proj-double-refund:bedrock_mantle/claude-opus",
+        rate_limit_type="tokens",
+    )
+
+    with pytest.raises(Exception) as exc_info:
+        await handler.async_pre_call_hook(
+            user_api_key_dict=user_api_key_dict,
+            cache=cache,
+            data=data,
+            call_type="",
+        )
+    assert getattr(exc_info.value, "status_code", None) == 429
+
+    tpm_after_pre_call = int(
+        await cache.async_get_cache(key=tpm_counter_key, local_only=True) or 0
+    )
+    assert tpm_after_pre_call == 0, (
+        f"combined TPM reservation not rolled back: {tpm_after_pre_call}"
+    )
+
+    # In the real request lifecycle, async_post_call_failure_hook fires next
+    # for a pre-call rejection. It must not refund the same reservation again.
+    await handler.async_post_call_failure_hook(
+        request_data=data,
+        original_exception=exc_info.value,
+        user_api_key_dict=user_api_key_dict,
+    )
+
+    tpm_after_failure_hook = int(
+        await cache.async_get_cache(key=tpm_counter_key, local_only=True) or 0
+    )
+    assert tpm_after_failure_hook == 0, (
+        f"combined TPM counter went negative from a double refund: {tpm_after_failure_hook}"
+    )
+
+
+@pytest.mark.parametrize(
+    "embedding_input",
+    [
+        list(range(51)),
+        [list(range(25)), list(range(26))],
+    ],
+)
+@pytest.mark.asyncio
+async def test_project_itpm_rejects_pretokenized_embedding_input(
+    rate_limiter,
+    embedding_input,
+):
+    handler, cache = rate_limiter
+    user_api_key_dict = UserAPIKeyAuth(
+        api_key=hash_token("sk-pretokenized-embedding-itpm"),
+        project_id="proj-pretokenized-embedding",
+        project_metadata={
+            "model_itpm_limit": {"text-embedding-3-small": 50},
+        },
+    )
+    data = {
+        "model": "text-embedding-3-small",
+        "input": embedding_input,
+    }
+
+    with pytest.raises(Exception) as exc_info:
+        await handler.async_pre_call_hook(
+            user_api_key_dict=user_api_key_dict,
+            cache=cache,
+            data=data,
+            call_type="aembedding",
+        )
+
+    assert getattr(exc_info.value, "status_code", None) == 429
+
+
+@pytest.mark.asyncio
+async def test_responses_api_not_misclassified_as_embedding_for_output_estimate(
+    rate_limiter,
+):
+    """
+    Regression for a High-severity review finding: the Responses API also
+    puts its prompt in data["input"], the same field embeddings use, so the
+    output-token estimate treated every Responses call as an embedding and
+    reserved zero output tokens. call_type now disambiguates the two: the
+    same input-only payload gets zero output tokens for an embedding call
+    but a real floor for a Responses API call.
+    """
+    handler, _cache = rate_limiter
+
+    data = {"input": "describe this image in detail"}
+
+    _, embedding_output_estimate = handler._estimate_input_and_output_tokens(
+        data=data, call_type="aembedding"
+    )
+    assert embedding_output_estimate == 0
+
+    _, responses_output_estimate = handler._estimate_input_and_output_tokens(
+        data=data, call_type="aresponses"
+    )
+    assert responses_output_estimate > 0, (
+        "Responses API call was misclassified as an embedding and reserved zero output tokens"
+    )
+
+
+@pytest.mark.parametrize(
+    ("data", "call_type", "expected_output_tokens"),
+    [
+        (
+            {
+                "messages": [{"role": "user", "content": "hello"}],
+                "max_tokens": 100,
+                "n": 10,
+            },
+            "acompletion",
+            1000,
+        ),
+        (
+            {
+                "prompt": "hello",
+                "max_tokens": 100,
+                "n": 2,
+                "best_of": 5,
+            },
+            "text_completion",
+            500,
+        ),
+        (
+            {
+                "messages": [{"role": "user", "content": "hello"}],
+                "max_tokens": 100,
+                "n": 0,
+                "best_of": "invalid",
+            },
+            "acompletion",
+            100,
+        ),
+    ],
+)
+def test_output_estimate_accounts_for_completion_candidates(
+    rate_limiter,
+    data,
+    call_type,
+    expected_output_tokens,
+):
+    handler, _cache = rate_limiter
+
+    _, estimated_output_tokens = handler._estimate_input_and_output_tokens(
+        data=data,
+        call_type=call_type,
+    )
+
+    assert estimated_output_tokens == expected_output_tokens
+
+
+@pytest.mark.asyncio
+async def test_responses_api_usage_reconciles_using_input_output_tokens_fields(
+    rate_limiter,
+):
+    """
+    Regression for the other half of the same finding: ResponseAPIUsage
+    exposes input_tokens/output_tokens, not prompt_tokens/completion_tokens.
+    Before this fix, _resolve_io_token_reconcile_usage couldn't resolve
+    Responses API usage at all, so the reservation was silently kept as-is
+    instead of being trued up to the much larger actual usage.
+    """
+    handler, _cache = rate_limiter
+
+    itpm_scope = ("model_per_project_itpm", "proj-responses:model")
+    otpm_scope = ("model_per_project_otpm", "proj-responses:model")
+
+    stash = get_or_create_request_stash()
+    stash.itpm_reserved_tokens = 10
+    stash.itpm_reserved_scopes = frozenset({itpm_scope})
+    stash.otpm_reserved_tokens = 10
+    stash.otpm_reserved_scopes = frozenset({otpm_scope})
+    mock_kwargs = {}
+
+    mock_response = ResponsesAPIResponse(
+        id="resp_test",
+        created_at=int(datetime.now().timestamp()),
+        output=[],
+        usage=ResponseAPIUsage(input_tokens=80, output_tokens=400, total_tokens=480),
+    )
+
+    increments = []
+
+    async def mock_increment(increment_list, **kwargs):
+        for op in increment_list:
+            increments.append({"key": op["key"], "increment": op["increment_value"]})
+
+    handler.internal_usage_cache.dual_cache.async_increment_cache_pipeline = (
+        mock_increment
+    )
+
+    await handler.async_log_success_event(
+        kwargs=mock_kwargs,
+        response_obj=mock_response,
+        start_time=datetime.now(),
+        end_time=datetime.now(),
+    )
+
+    itpm_adjustments = [i for i in increments if "model_per_project_itpm" in i["key"]]
+    otpm_adjustments = [i for i in increments if "model_per_project_otpm" in i["key"]]
+
+    # delta = 80 actual input - 10 reserved = +70
+    assert any(i["increment"] == 70 for i in itpm_adjustments), (
+        f"ITPM reservation was never trued up to actual Responses API usage: {itpm_adjustments}"
+    )
+    # delta = 400 actual output - 10 reserved = +390
+    assert any(i["increment"] == 390 for i in otpm_adjustments), (
+        f"OTPM reservation was never trued up to actual Responses API usage: {otpm_adjustments}"
+    )
+
+
+@pytest.mark.asyncio
+async def test_itpm_reservation_accounts_for_audio_content_not_just_text(rate_limiter):
+    """
+    Regression for the audio half of a Medium-severity review finding:
+    litellm.token_counter has no per-type handling for `input_audio`
+    content blocks (unlike images, which it does count via
+    use_default_image_token_count), so it silently contributes 0 tokens for
+    them. Without DEFAULT_AUDIO_TOKEN_ESTIMATE, a burst of audio-heavy
+    requests with minimal text would each reserve only the one-token floor
+    and blow past the project ITPM limit before post-call reconciliation.
+    """
+    handler, cache = rate_limiter
+
+    api_key = hash_token("sk-audio-itpm")
+    user_api_key_dict = UserAPIKeyAuth(
+        api_key=api_key,
+        project_id="proj-audio",
+        project_metadata={
+            # Tighter than DEFAULT_AUDIO_TOKEN_ESTIMATE (300), but far bigger
+            # than the handful of tokens the bare text "hi" would cost.
+            "model_itpm_limit": {"bedrock_mantle/claude-opus": 50},
+        },
+    )
+
+    data = {
+        "model": "bedrock_mantle/claude-opus",
+        "messages": [
+            {
+                "role": "user",
+                "content": [
+                    {"type": "text", "text": "hi"},
+                    {
+                        "type": "input_audio",
+                        "input_audio": {"data": "base64-audio-bytes", "format": "wav"},
+                    },
+                ],
+            }
+        ],
+    }
+
+    with pytest.raises(Exception) as exc_info:
+        await handler.async_pre_call_hook(
+            user_api_key_dict=user_api_key_dict,
+            cache=cache,
+            data=data,
+            call_type="",
+        )
+    assert getattr(exc_info.value, "status_code", None) == 429, (
+        "Expected the audio content to push the ITPM reservation over the "
+        "50-token limit; if this doesn't raise, audio content isn't being "
+        "counted again."
+    )
+
+
+def test_audio_token_estimate_scales_with_payload_size():
+    """
+    Regression for veria-ai Low finding: audio token reservation was flat
+    300 per block regardless of duration. A short clip and a long clip both
+    reserved the same amount, letting a caller hide long audio in one block
+    to exhaust ITPM quota while reserving almost nothing.
+
+    The estimate must now grow proportionally with the base64 payload size
+    (len(b64) * 3 // 4 // _AUDIO_BYTES_PER_TOKEN), floored at
+    DEFAULT_AUDIO_TOKEN_ESTIMATE so reference-only blocks and genuinely
+    short clips still get a non-trivial reservation.
+
+    To exceed the floor the decoded payload must be > 300 * 1600 = 480 000
+    bytes. We synthesise a fake b64-length string of 650 000 chars
+    (decoded ≈ 487 500 bytes → 304 tokens) to avoid actually allocating
+    and encoding ~480 kB of audio in every test run.
+    """
+    large_b64 = "A" * 650_000
+    very_large_b64 = "A" * 12_900_000
+    small_b64 = "A" * 1_000
+
+    large_block = {
+        "type": "input_audio",
+        "input_audio": {"data": large_b64, "format": "wav"},
+    }
+    small_block = {
+        "type": "input_audio",
+        "input_audio": {"data": small_b64, "format": "wav"},
+    }
+    very_large_block = {
+        "type": "input_audio",
+        "input_audio": {"data": very_large_b64, "format": "wav"},
+    }
+    no_data_block = {"type": "input_audio", "input_audio": {"format": "wav"}}
+
+    large_estimate = RateLimitHandler._estimate_audio_block_tokens(large_block)
+    very_large_estimate = RateLimitHandler._estimate_audio_block_tokens(
+        very_large_block
+    )
+    small_estimate = RateLimitHandler._estimate_audio_block_tokens(small_block)
+    no_data_estimate = RateLimitHandler._estimate_audio_block_tokens(no_data_block)
+
+    assert large_estimate > small_estimate, (
+        f"Large payload ({large_estimate}) must reserve more than small payload "
+        f"({small_estimate}); flat-rate bug is back"
+    )
+    assert very_large_estimate == len(very_large_b64) * 3 // 4 // _AUDIO_BYTES_PER_TOKEN
+    assert very_large_estimate > 6_000
+    assert no_data_estimate >= 300, (
+        f"Reference-only block (no data) must use the DEFAULT_AUDIO_TOKEN_ESTIMATE floor; got {no_data_estimate}"
+    )
+    assert small_estimate >= 300, (
+        f"Small payload must be floored at DEFAULT_AUDIO_TOKEN_ESTIMATE=300; got {small_estimate}"
+    )
+
+
+@pytest.mark.asyncio
+async def test_itpm_rejects_large_audio_payload_that_would_pass_flat_estimate(
+    rate_limiter,
+):
+    """
+    Regression: a caller placing a long audio clip in one block previously
+    reserved only 300 tokens (the flat estimate). With the size-proportional
+    estimate, the same clip now reserves proportionally more and must trip
+    the ITPM limit when the limit is tuned to exactly expose the difference.
+
+    1 100 000 b64 chars → decoded ≈ 825 000 bytes → 825 000 // 1600 ≈ 515
+    tokens > the 400-token limit. The flat estimate (300) would have passed.
+    """
+    handler, cache = rate_limiter
+
+    large_b64 = "A" * 1_100_000
+
+    user_api_key_dict = UserAPIKeyAuth(
+        api_key=hash_token("sk-large-audio"),
+        project_id="proj-large-audio",
+        project_metadata={
+            "model_itpm_limit": {"bedrock_mantle/claude-opus": 400},
+        },
+    )
+
+    data = {
+        "model": "bedrock_mantle/claude-opus",
+        "messages": [
+            {
+                "role": "user",
+                "content": [
+                    {"type": "text", "text": "transcribe this"},
+                    {
+                        "type": "input_audio",
+                        "input_audio": {"data": large_b64, "format": "wav"},
+                    },
+                ],
+            }
+        ],
+    }
+
+    with pytest.raises(Exception) as exc_info:
+        await handler.async_pre_call_hook(
+            user_api_key_dict=user_api_key_dict,
+            cache=cache,
+            data=data,
+            call_type="",
+        )
+    assert getattr(exc_info.value, "status_code", None) == 429, (
+        "Large audio payload must exceed the 400-token ITPM limit under the "
+        "size-proportional estimate; the old flat-rate estimate (300 tokens) "
+        "would have passed this limit silently"
+    )
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize(
+    ("call_type", "request_data"),
+    [
+        (
+            "acompletion",
+            {
+                "messages": [
+                    {
+                        "role": "user",
+                        "content": [
+                            {"type": "text", "text": "describe this"},
+                            {
+                                "type": "image_url",
+                                "image_url": {
+                                    "url": "https://example.com/high-resolution.png",
+                                    "detail": "high",
+                                },
+                            },
+                        ],
+                    }
+                ]
+            },
+        ),
+        (
+            "acompletion",
+            {
+                "messages": [
+                    {
+                        "role": "user",
+                        "content": [
+                            {"type": "text", "text": "summarize this"},
+                            {
+                                "type": "file",
+                                "file": {
+                                    "filename": "document.pdf",
+                                    "file_data": "data:application/pdf;base64,dGVzdA==",
+                                },
+                            },
+                        ],
+                    }
+                ]
+            },
+        ),
+        (
+            "aresponses",
+            {
+                "input": [
+                    {
+                        "role": "user",
+                        "content": [
+                            {"type": "input_text", "text": "describe this"},
+                            {
+                                "type": "input_image",
+                                "image_url": "https://example.com/high-resolution.png",
+                                "detail": "high",
+                            },
+                        ],
+                    }
+                ]
+            },
+        ),
+        (
+            "aresponses",
+            {"input": "continue", "previous_response_id": "resp-123"},
+        ),
+    ],
+)
+async def test_multimodal_requests_reserve_measured_project_itpm_not_full_limit(
+    rate_limiter,
+    call_type,
+    request_data,
+):
+    """
+    Regression: image, file, and previous_response_id requests used to
+    reserve the project's whole ITPM limit up front. Because the atomic
+    check is ``current + increment > limit``, that made every such request
+    429 as soon as the window carried any usage at all and, while in
+    flight, blocked every other request for the same project + model. They
+    now reserve the token_counter estimate like everything else, so two
+    multimodal requests fit in the same window.
+    """
+    handler, cache = rate_limiter
+    model = "bedrock_mantle/claude-opus"
+    project_itpm_limit = 10_000
+    user_api_key_dict = UserAPIKeyAuth(
+        api_key=hash_token("sk-multimodal-measured"),
+        project_id="project-multimodal-measured",
+        project_metadata={"model_itpm_limit": {model: project_itpm_limit}},
+    )
+
+    await handler.async_pre_call_hook(
+        user_api_key_dict=user_api_key_dict,
+        cache=cache,
+        data={"model": model, **request_data},
+        call_type=call_type,
+    )
+    first_stash = get_request_stash()
+    assert first_stash is not None
+    first_reservation = first_stash.itpm_reserved_tokens
+    assert 0 < first_reservation < project_itpm_limit // 2
+
+    _request_stash.set(None)
+    await handler.async_pre_call_hook(
+        user_api_key_dict=user_api_key_dict,
+        cache=cache,
+        data={"model": model, **request_data},
+        call_type=call_type,
+    )
+    second_stash = get_request_stash()
+    assert second_stash is not None
+    assert second_stash is not first_stash
+    assert second_stash.itpm_reserved_tokens == first_reservation
+
+
+@pytest.mark.asyncio
+async def test_itpm_otpm_reservation_is_kept_on_stream_disconnect(rate_limiter):
+    handler, cache = rate_limiter
+
+    api_key = hash_token("sk-disconnect-test")
+    user_api_key_dict = UserAPIKeyAuth(
+        api_key=api_key,
+        project_id="proj-disconnect",
+        project_metadata={
+            "model_itpm_limit": {"bedrock_mantle/claude-opus": 1000},
+            "model_otpm_limit": {"bedrock_mantle/claude-opus": 500},
+        },
+    )
+
+    data: Dict[str, Any] = {
+        "model": "bedrock_mantle/claude-opus",
+        "messages": [{"role": "user", "content": "hello"}],
+        "max_tokens": 50,
+    }
+
+    await handler.async_pre_call_hook(
+        user_api_key_dict=user_api_key_dict,
+        cache=cache,
+        data=data,
+        call_type="",
+    )
+
+    stash = get_request_stash()
+    assert stash is not None
+    assert stash.itpm_reserved_tokens > 0, (
+        "pre-call hook must stash an ITPM reservation"
+    )
+    assert stash.otpm_reserved_tokens > 0, (
+        "pre-call hook must stash an OTPM reservation"
+    )
+
+    increment_calls: list[dict] = []
+
+    async def mock_increment(increment_list, litellm_parent_otel_span=None):
+        for op in increment_list:
+            increment_calls.append(
+                {"key": op["key"], "increment": op["increment_value"]}
+            )
+
+    handler.internal_usage_cache.dual_cache.async_increment_cache_pipeline = (
+        mock_increment
+    )
+
+    await handler.async_release_max_parallel_requests_on_disconnect(
+        user_api_key_dict=user_api_key_dict
+    )
+
+    itpm_refunds = [
+        c
+        for c in increment_calls
+        if "model_per_project_itpm" in c["key"] and c["increment"] < 0
+    ]
+    otpm_refunds = [
+        c
+        for c in increment_calls
+        if "model_per_project_otpm" in c["key"] and c["increment"] < 0
+    ]
+
+    assert not itpm_refunds
+    assert not otpm_refunds
+    assert stash.reservation_released is False
+
+
+@pytest.mark.asyncio
+async def test_responses_api_otpm_output_cap_applied_not_skipped_as_embedding(
+    rate_limiter,
+):
+    """
+    Regression for a Greptile P1 finding: _reserve_project_io_tokens_or_raise
+    classified any request with data["input"] set as an embedding (no output
+    tokens), which also misclassifies the Responses API -- it puts its prompt
+    in "input" too, but does generate output. That skipped the output cap
+    applied whenever the configured OTPM limit is small enough to need it,
+    letting an unbounded Responses generation blow past OTPM before
+    post-call reconciliation catches up.
+
+    The cap must land on data["max_output_tokens"], not data["max_tokens"]:
+    the Responses-to-chat-completion transformation only reads
+    max_output_tokens, so a max_tokens cap is silently dropped before
+    provider dispatch (a second Greptile finding on the same code path).
+    """
+    handler, cache = rate_limiter
+
+    api_key = hash_token("sk-responses-otpm-cap")
+    user_api_key_dict = UserAPIKeyAuth(
+        api_key=api_key,
+        project_id="proj-responses-otpm",
+        project_metadata={
+            "model_otpm_limit": {"bedrock_mantle/claude-opus": 40},
+        },
+    )
+
+    data: Dict[str, Any] = {
+        "model": "bedrock_mantle/claude-opus",
+        "input": "describe this image in detail",
+    }
+
+    await handler.async_pre_call_hook(
+        user_api_key_dict=user_api_key_dict,
+        cache=cache,
+        data=data,
+        call_type="aresponses",
+    )
+
+    assert data.get("max_output_tokens") is not None, (
+        "Responses call was misclassified as an embedding and skipped the OTPM output cap"
+    )
+    assert data["max_output_tokens"] == 16
+    assert data.get("max_tokens") is None, (
+        "OTPM output cap was written to max_tokens, which the Responses transformation ignores"
+    )
+
+
+@pytest.mark.asyncio
+async def test_explicit_zero_output_responses_call_reserves_effective_provider_minimum(
+    rate_limiter,
+):
+    handler, cache = rate_limiter
+
+    user_api_key_dict = UserAPIKeyAuth(
+        api_key=hash_token("sk-responses-zero-output"),
+        project_id="proj-responses-zero-output",
+        project_metadata={
+            "model_otpm_limit": {"bedrock_mantle/claude-opus": 5},
+        },
+    )
+
+    with pytest.raises(Exception) as exc_info:
+        await handler.async_pre_call_hook(
+            user_api_key_dict=user_api_key_dict,
+            cache=cache,
+            data={
+                "model": "bedrock_mantle/claude-opus",
+                "input": "describe this image in detail",
+                "max_output_tokens": 0,
+            },
+            call_type="aresponses",
+        )
+
+    assert getattr(exc_info.value, "status_code", None) == 429
+
+
+@pytest.mark.asyncio
+async def test_responses_api_combined_tpm_output_cap_applied_not_skipped_as_embedding(
+    rate_limiter,
+):
+    """
+    Regression for the same misclassification bug in the combined-TPM
+    output-cap block of async_pre_call_hook (a second, independent
+    `is_embedding = data.get("input") is not None` check). A project with
+    only a combined model_tpm_limit (no split itpm/otpm) configured small
+    enough to need the output cap must still apply it to a Responses call,
+    and must write it to max_output_tokens for the same reason as the OTPM
+    case above.
+    """
+    handler, cache = rate_limiter
+
+    api_key = hash_token("sk-responses-tpm-cap")
+    user_api_key_dict = UserAPIKeyAuth(
+        api_key=api_key,
+        project_id="proj-responses-tpm",
+        project_metadata={
+            "model_tpm_limit": {"bedrock_mantle/claude-opus": 40},
+        },
+    )
+
+    data: Dict[str, Any] = {
+        "model": "bedrock_mantle/claude-opus",
+        "input": "describe this image in detail",
+    }
+
+    await handler.async_pre_call_hook(
+        user_api_key_dict=user_api_key_dict,
+        cache=cache,
+        data=data,
+        call_type="aresponses",
+    )
+
+    assert data.get("max_output_tokens") is not None, (
+        "Responses call was misclassified as an embedding and skipped the combined-TPM output cap"
+    )
+    assert data["max_output_tokens"] == 16
+    assert data.get("max_tokens") is None, (
+        "combined-TPM output cap was written to max_tokens, which the Responses transformation ignores"
+    )
+
+
+@pytest.mark.asyncio
+async def test_responses_api_multimodal_input_counts_image_content(rate_limiter):
+    """
+    Regression for a Low-severity veria-ai finding: the Responses API's
+    `input` is commonly a list of message/content-block dicts, but
+    litellm.token_counter's `text` argument only joins plain string entries
+    in a list and silently drops everything else -- so an `input_image`
+    block contributed ~0 tokens to the ITPM estimate instead of the real
+    image token count. _estimate_precise_input_tokens now converts Responses
+    `input` to chat messages first (via the standard
+    transform_responses_api_input_to_messages helper) so image content is
+    counted the same way a chat completion's image content already is.
+    """
+    handler, _cache = rate_limiter
+
+    text_only_estimate = handler._estimate_precise_input_tokens(
+        data={"input": "hi"},
+        model="bedrock_mantle/claude-opus",
+        call_type="aresponses",
+    )
+
+    multimodal_estimate = handler._estimate_precise_input_tokens(
+        data={
+            "input": [
+                {
+                    "role": "user",
+                    "content": [
+                        {"type": "input_text", "text": "hi"},
+                        {
+                            "type": "input_image",
+                            "image_url": "https://example.com/some-image.png",
+                        },
+                    ],
+                }
+            ],
+        },
+        model="bedrock_mantle/claude-opus",
+        call_type="aresponses",
+    )
+
+    assert multimodal_estimate > text_only_estimate + 100, (
+        "Responses API input_image content block was not counted; got "
+        f"text_only={text_only_estimate}, multimodal={multimodal_estimate}"
+    )
+
+
+@pytest.mark.asyncio
+async def test_refund_reserved_tokens_noop_when_amount_zero(rate_limiter):
+    """_refund_reserved_tokens returns immediately without calling Redis when amount=0."""
+    handler, _cache = rate_limiter
+
+    calls = []
+
+    async def mock_increment(pipeline_operations, **kwargs):
+        calls.extend(pipeline_operations)
+
+    handler.async_increment_tokens_with_ttl_preservation = mock_increment
+
+    await handler._refund_reserved_tokens(
+        scopes=[("api_key", "sk-test")],
+        amount=0,
+    )
+
+    assert not calls, "No Redis ops expected when amount is zero"
+
+
+@pytest.mark.asyncio
+async def test_reserve_io_tokens_noop_when_no_itpm_otpm_descriptors(rate_limiter):
+    """reserve_io_tokens returns OK immediately when no ITPM/OTPM descriptors present."""
+    handler, _cache = rate_limiter
+
+    non_io_descriptor = {
+        "key": "api_key",
+        "value": "sk-test",
+        "rate_limit": {"tokens_per_unit": 1000, "window_size": 60},
+    }
+    response, itpm_reserved, otpm_reserved = await handler.reserve_io_tokens(
+        descriptors=[non_io_descriptor],
+        estimated_input_tokens=50,
+        estimated_output_tokens=50,
+    )
+
+    assert response["overall_code"] == "OK"
+    assert itpm_reserved == 0
+    assert otpm_reserved == 0
+
+
+@pytest.mark.asyncio
+async def test_reserve_io_tokens_itpm_only_no_otpm(rate_limiter):
+    """When only ITPM descriptors are present (no OTPM), returns itpm_reserved with otpm=0."""
+    handler, cache = rate_limiter
+
+    itpm_descriptor = {
+        "key": PROJECT_ITPM_DESCRIPTOR_KEY,
+        "value": "proj-a:model",
+        "rate_limit": {"tokens_per_unit": 10000, "window_size": 60},
+    }
+    response, itpm_reserved, otpm_reserved = await handler.reserve_io_tokens(
+        descriptors=[itpm_descriptor],
+        estimated_input_tokens=100,
+        estimated_output_tokens=50,
+    )
+
+    assert response["overall_code"] == "OK"
+    assert itpm_reserved == 100
+    assert otpm_reserved == 0
+
+
+def test_strip_audio_content_blocks_passthrough_non_list_messages():
+    """Non-list input is returned unchanged (early return on line 2605)."""
+    result = RateLimitHandler._strip_audio_content_blocks("not a list")
+    assert result == "not a list"
+
+
+def test_strip_audio_content_blocks_passthrough_non_dict_message():
+    """Non-dict entries in the message list are appended unchanged."""
+    messages = ["plain string message"]
+    result = RateLimitHandler._strip_audio_content_blocks(messages)
+    assert result == ["plain string message"]
+
+
+def test_strip_audio_content_blocks_passthrough_non_list_content():
+    """Messages with non-list content (e.g. plain string) pass through unchanged."""
+    messages = [{"role": "user", "content": "hello"}]
+    result = RateLimitHandler._strip_audio_content_blocks(messages)
+    assert result == [{"role": "user", "content": "hello"}]
+
+
+@pytest.mark.asyncio
+async def test_otpm_rejection_releases_stashed_parallel_slot(rate_limiter):
+    """
+    When OTPM is over limit and a parallel slot was already acquired, the
+    disconnect cleanup path in _reserve_project_io_tokens_or_raise must
+    release that slot. Exercises lines 2773-2777.
+    """
+    handler, cache = rate_limiter
+
+    user_api_key_dict = UserAPIKeyAuth(
+        api_key=hash_token("sk-otpm-slot"),
+        project_id="proj-slot",
+        project_metadata={"model_otpm_limit": {"m": 5}},
+    )
+
+    data: Dict[str, Any] = {
+        "model": "m",
+        "messages": [{"role": "user", "content": "hello"}],
+        "max_tokens": 50,
+    }
+
+    slot_released = []
+
+    async def mock_release(acquisition, parent_otel_span=None):
+        slot_released.append(acquisition)
+
+    handler._release_parallel_request_slots = mock_release
+
+    stash = get_or_create_request_stash()
+    stash.parallel_slot = {
+        "slot_id": "test-slot-id",
+        "counter_keys": ["some-key"],
+    }
+
+    otpm_descriptor = {
+        "key": PROJECT_OTPM_DESCRIPTOR_KEY,
+        "value": "proj-slot:m",
+        "rate_limit": {"tokens_per_unit": 5, "window_size": 60},
+    }
+
+    with pytest.raises(Exception) as exc_info:
+        await handler._reserve_project_io_tokens_or_raise(
+            descriptors=[otpm_descriptor],
+            data=data,
+            requested_model="m",
+            user_api_key_dict=user_api_key_dict,
+            tpm_reservation_scopes=[],
+            tpm_reservation_amount=0,
+        )
+    assert getattr(exc_info.value, "status_code", None) == 429
+    assert slot_released, "Parallel slot must be released when OTPM rejects"
+    assert stash.parallel_slot is None
+
+
+@pytest.mark.asyncio
+async def test_itpm_only_status_stored_when_no_prior_rate_limit_response(rate_limiter):
+    """
+    When only ITPM is configured (no combined TPM/RPM to pre-populate
+    the request stash), a successful ITPM reservation must store its status
+    there so post-call headers can read it.
+    """
+    handler, cache = rate_limiter
+
+    user_api_key_dict = UserAPIKeyAuth(
+        api_key=hash_token("sk-itpm-only-store"),
+        project_id="proj-store",
+    )
+
+    data: Dict[str, Any] = {"model": "m", "messages": []}
+
+    itpm_descriptor = {
+        "key": PROJECT_ITPM_DESCRIPTOR_KEY,
+        "value": "proj-store:m",
+        "rate_limit": {"tokens_per_unit": 100000, "window_size": 60},
+    }
+
+    await handler._reserve_project_io_tokens_or_raise(
+        descriptors=[itpm_descriptor],
+        data=data,
+        requested_model="m",
+        user_api_key_dict=user_api_key_dict,
+        tpm_reservation_scopes=[],
+        tpm_reservation_amount=0,
+    )
+
+    stash = get_request_stash()
+    assert stash is not None
+    stored = stash.rate_limit_response
+    assert stored is not None, (
+        "ITPM status must be stored in litellm_proxy_rate_limit_response"
+    )
+    assert stored.get("statuses"), "Stored response must contain statuses"
+
+
+def test_resolve_io_token_usage_responses_api_with_cached_tokens(rate_limiter):
+    """
+    ResponsesAPIResponse whose usage.input_tokens_details.cached_tokens is set
+    subtracts the cached portion from billable input. Covers line 3501.
+    """
+    handler, _cache = rate_limiter
+
+    response_obj = ResponsesAPIResponse(
+        id="resp_cached",
+        created_at=int(datetime.now().timestamp()),
+        output=[],
+        usage=ResponseAPIUsage(
+            input_tokens=100,
+            output_tokens=50,
+            total_tokens=150,
+            input_tokens_details=InputTokensDetails(cached_tokens=25),
+        ),
+    )
+    billable_input, completion_tokens, resolved = (
+        handler._resolve_io_token_reconcile_usage(response_obj)
+    )
+
+    assert resolved is True
+    assert billable_input == 75, f"Expected 100 - 25 cached = 75, got {billable_input}"
+    assert completion_tokens == 50
+
+
+def test_resolve_io_token_usage_dict_format(rate_limiter):
+    """
+    Dict-shaped usage on a ModelResponse (older SDK versions or raw dicts in
+    the usage field) is parsed correctly. Covers lines 3502-3506.
+    """
+    handler, _cache = rate_limiter
+
+    response_obj = ModelResponse.model_construct(
+        usage={
+            "prompt_tokens": 80,
+            "completion_tokens": 40,
+            "prompt_tokens_details": {"cached_tokens": 20},
+        }
+    )
+    billable_input, completion_tokens, resolved = (
+        handler._resolve_io_token_reconcile_usage(response_obj)
+    )
+
+    assert resolved is True
+    assert billable_input == 60, f"Expected 80 - 20 cached = 60, got {billable_input}"
+    assert completion_tokens == 40
+
+
+def test_resolve_io_token_usage_unknown_type_returns_unresolved(rate_limiter):
+    """
+    A ModelResponse whose usage attribute is not a Usage, ResponseAPIUsage,
+    or dict (e.g. a plain int) returns (0, 0, False) so the reservation is
+    kept rather than guessed. Covers lines 3507-3508.
+    """
+    handler, _cache = rate_limiter
+
+    response_obj = ModelResponse.model_construct(usage=42)
+    billable_input, completion_tokens, resolved = (
+        handler._resolve_io_token_reconcile_usage(response_obj)
+    )
+
+    assert resolved is False
+    assert billable_input == 0
+    assert completion_tokens == 0
+
+
+@pytest.mark.parametrize(
+    ("combined_usage", "expected_increments"),
+    [
+        (None, ()),
+        (
+            Usage(prompt_tokens=40, completion_tokens=15, total_tokens=55),
+            (-60, -45),
+        ),
+    ],
+)
+def test_zero_usage_keeps_reservations_unless_measured_fallback_exists(
+    rate_limiter,
+    combined_usage,
+    expected_increments,
+):
+    handler, _cache = rate_limiter
+    itpm_scope = (PROJECT_ITPM_DESCRIPTOR_KEY, "project:model")
+    otpm_scope = (PROJECT_OTPM_DESCRIPTOR_KEY, "project:model")
+    stash = get_or_create_request_stash()
+    stash.itpm_reserved_tokens = 100
+    stash.itpm_reserved_scopes = frozenset({itpm_scope})
+    stash.otpm_reserved_tokens = 60
+    stash.otpm_reserved_scopes = frozenset({otpm_scope})
+    kwargs = {} if combined_usage is None else {"combined_usage_object": combined_usage}
+    response_obj = ModelResponse(
+        usage=Usage(prompt_tokens=0, completion_tokens=0, total_tokens=0)
+    )
+
+    operations = handler._build_io_token_reservation_ops(kwargs, response_obj)
+
+    assert tuple(operation["increment_value"] for operation in operations) == expected_increments
+
+
+@pytest.mark.parametrize(
+    ("usage", "expected_increments"),
+    [
+        (
+            Usage(prompt_tokens=40, completion_tokens=15, total_tokens=55),
+            (40, 15),
+        ),
+        (
+            Usage(prompt_tokens=0, completion_tokens=0, total_tokens=0),
+            (100, 60),
+        ),
+    ],
+)
+def test_retry_success_charges_released_project_io_reservations(
+    rate_limiter,
+    usage,
+    expected_increments,
+):
+    handler, _cache = rate_limiter
+    itpm_scope = (PROJECT_ITPM_DESCRIPTOR_KEY, "project:model")
+    otpm_scope = (PROJECT_OTPM_DESCRIPTOR_KEY, "project:model")
+    stash = get_or_create_request_stash()
+    stash.itpm_reserved_tokens = 100
+    stash.itpm_reserved_scopes = frozenset({itpm_scope})
+    stash.otpm_reserved_tokens = 60
+    stash.otpm_reserved_scopes = frozenset({otpm_scope})
+    stash.reservation_released = True
+
+    operations = handler._build_io_token_reservation_ops(
+        {},
+        ModelResponse(usage=usage),
+    )
+
+    assert tuple(operation["increment_value"] for operation in operations) == expected_increments
+
+
+@pytest.mark.asyncio
+async def test_build_io_token_reservation_ops_skips_unresolvable_usage(rate_limiter):
+    """
+    When response_obj has no parseable usage, _build_io_token_reservation_ops
+    returns [] to keep the reservation as-is rather than zeroing it out on a
+    bad guess. Covers line 3538.
+    """
+    handler, _cache = rate_limiter
+
+    itpm_scope = ("model_per_project_itpm", "proj-b:model")
+    stash = get_or_create_request_stash()
+    stash.itpm_reserved_tokens = 50
+    stash.itpm_reserved_scopes = frozenset({itpm_scope})
+    mock_kwargs = {}
+
+    ops = handler._build_io_token_reservation_ops(
+        kwargs=mock_kwargs,
+        response_obj=object(),
+    )
+
+    assert not ops, f"Expected empty ops for unresolvable usage, got {ops}"
+
+
+@pytest.mark.asyncio
+async def test_post_call_failure_skips_rpm_only_descriptor_in_tpm_refund(rate_limiter):
+    """
+    async_post_call_failure_hook skips descriptors without tokens_per_unit
+    (e.g. an RPM-only api_key scope) when building the combined-TPM refund ops,
+    so a key with rpm_limit but no tpm_limit doesn't receive a spurious refund
+    that would drive its counter negative. Covers the continue guard at line 4250.
+    """
+    handler, cache = rate_limiter
+
+    api_key = hash_token("sk-rpm-only-desc")
+    user_api_key_dict = UserAPIKeyAuth(
+        api_key=api_key,
+        rpm_limit=100,
+        project_id="proj-rpm-only-desc",
+        project_metadata={"model_tpm_limit": {"gpt-3.5-turbo": 100000}},
+    )
+
+    data = {
+        "model": "gpt-3.5-turbo",
+        "messages": [{"role": "user", "content": "hello"}],
+        "max_tokens": 20,
+    }
+
+    await handler.async_pre_call_hook(
+        user_api_key_dict=user_api_key_dict,
+        cache=cache,
+        data=data,
+        call_type="",
+    )
+
+    rpm_tokens_key = handler.create_rate_limit_keys(
+        key="api_key", value=api_key, rate_limit_type="tokens"
+    )
+
+    await handler.async_post_call_failure_hook(
+        request_data=data,
+        original_exception=Exception("rejected"),
+        user_api_key_dict=user_api_key_dict,
+    )
+
+    api_key_tokens_after = int(
+        await cache.async_get_cache(key=rpm_tokens_key, local_only=True) or 0
+    )
+    assert api_key_tokens_after >= 0, (
+        f"RPM-only api_key scope must not receive a negative TPM refund; got {api_key_tokens_after}"
+    )
+
+
+@pytest.mark.asyncio
+async def test_max_output_tokens_prevents_cap_injection(rate_limiter):
+    """
+    Regression for veria-ai comment: when a Responses API request supplies
+    max_output_tokens (the canonical Responses output bound) but not max_tokens
+    or max_completion_tokens, the has_explicit_max_tokens check was False, so
+    the code injected data["max_tokens"] = capped_floor and silently truncated
+    the response.
+
+    With the fix, max_output_tokens is included in the explicit-cap check and
+    data["max_tokens"] must NOT be injected when max_output_tokens is already
+    set.
+    """
+    handler, cache = rate_limiter
+
+    user_api_key_dict = UserAPIKeyAuth(
+        api_key=hash_token("sk-max-output-tokens"),
+        project_id="proj-responses-max-output",
+        project_metadata={
+            "model_otpm_limit": {"mock-model": 100},
+        },
+    )
+
+    data: dict = {
+        "model": "mock-model",
+        "input": "Summarise the document",
+        "max_output_tokens": 80,
+        "litellm_call_id": "test-max-output-tokens",
+        "metadata": {},
+    }
+
+    try:
+        await handler.async_pre_call_hook(
+            user_api_key_dict=user_api_key_dict,
+            cache=cache,
+            data=data,
+            call_type="responses",
+        )
+    except Exception:
+        pass
+
+    assert "max_tokens" not in data, (
+        "data['max_tokens'] must not be injected when max_output_tokens is already "
+        "set; the cap injection was overriding the caller's explicit output bound"
+    )
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize(
+    ("call_type", "request_data", "cap_field", "reserved_tokens"),
+    [
+        ("aresponses", {"input": "hello", "max_tokens": 1}, "max_output_tokens", 16),
+        (
+            "acompletion",
+            {
+                "messages": [{"role": "user", "content": "hello"}],
+                "max_output_tokens": 1,
+            },
+            "max_tokens",
+            10,
+        ),
+    ],
+)
+async def test_output_reservation_ignores_cap_fields_from_other_endpoints(
+    rate_limiter,
+    call_type,
+    request_data,
+    cap_field,
+    reserved_tokens,
+):
+    handler, cache = rate_limiter
+    user_api_key_dict = UserAPIKeyAuth(
+        api_key=hash_token(f"sk-{call_type}"),
+        project_id=f"project-{call_type}",
+        project_metadata={"model_otpm_limit": {"model": 40}},
+    )
+    data = {"model": "model", **request_data}
+
+    await handler.async_pre_call_hook(
+        user_api_key_dict=user_api_key_dict,
+        cache=cache,
+        data=data,
+        call_type=call_type,
+    )
+
+    assert data[cap_field] == reserved_tokens
+    stash = get_request_stash()
+    assert stash is not None
+    assert stash.otpm_reserved_tokens == reserved_tokens
+
+
+def test_responses_input_is_counted_even_when_messages_is_present(rate_limiter):
+    handler, _cache = rate_limiter
+    small_estimate = handler._estimate_precise_input_tokens(
+        data={"input": "short", "messages": [{"role": "user", "content": "ignored"}]},
+        model="",
+        call_type="aresponses",
+    )
+    large_estimate = handler._estimate_precise_input_tokens(
+        data={"input": "large input " * 500, "messages": []},
+        model="",
+        call_type="aresponses",
+    )
+
+    assert large_estimate > small_estimate
+
+
+def test_anthropic_messages_usage_reconciles_split_project_quota(rate_limiter):
+    handler, _cache = rate_limiter
+
+    billable_input, output_tokens, resolved = handler._resolve_io_token_reconcile_usage(
+        {
+            "usage": {
+                "input_tokens": 100,
+                "output_tokens": 25,
+                "cache_read_input_tokens": 30,
+            }
+        }
+    )
+
+    assert resolved is True
+    assert billable_input == 70
+    assert output_tokens == 25
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize(
+    "call_type",
+    ["agenerate_content", "agenerate_content_stream"],
+)
+async def test_google_genai_native_contents_reserve_project_itpm(
+    rate_limiter,
+    call_type,
+):
+    handler, cache = rate_limiter
+    model = "gemini/gemini-2.5-flash"
+    user_api_key_dict = UserAPIKeyAuth(
+        api_key=hash_token("sk-google-genai-native-itpm"),
+        project_id="project-google-genai-native-itpm",
+        project_metadata={"model_itpm_limit": {model: 10_000}},
+    )
+
+    await handler.async_pre_call_hook(
+        user_api_key_dict=user_api_key_dict,
+        cache=cache,
+        data={
+            "model": model,
+            "contents": [
+                {
+                    "role": "user",
+                    "parts": [{"text": "Gemini quota input " * 200}],
+                }
+            ],
+        },
+        call_type=call_type,
+    )
+
+    stash = get_request_stash()
+    assert stash is not None
+    assert stash.itpm_reserved_tokens > 100
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("call_type", ["rerank", "arerank"])
+async def test_rerank_query_and_documents_enforce_project_itpm(
+    rate_limiter,
+    monkeypatch,
+    call_type,
+):
+    handler, cache = rate_limiter
+    captured = {}
+
+    def token_counter(**kwargs):
+        captured.update(kwargs)
+        return 101
+
+    monkeypatch.setattr("litellm.token_counter", token_counter)
+    user_api_key_dict = UserAPIKeyAuth(
+        api_key=hash_token(f"sk-{call_type}-itpm"),
+        project_id=f"project-{call_type}-itpm",
+        project_metadata={"model_itpm_limit": {"rerank-model": 100}},
+    )
+
+    with pytest.raises(Exception) as exc_info:
+        await handler.async_pre_call_hook(
+            user_api_key_dict=user_api_key_dict,
+            cache=cache,
+            data={
+                "model": "rerank-model",
+                "query": "Which document is most relevant?",
+                "documents": ["first document", {"text": "second document"}],
+            },
+            call_type=call_type,
+        )
+
+    assert getattr(exc_info.value, "status_code", None) == 429
+    assert captured["text"] == (
+        "Which document is most relevant?\n"
+        "first document\n"
+        "{'text': 'second document'}"
+    )
+
+
+def test_rerank_input_estimate_falls_back_to_character_count(
+    rate_limiter,
+    monkeypatch,
+):
+    handler, _cache = rate_limiter
+    data = {
+        "query": "query text",
+        "documents": ["first document", "second document"],
+    }
+
+    def token_counter(**_kwargs):
+        raise ValueError("tokenizer unavailable")
+
+    monkeypatch.setattr("litellm.token_counter", token_counter)
+    rerank_text = handler._rerank_input_to_text(data)
+
+    assert handler._estimate_precise_input_tokens(
+        data,
+        model="custom-rerank-model",
+        call_type="rerank",
+    ) == len(rerank_text) // 4
+
+
+@pytest.mark.parametrize(
+    ("response_obj", "expected"),
+    [
+        (
+            RerankResponse(
+                meta={"tokens": {"input_tokens": 42, "output_tokens": 3}}
+            ),
+            (42, 3, True),
+        ),
+        (
+            RerankResponse(
+                meta={
+                    "tokens": {"input_tokens": 0, "output_tokens": 0},
+                    "billed_units": {"total_tokens": 57},
+                }
+            ),
+            (57, 0, True),
+        ),
+        (
+            RerankResponse(
+                meta={
+                    "tokens": {"input_tokens": 0, "output_tokens": 0},
+                    "billed_units": {"total_tokens": 0},
+                }
+            ),
+            (0, 0, False),
+        ),
+    ],
+)
+def test_rerank_usage_reconciles_project_split_token_quota(
+    rate_limiter,
+    response_obj,
+    expected,
+):
+    handler, _cache = rate_limiter
+
+    assert handler._resolve_io_token_reconcile_usage(response_obj) == expected
+
+
+def test_split_quota_helpers_handle_non_mapping_inputs(rate_limiter):
+    handler, _cache = rate_limiter
+
+    assert _call_id_from_callback_kwargs(object()) is None
+    assert handler._is_embedding_request(object(), None) is False
+    assert handler._get_explicit_output_cap(object(), None) is None
+    assert handler.get_output_candidate_count(object()) == 1
+    assert handler.get_output_candidate_count({"n": 1e309}) == 1
+    assert (
+        handler._get_explicit_output_cap({"max_output_tokens": []}, "responses") is None
+    )
+    assert handler._apply_implicit_output_cap(object(), 100, "responses") is None
+    assert handler._estimate_input_and_output_tokens(object()) == (0, 0)
+    assert handler._build_io_token_reservation_ops(object(), object()) == ()
+
+
+@pytest.mark.parametrize(
+    ("data", "call_type", "expected"),
+    [
+        ({"max_tokens": "30.0"}, "", 30),
+        ({"max_tokens": "not-a-number"}, "", None),
+        ({"max_tokens": True}, "", None),
+        ({"max_output_tokens": "30.0"}, "responses", 30),
+        ({"max_output_tokens": "nan"}, "responses", None),
+        ({"generationConfig": {"maxOutputTokens": "12.5"}}, "agenerate_content", 12),
+        ({"generationConfig": {"maxOutputTokens": "oops"}}, "agenerate_content", None),
+    ],
+)
+def test_get_explicit_output_cap_tolerates_unparseable_values(
+    rate_limiter, data, call_type, expected
+):
+    """A client-supplied cap the proxy cannot parse must fall back to the
+    no-cap output estimate instead of raising ValueError and 500ing the
+    request before it ever reaches the provider."""
+    handler, _cache = rate_limiter
+
+    assert handler._get_explicit_output_cap(data, call_type) == expected
+
+
+@pytest.mark.asyncio
+async def test_project_io_counters_not_double_charged_when_reservation_disabled(
+    monkeypatch,
+):
+    """With LITELLM_TPM_TOKEN_RESERVATION_ENABLED=false the first
+    should_rate_limit pass used to +1 every ITPM/OTPM counter on top of the
+    full reservation _reserve_project_io_tokens_or_raise always makes,
+    permanently inflating each bucket by one token per request."""
+    monkeypatch.setenv("LITELLM_TPM_TOKEN_RESERVATION_ENABLED", "false")
+    cache = DualCache()
+    handler = RateLimitHandler(internal_usage_cache=InternalUsageCache(cache))
+    assert handler.tpm_reservation_enabled is False
+
+    user_api_key_dict = UserAPIKeyAuth(
+        api_key=hash_token("sk-io-no-reservation"),
+        project_id="proj-io-no-reservation",
+        project_metadata={
+            "model_itpm_limit": {"bedrock_mantle/claude-opus": 1000000},
+            "model_otpm_limit": {"bedrock_mantle/claude-opus": 1000000},
+        },
+    )
+    data = {
+        "model": "bedrock_mantle/claude-opus",
+        "messages": [{"role": "user", "content": "hello"}],
+        "max_tokens": 50,
+    }
+
+    await handler.async_pre_call_hook(
+        user_api_key_dict=user_api_key_dict,
+        cache=cache,
+        data=data,
+        call_type="",
+    )
+
+    stash = get_request_stash()
+    assert stash is not None
+    assert stash.itpm_reserved_tokens > 0
+    assert stash.otpm_reserved_tokens > 0
+
+    for descriptor_key, reserved in (
+        ("model_per_project_itpm", stash.itpm_reserved_tokens),
+        ("model_per_project_otpm", stash.otpm_reserved_tokens),
+    ):
+        counter_key = handler.create_rate_limit_keys(
+            key=descriptor_key,
+            value="proj-io-no-reservation:bedrock_mantle/claude-opus",
+            rate_limit_type="tokens",
+        )
+        cached = await cache.async_get_cache(key=counter_key, local_only=True)
+        assert int(cached or 0) == reserved, (
+            f"{descriptor_key} counter {cached} != reserved {reserved}: "
+            "first-pass should_rate_limit double-charged the bucket"
+        )
+
+
+@pytest.mark.parametrize(
+    ("call_type", "data"),
+    [
+        (
+            "text_completion",
+            {
+                "messages": [{"role": "user", "content": "ignored"}],
+                "prompt": "abcd",
+                "input": "ignored",
+                "max_tokens": 1,
+            },
+        ),
+        (None, {"prompt": "abcd", "max_tokens": 1}),
+        (None, {"prompt": ["abcd", "efgh"], "max_tokens": 1}),
+    ],
+)
+def test_split_token_estimate_selects_endpoint_input(rate_limiter, call_type, data):
+    handler, _cache = rate_limiter
+
+    estimated_input, estimated_output = handler._estimate_input_and_output_tokens(
+        data=data,
+        call_type=call_type,
+    )
+
+    assert estimated_input > 0
+    assert estimated_output == 1
+
+
+def test_split_quota_multimodal_guards_handle_non_mapping_inputs(rate_limiter):
+    handler, _cache = rate_limiter
+
+    assert handler._estimate_audio_block_tokens(
+        object()
+    ) == handler._estimate_audio_block_tokens({})
+    assert handler._responses_input_to_chat_messages(object()) == ()
+    assert handler._estimate_precise_input_tokens(object(), model=None) == 0
+
+
+@pytest.mark.parametrize(
+    ("call_type", "data", "expected_text"),
+    [
+        ("embedding", {"input": "embedding input"}, "embedding input"),
+        (
+            "embedding",
+            {"input": ["first embedding", "second embedding"]},
+            ["first embedding", "second embedding"],
+        ),
+        ("text_completion", {"prompt": "completion prompt"}, "completion prompt"),
+    ],
+)
+def test_precise_input_estimate_selects_endpoint_text(
+    rate_limiter,
+    monkeypatch,
+    call_type,
+    data,
+    expected_text,
+):
+    handler, _cache = rate_limiter
+    captured = {}
+
+    def token_counter(**kwargs):
+        captured.update(kwargs)
+        return 7
+
+    monkeypatch.setattr("litellm.token_counter", token_counter)
+
+    assert (
+        handler._estimate_precise_input_tokens(data, model="test", call_type=call_type)
+        == 7
+    )
+    assert captured["messages"] is None
+    assert captured["text"] == expected_text
+
+
+@pytest.mark.asyncio
+async def test_project_io_reservation_ignores_non_mapping_request_data(rate_limiter):
+    handler, _cache = rate_limiter
+
+    await handler._reserve_project_io_tokens_or_raise(
+        descriptors=[],
+        data=object(),
+        requested_model=None,
+        user_api_key_dict=UserAPIKeyAuth(),
+        tpm_reservation_scopes=(),
+        tpm_reservation_amount=0,
+    )
+
+
+@pytest.mark.asyncio
+async def test_streaming_combined_usage_reconciles_project_io_reservations(
+    rate_limiter,
+):
+    handler, _cache = rate_limiter
+    itpm_scope = (PROJECT_ITPM_DESCRIPTOR_KEY, "project:model")
+    otpm_scope = (PROJECT_OTPM_DESCRIPTOR_KEY, "project:model")
+    stash = get_or_create_request_stash()
+    stash.itpm_reserved_tokens = 100
+    stash.itpm_reserved_scopes = frozenset({itpm_scope})
+    stash.otpm_reserved_tokens = 60
+    stash.otpm_reserved_scopes = frozenset({otpm_scope})
+    kwargs = {
+        "combined_usage_object": Usage(
+            prompt_tokens=40,
+            completion_tokens=15,
+            total_tokens=55,
+        ),
+    }
+    increments = []
+
+    async def capture_increments(increment_list, **_kwargs):
+        increments.extend(increment_list)
+
+    handler.internal_usage_cache.dual_cache.async_increment_cache_pipeline = (
+        capture_increments
+    )
+
+    await handler.async_log_success_event(
+        kwargs=kwargs,
+        response_obj={"response": "stream body"},
+        start_time=datetime.now(),
+        end_time=datetime.now(),
+    )
+
+    itpm_adjustments = [
+        operation
+        for operation in increments
+        if PROJECT_ITPM_DESCRIPTOR_KEY in operation["key"]
+    ]
+    otpm_adjustments = [
+        operation
+        for operation in increments
+        if PROJECT_OTPM_DESCRIPTOR_KEY in operation["key"]
+    ]
+    assert [operation["increment_value"] for operation in itpm_adjustments] == [-60]
+    assert [operation["increment_value"] for operation in otpm_adjustments] == [-45]
+
+
+def test_aggregate_only_combined_usage_reconciles_project_io_reservations(rate_limiter):
+    handler, _cache = rate_limiter
+    stash = get_or_create_request_stash()
+    stash.itpm_reserved_tokens = 100
+    stash.itpm_reserved_scopes = frozenset(
+        {(PROJECT_ITPM_DESCRIPTOR_KEY, "project:model")}
+    )
+    stash.otpm_reserved_tokens = 80
+    stash.otpm_reserved_scopes = frozenset(
+        {(PROJECT_OTPM_DESCRIPTOR_KEY, "project:model")}
+    )
+    kwargs = {
+        "combined_usage_object": Usage(total_tokens=55),
+    }
+
+    operations = handler._build_io_token_reservation_ops(kwargs, object())
+
+    assert [operation["increment_value"] for operation in operations] == [-45, -25]
+
+
+def test_raw_split_usage_dict_reconciles_project_io_tokens(rate_limiter):
+    handler, _cache = rate_limiter
+
+    assert handler._resolve_io_token_reconcile_usage(
+        {
+            "input_tokens": 30,
+            "output_tokens": 12,
+            "input_tokens_details": {"cached_tokens": 5},
+        }
+    ) == (25, 12, True)
+
+
+@pytest.mark.asyncio
+async def test_post_call_success_hook_contains_header_merge_failures(
+    rate_limiter, monkeypatch
+):
+    handler, _cache = rate_limiter
+    response = ModelResponse()
+    response._hidden_params = {}
+
+    def raise_on_merge(**_kwargs):
+        raise RuntimeError("header merge failed")
+
+    monkeypatch.setattr(
+        handler,
+        "_merge_ratelimit_statuses_into_additional_headers",
+        raise_on_merge,
+    )
+
+    await handler.async_post_call_success_hook(
+        data={
+            "litellm_proxy_rate_limit_response": {
+                "overall_code": "OK",
+                "statuses": (),
+            }
+        },
+        user_api_key_dict=UserAPIKeyAuth(),
+        response=response,
+    )
+
+
 if __name__ == "__main__":
     pytest.main([__file__, "-v", "-s"])
diff --git a/tests/test_litellm/proxy/management_endpoints/test_access_group_management.py b/tests/test_litellm/proxy/management_endpoints/test_access_group_management.py
index 3240ad20edb..c973c6a8346 100644
--- a/tests/test_litellm/proxy/management_endpoints/test_access_group_management.py
+++ b/tests/test_litellm/proxy/management_endpoints/test_access_group_management.py
@@ -13,6 +13,9 @@ sys.path.insert(
 )  # Adds the parent directory to the system path
 
 from litellm import Router
+from litellm.proxy.management_endpoints.model_management_endpoints import (
+    ReconcileOutcome,
+)
 
 
 @pytest.mark.asyncio
@@ -121,7 +124,7 @@ async def test_create_access_group_with_model_ids_tags_only_specific_deployments
         patch("litellm.proxy.proxy_server.prisma_client", mock_prisma),
         patch(
             "litellm.proxy.management_endpoints.model_access_group_management_endpoints.clear_cache",
-            new_callable=AsyncMock,
+            new=AsyncMock(return_value=ReconcileOutcome(still_desired=None, live_after=None)),
         ),
     ):
         response = await create_model_group(
@@ -186,7 +189,7 @@ async def test_create_access_group_with_model_names_tags_all_deployments():
         patch("litellm.proxy.proxy_server.prisma_client", mock_prisma),
         patch(
             "litellm.proxy.management_endpoints.model_access_group_management_endpoints.clear_cache",
-            new_callable=AsyncMock,
+            new=AsyncMock(return_value=ReconcileOutcome(still_desired=None, live_after=None)),
         ),
     ):
         response = await create_model_group(
@@ -236,7 +239,7 @@ async def test_create_access_group_model_ids_takes_priority_over_model_names():
         patch("litellm.proxy.proxy_server.prisma_client", mock_prisma),
         patch(
             "litellm.proxy.management_endpoints.model_access_group_management_endpoints.clear_cache",
-            new_callable=AsyncMock,
+            new=AsyncMock(return_value=ReconcileOutcome(still_desired=None, live_after=None)),
         ),
     ):
         response = await create_model_group(
@@ -313,7 +316,7 @@ async def test_create_access_group_invalid_model_id_returns_400():
         patch("litellm.proxy.proxy_server.prisma_client", mock_prisma),
         patch(
             "litellm.proxy.management_endpoints.model_access_group_management_endpoints.clear_cache",
-            new_callable=AsyncMock,
+            new=AsyncMock(return_value=ReconcileOutcome(still_desired=None, live_after=None)),
         ),
     ):
         with pytest.raises(HTTPException) as exc_info:
@@ -352,7 +355,7 @@ async def test_create_access_group_surfaces_dropped_models():
         patch("litellm.proxy.proxy_server.prisma_client", mock_prisma),
         patch(
             "litellm.proxy.management_endpoints.model_access_group_management_endpoints.clear_cache",
-            new=AsyncMock(return_value=None),
+            new=AsyncMock(return_value=ReconcileOutcome(still_desired=None, live_after=None)),
         ),
     ):
         with pytest.raises(HTTPException) as exc_info:
@@ -365,6 +368,50 @@ async def test_create_access_group_surfaces_dropped_models():
     assert "deploy-A" in str(exc_info.value.detail)
 
 
+
+@pytest.mark.asyncio
+async def test_create_access_group_trusts_reload_snapshot_over_post_lock_fresh_read():
+    """A concurrent reconcile sampled after the lock is released must not make this
+    write's reload look like it dropped the tagged model: the verdict has to judge from
+    the ReconcileOutcome the reload captured under the lock, not a fresh router read."""
+    from litellm.proxy._types import LitellmUserRoles, UserAPIKeyAuth
+    from litellm.proxy.management_endpoints.model_access_group_management_endpoints import (
+        create_model_group,
+    )
+    from litellm.types.proxy.management_endpoints.model_management_endpoints import (
+        NewModelGroupRequest,
+    )
+
+    deploy_a = MagicMock(model_id="deploy-A", model_name="gpt-4o", model_info={})
+
+    mock_prisma = MagicMock()
+    mock_prisma.db.litellm_proxymodeltable.find_many = AsyncMock(return_value=[])
+    mock_prisma.db.litellm_proxymodeltable.find_unique = AsyncMock(return_value=deploy_a)
+    mock_prisma.db.litellm_proxymodeltable.update = AsyncMock()
+
+    concurrently_wiped_router = MagicMock()
+    concurrently_wiped_router.get_model_ids.side_effect = [["deploy-A"], []]
+    with (
+        patch("litellm.proxy.proxy_server.llm_router", concurrently_wiped_router),
+        patch("litellm.proxy.proxy_server.prisma_client", mock_prisma),
+        patch(
+            "litellm.proxy.management_endpoints.model_access_group_management_endpoints.clear_cache",
+            new=AsyncMock(
+                return_value=ReconcileOutcome(
+                    still_desired=frozenset({"deploy-A"}), live_after=frozenset({"deploy-A"})
+                )
+            ),
+        ),
+    ):
+        response = await create_model_group(
+            data=NewModelGroupRequest(access_group="production-models", model_ids=["deploy-A"]),
+            user_api_key_dict=UserAPIKeyAuth(user_id="test_admin", user_role=LitellmUserRoles.PROXY_ADMIN),
+        )
+
+    assert response.models_updated == 1
+    assert concurrently_wiped_router.get_model_ids.call_count == 1
+
+
 @pytest.mark.asyncio
 async def test_tag_deployment_parses_string_model_info_and_refuses_corrupt():
     """The model_info column can arrive as its JSON string; tagging must parse it rather
@@ -420,7 +467,7 @@ async def test_delete_access_group_ignores_models_that_were_already_dead():
         patch("litellm.proxy.proxy_server.prisma_client", mock_prisma),
         patch(
             "litellm.proxy.management_endpoints.model_access_group_management_endpoints.clear_cache",
-            new=AsyncMock(return_value=None),
+            new=AsyncMock(return_value=ReconcileOutcome(still_desired=None, live_after=None)),
         ),
     ):
         response = await delete_access_group(
@@ -430,3 +477,99 @@ async def test_delete_access_group_ignores_models_that_were_already_dead():
 
     assert response.models_updated == 1
     mock_prisma.db.litellm_proxymodeltable.update.assert_awaited_once()
+
+
+@pytest.mark.asyncio
+async def test_create_access_group_read_through_recovers_model_created_on_sibling_replica():
+    """Regression: an access group referencing a model that another replica just wrote
+    to the DB must be created instead of 400ing until the periodic config reload."""
+    from litellm.proxy._types import LitellmUserRoles, UserAPIKeyAuth
+    from litellm.proxy.management_endpoints.model_access_group_management_endpoints import (
+        create_model_group,
+    )
+    from litellm.types.proxy.management_endpoints.model_management_endpoints import (
+        NewModelGroupRequest,
+    )
+
+    from types import SimpleNamespace
+
+    model_name = "e2e-ag-sibling-replica-model"
+    db_row = SimpleNamespace(
+        model_id=f"{model_name}-id",
+        model_name=model_name,
+        litellm_params={"model": "openai/gpt-4o", "api_key": "fake", "mock_response": "hi"},
+        model_info={},
+        blocked=False,
+    )
+
+    mock_router = Router(
+        model_list=[
+            {
+                "model_name": "some-other-model",
+                "litellm_params": {"model": "openai/gpt-4o", "api_key": "fake"},
+            }
+        ]
+    )
+
+    mock_prisma = MagicMock()
+    mock_prisma.db.litellm_proxymodeltable.find_many = AsyncMock(side_effect=[[db_row], [], [db_row]])
+    mock_prisma.db.litellm_proxymodeltable.update = AsyncMock()
+
+    with (
+        patch("litellm.proxy.proxy_server.llm_router", mock_router),
+        patch("litellm.proxy.proxy_server.prisma_client", mock_prisma),
+        patch("litellm.proxy.proxy_server.store_model_in_db", True),
+        patch(
+            "litellm.proxy.management_endpoints.model_access_group_management_endpoints.clear_cache",
+            new=AsyncMock(return_value=ReconcileOutcome(still_desired=None, live_after=None)),
+        ),
+    ):
+        response = await create_model_group(
+            data=NewModelGroupRequest(access_group="replica-lag-group", model_names=[model_name]),
+            user_api_key_dict=UserAPIKeyAuth(user_id="admin", user_role=LitellmUserRoles.PROXY_ADMIN),
+        )
+
+    assert response.models_updated == 1
+    assert response.model_names == [model_name]
+    assert mock_prisma.db.litellm_proxymodeltable.find_many.await_args_list[0].kwargs["where"] == {
+        "model_name": model_name
+    }
+
+
+@pytest.mark.asyncio
+async def test_create_access_group_model_missing_everywhere_still_400s():
+    from fastapi import HTTPException
+
+    from litellm.proxy._types import LitellmUserRoles, UserAPIKeyAuth
+    from litellm.proxy.management_endpoints.model_access_group_management_endpoints import (
+        create_model_group,
+    )
+    from litellm.types.proxy.management_endpoints.model_management_endpoints import (
+        NewModelGroupRequest,
+    )
+
+    model_name = "e2e-ag-model-nobody-created"
+    mock_router = Router(
+        model_list=[
+            {
+                "model_name": "some-other-model",
+                "litellm_params": {"model": "openai/gpt-4o", "api_key": "fake"},
+            }
+        ]
+    )
+    mock_prisma = MagicMock()
+    mock_prisma.db.litellm_proxymodeltable.find_many = AsyncMock(return_value=[])
+
+    with (
+        patch("litellm.proxy.proxy_server.llm_router", mock_router),
+        patch("litellm.proxy.proxy_server.prisma_client", mock_prisma),
+        patch("litellm.proxy.proxy_server.store_model_in_db", True),
+    ):
+        with pytest.raises(HTTPException) as exc_info:
+            await create_model_group(
+                data=NewModelGroupRequest(access_group="ghost-group", model_names=[model_name]),
+                user_api_key_dict=UserAPIKeyAuth(user_id="admin", user_role=LitellmUserRoles.PROXY_ADMIN),
+            )
+
+    assert exc_info.value.status_code == 400
+    assert model_name in str(exc_info.value.detail)
diff --git a/tests/test_litellm/proxy/management_endpoints/test_common_daily_activity.py b/tests/test_litellm/proxy/management_endpoints/test_common_daily_activity.py
index 412e6f0f83c..62c05841197 100644
--- a/tests/test_litellm/proxy/management_endpoints/test_common_daily_activity.py
+++ b/tests/test_litellm/proxy/management_endpoints/test_common_daily_activity.py
@@ -14,6 +14,7 @@ sys.path.insert(0, os.path.abspath("../../../.."))  # Adds the parent directory
 from litellm.proxy.management_endpoints.common_daily_activity import (
     _adjust_dates_for_timezone,
     _build_aggregated_sql_query,
+    _build_entity_rollup_sql_query,
     _is_user_agent_tag,
     _record_to_spend_metrics,
     get_api_key_metadata,
@@ -982,6 +983,58 @@ class TestBuildAggregatedSqlQuery:
         assert "COALESCE(model_group, model)" not in normalized
 
 
+class TestAggregatedEmptyEntityFilter:
+    _BUILDERS: Final = (_build_aggregated_sql_query, _build_entity_rollup_sql_query)
+
+    @pytest.mark.parametrize("build", _BUILDERS)
+    def test_empty_entity_list_emits_no_degenerate_in_clause(self, build):
+        sql, params = build(
+            table_name="litellm_dailyteamspend",
+            entity_id_field="team_id",
+            entity_id=[],
+            start_date="2026-08-01",
+            end_date="2026-08-19",
+            model=None,
+            api_key=None,
+        )
+
+        normalized = " ".join(sql.split())
+        assert "IN ()" not in normalized
+        assert '"team_id" IN' not in normalized
+        assert params == ["2026-08-01", "2026-08-19"]
+
+    @pytest.mark.parametrize("build", _BUILDERS)
+    def test_empty_entity_list_matches_nothing_rather_than_everything(self, build):
+        sql, _ = build(
+            table_name="litellm_dailyteamspend",
+            entity_id_field="team_id",
+            entity_id=[],
+            start_date="2026-08-01",
+            end_date="2026-08-19",
+            model=None,
+            api_key=None,
+        )
+
+        assert "FALSE" in " ".join(sql.split())
+
+    @pytest.mark.parametrize("build", _BUILDERS)
+    def test_populated_entity_list_still_filters_on_its_ids(self, build):
+        sql, params = build(
+            table_name="litellm_dailyteamspend",
+            entity_id_field="team_id",
+            entity_id=["team-alpha", "team-beta"],
+            start_date="2026-08-01",
+            end_date="2026-08-19",
+            model=None,
+            api_key=None,
+        )
+
+        normalized = " ".join(sql.split())
+        assert '"team_id" IN ($3, $4)' in normalized
+        assert "FALSE" not in normalized
+        assert params == ["2026-08-01", "2026-08-19", "team-alpha", "team-beta"]
+
+
 @pytest.mark.asyncio
 async def test_get_daily_activity_aggregated_empty_result_set():
     """Regression test for the empty-range 500.
diff --git a/tests/test_litellm/proxy/pass_through_endpoints/llm_provider_handlers/test_openai_passthrough_logging_handler.py b/tests/test_litellm/proxy/pass_through_endpoints/llm_provider_handlers/test_openai_passthrough_logging_handler.py
index 664015003e4..69819318800 100644
--- a/tests/test_litellm/proxy/pass_through_endpoints/llm_provider_handlers/test_openai_passthrough_logging_handler.py
+++ b/tests/test_litellm/proxy/pass_through_endpoints/llm_provider_handlers/test_openai_passthrough_logging_handler.py
@@ -1286,6 +1286,75 @@ class TestOpenAIPassthroughIntegration:
         mock_chat_handler.assert_called_once()
         assert result == {"result": None, "kwargs": {}}
 
+    def test_openai_passthrough_handler_embeddings_unmapped_model_logs_zero_cost(self):
+        response_body = {
+            "object": "list",
+            "model": "lit5787-unmapped-embeddings-deployment",
+            "data": [{"object": "embedding", "index": 0, "embedding": [0.1, 0.2]}],
+            "usage": {"prompt_tokens": 9, "total_tokens": 9},
+        }
+        mock_logging_obj = self._create_mock_logging_obj()
+        result = OpenAIPassthroughLoggingHandler.openai_passthrough_handler(
+            httpx_response=self._create_mock_httpx_response(response_body),
+            response_body=response_body,
+            logging_obj=mock_logging_obj,
+            url_route="https://my-resource.openai.azure.com/openai/v1/embeddings",
+            result="",
+            start_time=self.start_time,
+            end_time=self.end_time,
+            cache_hit=False,
+            request_body={
+                "model": "lit5787-unmapped-embeddings-deployment",
+                "input": "spend probe",
+            },
+            passthrough_logging_payload=PassthroughStandardLoggingPayload(
+                url="https://my-resource.openai.azure.com/openai/v1/embeddings",
+                request_body={
+                    "model": "lit5787-unmapped-embeddings-deployment",
+                    "input": "spend probe",
+                },
+                request_method="POST",
+            ),
+            litellm_params={},
+        )
+
+        assert result["result"] is not None
+        assert result["result"].usage.prompt_tokens == 9
+        assert result["kwargs"]["response_cost"] == 0.0
+        assert result["kwargs"]["model"] == "lit5787-unmapped-embeddings-deployment"
+        assert result["result"]._hidden_params["response_cost"] == 0.0
+        assert mock_logging_obj.model_call_details["response_cost"] == 0.0
+
+    def test_openai_passthrough_handler_embeddings_error_skips_chat_fallback(self):
+        response_body = {
+            "object": "list",
+            "model": "text-embedding-3-small",
+            "usage": {"prompt_tokens": 9, "total_tokens": 9},
+        }
+        kwargs_in = {
+            "passthrough_logging_payload": PassthroughStandardLoggingPayload(
+                url="https://api.openai.com/v1/embeddings",
+                request_body={"model": "text-embedding-3-small", "input": "spend probe"},
+                request_method="POST",
+            ),
+            "litellm_params": {},
+        }
+        result = OpenAIPassthroughLoggingHandler.openai_passthrough_handler(
+            httpx_response=self._create_mock_httpx_response(response_body),
+            response_body=response_body,
+            logging_obj=self._create_mock_logging_obj(),
+            url_route="https://api.openai.com/v1/embeddings",
+            result="",
+            start_time=self.start_time,
+            end_time=self.end_time,
+            cache_hit=False,
+            request_body={"model": "text-embedding-3-small", "input": "spend probe"},
+            **kwargs_in,
+        )
+
+        assert result["result"] is None
+        assert result["kwargs"]["passthrough_logging_payload"] == kwargs_in["passthrough_logging_payload"]
+
     @patch(
         "litellm.proxy.pass_through_endpoints.llm_provider_handlers.openai_passthrough_logging_handler.OpenAIPassthroughLoggingHandler.openai_passthrough_handler"
     )
diff --git a/tests/test_litellm/proxy/pass_through_endpoints/test_llm_pass_through_endpoints.py b/tests/test_litellm/proxy/pass_through_endpoints/test_llm_pass_through_endpoints.py
index 050070e2fcf..b56a8da7c66 100644
--- a/tests/test_litellm/proxy/pass_through_endpoints/test_llm_pass_through_endpoints.py
+++ b/tests/test_litellm/proxy/pass_through_endpoints/test_llm_pass_through_endpoints.py
@@ -1,7 +1,10 @@
+import contextlib
 import json
 import os
 import sys
 import traceback
+from collections.abc import Mapping
+from types import MappingProxyType, SimpleNamespace
 from typing import Final
 from unittest import mock
 from unittest.mock import AsyncMock, MagicMock, Mock, patch
@@ -22,6 +25,7 @@ from litellm.proxy.pass_through_endpoints.llm_passthrough_endpoints import (
     _join_url_paths,
     azure_proxy_route,
     bedrock_llm_proxy_route,
+    bedrock_proxy_route,
     create_pass_through_route,
     cursor_proxy_route,
     get_azure_ai_search_index_from_endpoint,
@@ -1730,6 +1734,116 @@ class TestBedrockLLMProxyRoute:
         assert "Blocked by guardrail" in str(exc_info.value.detail)
 
 
+class TestBedrockAgentRuntimePassthroughToggle:
+    AGENT_RUNTIME_ENDPOINT: Final = "knowledgebases/KB1234567/retrieve"
+    MODEL_ENDPOINT: Final = "model/us.anthropic.claude-sonnet-4-5-20250929-v1:0/converse"
+    DISABLED: Final = MappingProxyType({"disable_bedrock_agent_runtime_passthrough": True})
+
+    @staticmethod
+    def _mock_request() -> Mock:
+        request: Final = Mock()
+        request.method = "POST"
+        request.state = SimpleNamespace()
+        request.json = AsyncMock(return_value={"retrievalQuery": {"text": "hi"}})  # mutable-ok: must be json.dumps-able
+        return request
+
+    @contextlib.contextmanager
+    def _patched_dispatch(self, general_settings: Mapping[str, object]):
+        from botocore.credentials import Credentials
+
+        bedrock_llm: Final = Mock()
+        bedrock_llm.get_credentials = Mock(return_value=Credentials("ak", "sk"))
+        forwarder: Final = AsyncMock(return_value="forwarded")
+
+        with (
+            patch("litellm.proxy.proxy_server.general_settings", general_settings),
+            patch("litellm.utils.get_secret", return_value="us-east-1"),
+            patch("litellm.llms.bedrock.chat.BedrockConverseLLM", return_value=bedrock_llm),
+            patch(
+                "litellm.proxy.pass_through_endpoints.llm_passthrough_endpoints.create_request_copy",
+                Mock(),
+            ),
+            patch(
+                "litellm.proxy.pass_through_endpoints.llm_passthrough_endpoints.create_pass_through_route",
+                return_value=forwarder,
+            ) as create_route,
+        ):
+            yield create_route, forwarder
+
+    @pytest.mark.asyncio
+    async def test_agent_runtime_dispatch_allowed_by_default(self):
+        with self._patched_dispatch(MappingProxyType({})) as (create_route, forwarder):
+            result: Final = await bedrock_proxy_route(
+                endpoint=self.AGENT_RUNTIME_ENDPOINT,
+                request=self._mock_request(),
+                fastapi_response=Mock(),
+                user_api_key_dict=UserAPIKeyAuth(),
+            )
+
+        assert result == "forwarded"
+        forwarder.assert_awaited_once()
+        assert "bedrock-agent-runtime.us-east-1.amazonaws.com" in create_route.call_args.kwargs["target"]
+
+    @pytest.mark.asyncio
+    @pytest.mark.parametrize("value", (True, "true", "True"))
+    async def test_agent_runtime_dispatch_rejected_when_disabled(self, value: bool | str):
+        settings: Final = MappingProxyType({"disable_bedrock_agent_runtime_passthrough": value})
+
+        with self._patched_dispatch(settings) as (create_route, forwarder):
+            with pytest.raises(HTTPException) as exc_info:
+                await bedrock_proxy_route(
+                    endpoint=self.AGENT_RUNTIME_ENDPOINT,
+                    request=self._mock_request(),
+                    fastapi_response=Mock(),
+                    user_api_key_dict=UserAPIKeyAuth(),
+                )
+
+        assert exc_info.value.status_code == 403
+        assert "bedrock-agent-runtime pass-through is disabled" in str(exc_info.value.detail)
+        create_route.assert_not_called()
+        forwarder.assert_not_awaited()
+
+    @pytest.mark.asyncio
+    async def test_model_invoke_still_routed_when_agent_runtime_disabled(self):
+        with (
+            patch("litellm.proxy.proxy_server.general_settings", self.DISABLED),
+            patch("litellm.utils.get_secret", return_value="us-east-1"),
+            patch(
+                "litellm.proxy.pass_through_endpoints.llm_passthrough_endpoints.create_request_copy",
+                Mock(),
+            ),
+            patch(
+                "litellm.proxy.pass_through_endpoints.llm_passthrough_endpoints.bedrock_llm_proxy_route",
+                new=AsyncMock(return_value="llm-route"),
+            ) as llm_route,
+        ):
+            result: Final = await bedrock_proxy_route(
+                endpoint=self.MODEL_ENDPOINT,
+                request=self._mock_request(),
+                fastapi_response=Mock(),
+                user_api_key_dict=UserAPIKeyAuth(),
+            )
+
+        assert result == "llm-route"
+        llm_route.assert_awaited_once()
+
+    @pytest.mark.asyncio
+    @pytest.mark.parametrize("value", (False, "false", None, "", "yes"))
+    async def test_agent_runtime_dispatch_allowed_for_non_true_values(self, value: object):
+        settings: Final = MappingProxyType({"disable_bedrock_agent_runtime_passthrough": value})
+
+        with self._patched_dispatch(settings) as (create_route, forwarder):
+            result: Final = await bedrock_proxy_route(
+                endpoint=self.AGENT_RUNTIME_ENDPOINT,
+                request=self._mock_request(),
+                fastapi_response=Mock(),
+                user_api_key_dict=UserAPIKeyAuth(),
+            )
+
+        assert result == "forwarded"
+        create_route.assert_called_once()
+
+
 class TestLLMPassthroughFactoryProxyRoute:
     @pytest.mark.asyncio
     async def test_llm_passthrough_factory_proxy_route_success(self):
diff --git a/tests/test_litellm/proxy/spend_tracking/test_spend_tracking_utils.py b/tests/test_litellm/proxy/spend_tracking/test_spend_tracking_utils.py
index 33d835652cd..e5add059260 100644
--- a/tests/test_litellm/proxy/spend_tracking/test_spend_tracking_utils.py
+++ b/tests/test_litellm/proxy/spend_tracking/test_spend_tracking_utils.py
@@ -124,6 +124,30 @@ def test_get_logging_payload_maps_openai_cache_write_tokens_to_cache_creation_in
     assert additional_usage_values["prompt_tokens_details"]["cache_write_tokens"] == 800
 
 
+def test_get_logging_payload_maps_nested_cache_creation_input_tokens():
+    """
+    Regression (LIT-5757): DashScope nests cache_creation_input_tokens inside
+    prompt_tokens_details; SpendLogs must record it as cache_creation_input_tokens.
+    """
+    additional_usage_values: Final = _get_additional_usage_values_for_usage(
+        litellm.Usage(
+            prompt_tokens=2059,
+            completion_tokens=31,
+            total_tokens=2090,
+            prompt_tokens_details={
+                "cached_tokens": 0,
+                "text_tokens": 2059,
+                "cache_type": "ephemeral",
+                "cache_creation_input_tokens": 2048,
+                "cache_creation": {"ephemeral_5m_input_tokens": 2048},
+            },
+        )
+    )
+
+    assert additional_usage_values["cache_creation_input_tokens"] == 2048
+    assert additional_usage_values["prompt_tokens_details"]["cache_write_tokens"] == 2048
+
+
 def test_get_logging_payload_preserves_anthropic_cache_creation_input_tokens():
     additional_usage_values = _get_additional_usage_values_for_usage(
         litellm.Usage(
diff --git a/tests/test_litellm/proxy/test_proxy_server.py b/tests/test_litellm/proxy/test_proxy_server.py
index 5545ee92e84..75aa716bb85 100644
--- a/tests/test_litellm/proxy/test_proxy_server.py
+++ b/tests/test_litellm/proxy/test_proxy_server.py
@@ -11098,3 +11098,100 @@ async def test_moderations_reraises_proxy_exception_unwrapped():
     assert exc_info.value.code == "400"
     assert exc_info.value.param == "metadata"
     mock_logging.post_call_failure_hook.assert_awaited_once()
+
+
+@pytest.mark.asyncio
+async def test_init_agents_in_db_rebuilds_registry_under_agent_reconcile_lock(monkeypatch):
+    from litellm.proxy.agent_endpoints.agent_registry import (
+        AGENT_RECONCILE_LOCK,
+        global_agent_registry,
+    )
+    from litellm.proxy.proxy_server import ProxyConfig
+
+    lock_states: list[bool] = []
+
+    async def fake_get_all_agents_from_db(prisma_client) -> list:
+        lock_states.append(AGENT_RECONCILE_LOCK.locked())
+        return []
+
+    def fake_load_agents_from_db_and_config(db_agents) -> None:
+        lock_states.append(AGENT_RECONCILE_LOCK.locked())
+
+    monkeypatch.setattr(global_agent_registry, "get_all_agents_from_db", fake_get_all_agents_from_db)
+    monkeypatch.setattr(global_agent_registry, "load_agents_from_db_and_config", fake_load_agents_from_db_and_config)
+
+    await ProxyConfig()._init_agents_in_db(prisma_client=MagicMock())
+
+    assert lock_states == [True, True]
+    assert not AGENT_RECONCILE_LOCK.locked()
+
+
+@pytest.mark.asyncio
+async def test_init_guardrails_in_db_snapshots_and_reconciles_under_guardrail_reconcile_lock(monkeypatch):
+    from litellm.proxy.guardrails.guardrail_registry import (
+        GUARDRAIL_RECONCILE_LOCK,
+        IN_MEMORY_GUARDRAIL_HANDLER,
+        GuardrailRegistry,
+    )
+    from litellm.proxy.proxy_server import ProxyConfig
+
+    lock_states: list[bool] = []
+
+    async def fake_get_all_guardrails_from_db(prisma_client) -> list:
+        lock_states.append(GUARDRAIL_RECONCILE_LOCK.locked())
+        return []
+
+    def fake_reconcile_db_guardrails(db_guardrail_ids) -> list:
+        lock_states.append(GUARDRAIL_RECONCILE_LOCK.locked())
+        return []
+
+    monkeypatch.setattr(GuardrailRegistry, "get_all_guardrails_from_db", fake_get_all_guardrails_from_db)
+    monkeypatch.setattr(IN_MEMORY_GUARDRAIL_HANDLER, "reconcile_db_guardrails", fake_reconcile_db_guardrails)
+
+    await ProxyConfig()._init_guardrails_in_db(prisma_client=MagicMock())
+
+    assert lock_states == [True, True]
+    assert not GUARDRAIL_RECONCILE_LOCK.locked()
+
+
+class TestEmbeddingsFailureHookRequestData:
+    @pytest.mark.asyncio
+    async def test_failure_hook_gets_post_setup_data_with_logging_obj(self):
+        """Request setup replaces the processor's data dict (adding the logging
+        object the failure hook needs to lift token usage from); the embeddings
+        exception handler must pass that replaced dict, not the raw request body
+        dict it was rebuilt from."""
+        from litellm.proxy._types import ProxyException
+
+        captured = {}
+        logging_obj_sentinel = MagicMock()
+
+        async def fake_process(self, **kwargs):
+            self.data = {**self.data, "litellm_logging_obj": logging_obj_sentinel}
+            captured["processor_data"] = self.data
+            raise RuntimeError("provider timeout")
+
+        with (
+            patch.object(
+                proxy_server_module,
+                "_read_request_body",
+                new=AsyncMock(return_value={"model": "my-embed", "input": "hello"}),
+            ),
+            patch.object(
+                proxy_server_module.ProxyBaseLLMRequestProcessing,
+                "base_process_llm_request",
+                new=fake_process,
+            ),
+            patch.object(proxy_server_module, "proxy_logging_obj") as mock_logging,
+        ):
+            mock_logging.post_call_failure_hook = AsyncMock(return_value=None)
+            with pytest.raises(ProxyException):
+                await proxy_server_module.embeddings(
+                    request=MagicMock(),
+                    fastapi_response=MagicMock(),
+                    user_api_key_dict=UserAPIKeyAuth(),
+                )
+
+        hook_request_data = mock_logging.post_call_failure_hook.await_args.kwargs["request_data"]
+        assert hook_request_data is captured["processor_data"]
+        assert hook_request_data["litellm_logging_obj"] is logging_obj_sentinel
diff --git a/tests/test_litellm/proxy/test_proxy_types.py b/tests/test_litellm/proxy/test_proxy_types.py
index 5354de182a0..4a93e9ac7ba 100644
--- a/tests/test_litellm/proxy/test_proxy_types.py
+++ b/tests/test_litellm/proxy/test_proxy_types.py
@@ -159,3 +159,21 @@ def test_update_key_request_requires_key_or_key_alias():
     by_alias = UpdateKeyRequest(key_alias="my-alias")
     assert by_alias.key is None
     assert by_alias.key_alias == "my-alias"
+
+
+@pytest.mark.parametrize("request_type", ["new", "update"])
+def test_project_io_token_limits_are_stored_in_metadata(request_type):
+    from litellm.proxy._types import NewProjectRequest, UpdateProjectRequest
+
+    limits = {
+        "model_itpm_limit": {"bedrock_mantle/openai.gpt-oss-120b": 20_000_000},
+        "model_otpm_limit": {"bedrock_mantle/openai.gpt-oss-120b": 4_000_000},
+    }
+    request = (
+        NewProjectRequest(team_id="team-1", **limits)
+        if request_type == "new"
+        else UpdateProjectRequest(project_id="project-1", **limits)
+    )
+
+    assert request.metadata == limits
+    assert request.model_dump(exclude_none=True)["metadata"] == limits
diff --git a/tests/test_litellm/proxy/test_proxy_utils.py b/tests/test_litellm/proxy/test_proxy_utils.py
index 1504c3c3103..d6cf0e30139 100644
--- a/tests/test_litellm/proxy/test_proxy_utils.py
+++ b/tests/test_litellm/proxy/test_proxy_utils.py
@@ -478,6 +478,307 @@ class TestPostCallFailureHookLiftsRecoveredPartialSpend:
         assert "response_cost" not in request_data
 
 
+class TestPostCallFailureHookEstimatesDispatchedInputTokens:
+    """A non-stream request that failed after dispatch (timeout, provider
+    error) consumed provider-billed input tokens but recovered no usage.
+    post_call_failure_hook must estimate the input side onto request_data so
+    the spend log's failure row records what was sent instead of zero, while
+    never charging spend for the failure (LIT-5690).
+    """
+
+    async def _run(self, request_data):
+        from unittest.mock import AsyncMock, patch
+
+        from litellm.proxy._types import UserAPIKeyAuth
+
+        proxy_logging_obj = ProxyLogging(user_api_key_cache=DualCache())
+        proxy_logging_obj.alert_types = []
+        with patch.object(proxy_logging_obj, "update_request_status", new=AsyncMock()):
+            await proxy_logging_obj.post_call_failure_hook(
+                request_data=request_data,
+                original_exception=Exception("boom"),
+                user_api_key_dict=UserAPIKeyAuth(),
+            )
+
+    def _logging_obj(self, model_call_details):
+        logging_obj = MagicMock()
+        logging_obj.model_call_details = model_call_details
+        return logging_obj
+
+    @pytest.mark.asyncio
+    async def test_dispatched_failure_estimates_input_tokens_with_zero_cost(self):
+        from datetime import datetime
+
+        from litellm.types.utils import Usage
+
+        request_data = {
+            "litellm_logging_obj": self._logging_obj(
+                {
+                    "first_api_call_start_time": datetime.now(),
+                    "model": "gpt-3.5-turbo",
+                    "messages": [{"role": "user", "content": "count these input tokens please"}],
+                    "call_type": "acompletion",
+                }
+            ),
+            "metadata": {},
+            "response_cost": 123.0,
+        }
+        await self._run(request_data)
+
+        estimated = request_data["combined_usage_object"]
+        assert isinstance(estimated, Usage)
+        assert estimated.prompt_tokens > 0
+        assert estimated.completion_tokens == 0
+        assert estimated.total_tokens == estimated.prompt_tokens
+        assert request_data["response_cost"] == 0.0
+
+    @pytest.mark.asyncio
+    async def test_failure_before_dispatch_stays_zero(self):
+        request_data = {
+            "litellm_logging_obj": self._logging_obj(
+                {
+                    "model": "gpt-3.5-turbo",
+                    "messages": [{"role": "user", "content": "never dispatched"}],
+                }
+            ),
+            "metadata": {},
+        }
+        await self._run(request_data)
+
+        assert "combined_usage_object" not in request_data
+        assert "response_cost" not in request_data
+
+    @pytest.mark.asyncio
+    async def test_proxy_only_error_never_dispatched_stays_zero(self):
+        from datetime import datetime
+
+        from litellm.constants import LITELLM_LOGGING_NO_UPSTREAM_LLM_CALL
+
+        request_data = {
+            "litellm_logging_obj": self._logging_obj(
+                {
+                    "first_api_call_start_time": datetime.now(),
+                    "model": "no-such-model",
+                    "messages": [{"role": "user", "content": "hi"}],
+                    LITELLM_LOGGING_NO_UPSTREAM_LLM_CALL: True,
+                }
+            ),
+            "metadata": {},
+        }
+        await self._run(request_data)
+
+        assert "combined_usage_object" not in request_data
+        assert "response_cost" not in request_data
+
+    @pytest.mark.asyncio
+    async def test_recovered_partial_usage_wins_over_estimate(self):
+        from datetime import datetime
+
+        from litellm.types.utils import Usage
+
+        recovered_usage = Usage(prompt_tokens=30, completion_tokens=7, total_tokens=37)
+        request_data = {
+            "litellm_logging_obj": self._logging_obj(
+                {
+                    "first_api_call_start_time": datetime.now(),
+                    "model": "gpt-3.5-turbo",
+                    "messages": [{"role": "user", "content": "mid-stream failure"}],
+                    "call_type": "acompletion",
+                    "combined_usage_object": recovered_usage,
+                    "response_cost": 3.5e-05,
+                }
+            ),
+            "metadata": {},
+        }
+        await self._run(request_data)
+
+        assert request_data["combined_usage_object"] is recovered_usage
+        assert request_data["response_cost"] == 3.5e-05
+
+    @pytest.mark.asyncio
+    async def test_dispatched_failure_with_text_completion_prompt(self):
+        from datetime import datetime
+
+        from litellm.types.utils import Usage
+
+        request_data = {
+            "litellm_logging_obj": self._logging_obj(
+                {
+                    "first_api_call_start_time": datetime.now(),
+                    "model": "gpt-3.5-turbo",
+                    "messages": "a plain text-completion prompt string",
+                    "call_type": "atext_completion",
+                }
+            ),
+            "metadata": {},
+        }
+        await self._run(request_data)
+
+        estimated = request_data["combined_usage_object"]
+        assert isinstance(estimated, Usage)
+        assert estimated.prompt_tokens > 0
+        assert estimated.completion_tokens == 0
+
+    def _dispatched_request_data(self, messages, optional_params, call_type="acompletion"):
+        from datetime import datetime
+
+        return {
+            "litellm_logging_obj": self._logging_obj(
+                {
+                    "first_api_call_start_time": datetime.now(),
+                    "model": "gpt-3.5-turbo",
+                    "messages": messages,
+                    "optional_params": optional_params,
+                    "call_type": call_type,
+                }
+            ),
+            "metadata": {},
+        }
+
+    @pytest.mark.asyncio
+    async def test_image_message_estimated_without_fetching_image(self):
+        import litellm as litellm_module
+        from litellm.types.utils import Usage
+
+        messages = [
+            {
+                "role": "user",
+                "content": [
+                    {"type": "text", "text": "describe this image"},
+                    {
+                        "type": "image_url",
+                        "image_url": {"url": "http://127.0.0.1:1/unreachable.png", "detail": "high"},
+                    },
+                ],
+            }
+        ]
+        request_data = self._dispatched_request_data(messages, {})
+        await self._run(request_data)
+
+        estimated = request_data["combined_usage_object"]
+        assert isinstance(estimated, Usage)
+        expected = litellm_module.token_counter(
+            model="gpt-3.5-turbo", messages=messages, use_default_image_token_count=True
+        )
+        assert estimated.prompt_tokens == expected
+        assert estimated.prompt_tokens > 0
+
+    @pytest.mark.asyncio
+    async def test_embedding_string_list_input_counted_in_estimate(self):
+        import litellm as litellm_module
+        from litellm.types.utils import Usage
+
+        embedding_input = ["first embedding text", "second embedding text"]
+        request_data = self._dispatched_request_data(embedding_input, {}, call_type="aembedding")
+        await self._run(request_data)
+
+        estimated = request_data["combined_usage_object"]
+        assert isinstance(estimated, Usage)
+        expected = litellm_module.token_counter(model="gpt-3.5-turbo", text="".join(embedding_input))
+        assert estimated.prompt_tokens == expected
+
+    @pytest.mark.asyncio
+    async def test_transcription_checksum_not_estimated(self):
+        request_data = self._dispatched_request_data("a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6", {}, call_type="atranscription")
+        await self._run(request_data)
+
+        assert "combined_usage_object" not in request_data
+        assert "response_cost" not in request_data
+
+    @pytest.mark.asyncio
+    async def test_anthropic_system_prompt_counted_in_estimate(self):
+        import litellm as litellm_module
+        from litellm.types.utils import Usage
+
+        system_prompt = "You are a verbose historian who narrates every fact in exhaustive detail."
+        messages = [{"role": "user", "content": "write a short essay"}]
+        request_data = self._dispatched_request_data(messages, {"system": system_prompt, "max_tokens": 100})
+        await self._run(request_data)
+
+        estimated = request_data["combined_usage_object"]
+        assert isinstance(estimated, Usage)
+        expected = litellm_module.token_counter(model="gpt-3.5-turbo", messages=messages) + litellm_module.token_counter(
+            model="gpt-3.5-turbo", text=system_prompt
+        )
+        assert estimated.prompt_tokens == expected
+
+    @pytest.mark.asyncio
+    async def test_anthropic_system_text_blocks_counted_in_estimate(self):
+        import litellm as litellm_module
+        from litellm.types.utils import Usage
+
+        system_blocks = [
+            {"type": "text", "text": "part one of the system prompt. "},
+            {"type": "text", "text": "part two of the system prompt."},
+        ]
+        messages = [{"role": "user", "content": "write a short essay"}]
+        request_data = self._dispatched_request_data(messages, {"system": system_blocks})
+        await self._run(request_data)
+
+        estimated = request_data["combined_usage_object"]
+        assert isinstance(estimated, Usage)
+        expected = litellm_module.token_counter(model="gpt-3.5-turbo", messages=messages) + litellm_module.token_counter(
+            model="gpt-3.5-turbo", text="part one of the system prompt. part two of the system prompt."
+        )
+        assert estimated.prompt_tokens == expected
+
+    @pytest.mark.asyncio
+    async def test_responses_instructions_counted_in_estimate(self):
+        import litellm as litellm_module
+        from litellm.types.utils import Usage
+
+        instructions = "Answer every question as a meticulous archivist."
+        request_data = self._dispatched_request_data("summarize the archive", {"instructions": instructions})
+        await self._run(request_data)
+
+        estimated = request_data["combined_usage_object"]
+        assert isinstance(estimated, Usage)
+        expected = litellm_module.token_counter(
+            model="gpt-3.5-turbo", text="summarize the archive"
+        ) + litellm_module.token_counter(model="gpt-3.5-turbo", text=instructions)
+        assert estimated.prompt_tokens == expected
+
+    @pytest.mark.asyncio
+    async def test_request_body_system_counted_when_optional_params_empty(self):
+        import litellm as litellm_module
+        from litellm.types.utils import Usage
+
+        system_prompt = "You are a meticulous cartographer who labels every landmark."
+        messages = [{"role": "user", "content": "draw me a map"}]
+        request_data = {
+            **self._dispatched_request_data(messages, {}, call_type="aanthropic_messages"),
+            "system": system_prompt,
+        }
+        await self._run(request_data)
+
+        estimated = request_data["combined_usage_object"]
+        assert isinstance(estimated, Usage)
+        expected = litellm_module.token_counter(model="gpt-3.5-turbo", messages=messages) + litellm_module.token_counter(
+            model="gpt-3.5-turbo", text=system_prompt
+        )
+        assert estimated.prompt_tokens == expected
+
+    @pytest.mark.asyncio
+    async def test_optional_params_system_wins_over_request_body_system(self):
+        import litellm as litellm_module
+        from litellm.types.utils import Usage
+
+        dispatched_system = "short dispatched system prompt"
+        messages = [{"role": "user", "content": "hello"}]
+        request_data = {
+            **self._dispatched_request_data(messages, {"system": dispatched_system}),
+            "system": "a much longer request body system prompt that must not be double counted here",
+        }
+        await self._run(request_data)
+
+        estimated = request_data["combined_usage_object"]
+        assert isinstance(estimated, Usage)
+        expected = litellm_module.token_counter(model="gpt-3.5-turbo", messages=messages) + litellm_module.token_counter(
+            model="gpt-3.5-turbo", text=dispatched_system
+        )
+        assert estimated.prompt_tokens == expected
+
+
 from typing import cast
 
 import litellm
diff --git a/tests/test_litellm/proxy/test_route_a2a_models.py b/tests/test_litellm/proxy/test_route_a2a_models.py
index 02e4bddcee0..0523e796543 100644
--- a/tests/test_litellm/proxy/test_route_a2a_models.py
+++ b/tests/test_litellm/proxy/test_route_a2a_models.py
@@ -50,6 +50,7 @@ async def test_route_a2a_model_bypasses_router():
     )
 
     mock_registry = Mock()
+    mock_registry.get_agent_by_id = Mock(return_value=None)
     mock_registry.get_agent_by_name = Mock(return_value=mock_agent)
 
     # Mock litellm.acompletion to verify it's called
@@ -106,3 +107,79 @@ async def test_route_non_a2a_model_raises_error_if_not_in_router():
             user_model=None,
             route_type="acompletion",
         )
+
+
+class _DbAgentRow:
+    def __init__(self, agent_id: str, agent_name: str) -> None:
+        self.agent_id = agent_id
+        self.agent_name = agent_name
+        self.object_permission = None
+        self.spend = 0.0
+
+    def model_dump(self):
+        return {
+            "agent_id": self.agent_id,
+            "agent_name": self.agent_name,
+            "agent_card_params": {"name": self.agent_name, "url": "http://sibling-db-agent.example.com"},
+            "litellm_params": {},
+            "object_permission": None,
+            "spend": self.spend,
+        }
+
+
+def _router_without_models():
+    mock_router = Mock()
+    mock_router.model_names = []
+    mock_router.deployment_names = []
+    mock_router.has_model_id = Mock(return_value=False)
+    mock_router.model_group_alias = None
+    mock_router.router_general_settings = Mock(pass_through_all_models=False)
+    mock_router.default_deployment = None
+    mock_router.pattern_router = Mock(patterns=[])
+    mock_router.map_team_model = Mock(return_value=None)
+    mock_router.is_recognized_model = Mock(return_value=False)
+    mock_router.team_public_model_names = []
+    return mock_router
+
+
+@pytest.mark.asyncio
+async def test_route_a2a_model_read_through_recovers_agent_created_on_sibling_replica(monkeypatch):
+    import litellm.proxy.proxy_server as proxy_server
+    from litellm.proxy.agent_endpoints.agent_registry import global_agent_registry
+
+    agent_name = "a2a-sibling-replica-agent"
+    prisma_client = Mock()
+    prisma_client.db.litellm_agentstable.find_unique = AsyncMock(
+        side_effect=[None, _DbAgentRow("a2a-sibling-replica-agent-id", agent_name)]
+    )
+    monkeypatch.setattr(proxy_server, "prisma_client", prisma_client)
+    monkeypatch.setattr(proxy_server, "store_model_in_db", True)
+
+    original_agents = list(global_agent_registry.agent_list)
+    original_config_agents = getattr(global_agent_registry, "config_agents", ())
+    global_agent_registry.agent_list = []
+    global_agent_registry.config_agents = ()
+
+    data = {
+        "model": f"a2a/{agent_name}",
+        "messages": [{"role": "user", "content": "Hello"}],
+    }
+    mock_acompletion = AsyncMock(return_value={"id": "read-through-response"})
+
+    try:
+        with patch("litellm.acompletion", mock_acompletion):
+            await route_request(
+                data=data,
+                llm_router=_router_without_models(),
+                user_model=None,
+                route_type="acompletion",
+            )
+    finally:
+        global_agent_registry.agent_list = original_agents
+        global_agent_registry.config_agents = original_config_agents
+
+    mock_acompletion.assert_called_once()
+    call_kwargs = mock_acompletion.call_args.kwargs
+    assert call_kwargs["model"] == f"a2a/{agent_name}"
+    assert call_kwargs["api_base"] == "http://sibling-db-agent.example.com"
+    prisma_client.db.litellm_agentstable.find_unique.assert_awaited()
diff --git a/tests/test_litellm/proxy/test_route_llm_request.py b/tests/test_litellm/proxy/test_route_llm_request.py
index fc3b14592cd..1e716f7c148 100644
--- a/tests/test_litellm/proxy/test_route_llm_request.py
+++ b/tests/test_litellm/proxy/test_route_llm_request.py
@@ -1119,6 +1119,126 @@ async def test_route_request_rejects_chat_completion_without_messages():
     llm_router.acompletion.assert_not_called()
 
 
+class FakeProxyModelTable:
+    def __init__(self, rows):
+        self.rows = rows
+        self.find_many_wheres = []
+
+    async def find_many(self, where=None, **kwargs):
+        self.find_many_wheres.append(where)
+        return list(self.rows)
+
+
+def _fake_prisma_client_with_models(rows):
+    from types import SimpleNamespace
+
+    table = FakeProxyModelTable(rows)
+    return SimpleNamespace(db=SimpleNamespace(litellm_proxymodeltable=table)), table
+
+
+def _db_model_row(model_name: str, mock_response: str):
+    from types import SimpleNamespace
+
+    return SimpleNamespace(
+        model_id=f"{model_name}-id",
+        model_name=model_name,
+        litellm_params={"model": "openai/gpt-4o", "api_key": "fake", "mock_response": mock_response},
+        model_info={},
+        blocked=False,
+    )
+
+
+@pytest.mark.asyncio
+async def test_route_request_read_through_recovers_model_created_on_sibling_replica(monkeypatch):
+    """Regression: a model written to the DB by another replica must be served on
+    first request instead of 400ing until the periodic config reload."""
+    import litellm
+    import litellm.proxy.proxy_server as proxy_server
+
+    model_name = "e2e-sibling-replica-model"
+    router = litellm.Router(
+        model_list=[
+            {
+                "model_name": "some-other-model",
+                "litellm_params": {"model": "openai/gpt-4o", "api_key": "fake"},
+            }
+        ]
+    )
+    fake_prisma, table = _fake_prisma_client_with_models([_db_model_row(model_name, "hello-from-db")])
+    monkeypatch.setattr(proxy_server, "prisma_client", fake_prisma)
+    monkeypatch.setattr(proxy_server, "store_model_in_db", True)
+    monkeypatch.setattr(proxy_server, "llm_router", router)
+
+    llm_call = await route_request(
+        data={"model": model_name, "messages": [{"role": "user", "content": "hi"}]},
+        llm_router=router,
+        user_model=None,
+        route_type="acompletion",
+    )
+    response = await llm_call
+
+    assert response.choices[0].message.content == "hello-from-db"
+    assert len(table.find_many_wheres) == 1
+    assert table.find_many_wheres[0] == {"model_name": model_name}
+
+
+@pytest.mark.asyncio
+async def test_route_request_unknown_model_raises_and_hits_db_once_within_ttl(monkeypatch):
+    import litellm
+    import litellm.proxy.proxy_server as proxy_server
+
+    model_name = "e2e-model-nobody-created"
+    router = litellm.Router(
+        model_list=[
+            {
+                "model_name": "some-other-model",
+                "litellm_params": {"model": "openai/gpt-4o", "api_key": "fake"},
+            }
+        ]
+    )
+    fake_prisma, table = _fake_prisma_client_with_models([])
+    monkeypatch.setattr(proxy_server, "prisma_client", fake_prisma)
+    monkeypatch.setattr(proxy_server, "store_model_in_db", True)
+    monkeypatch.setattr(proxy_server, "llm_router", router)
+
+    data = {"model": model_name, "messages": [{"role": "user", "content": "hi"}]}
+    with pytest.raises(ProxyModelNotFoundError):
+        await route_request(data=data, llm_router=router, user_model=None, route_type="acompletion")
+    with pytest.raises(ProxyModelNotFoundError):
+        await route_request(data=data, llm_router=router, user_model=None, route_type="acompletion")
+
+    assert table.find_many_wheres == [{"model_name": model_name}, {"model_id": model_name}]
+
+
+@pytest.mark.asyncio
+async def test_route_request_read_through_disabled_without_store_model_in_db(monkeypatch):
+    import litellm
+    import litellm.proxy.proxy_server as proxy_server
+
+    model_name = "e2e-config-only-proxy-model"
+    router = litellm.Router(
+        model_list=[
+            {
+                "model_name": "some-other-model",
+                "litellm_params": {"model": "openai/gpt-4o", "api_key": "fake"},
+            }
+        ]
+    )
+    fake_prisma, table = _fake_prisma_client_with_models([_db_model_row(model_name, "should-not-load")])
+    monkeypatch.setattr(proxy_server, "prisma_client", fake_prisma)
+    monkeypatch.setattr(proxy_server, "store_model_in_db", False)
+    monkeypatch.setattr(proxy_server, "llm_router", router)
+
+    with pytest.raises(ProxyModelNotFoundError):
+        await route_request(
+            data={"model": model_name, "messages": [{"role": "user", "content": "hi"}]},
+            llm_router=router,
+            user_model=None,
+            route_type="acompletion",
+        )
+
+    assert table.find_many_wheres == []
+
 @pytest.mark.asyncio
 async def test_route_request_routing_group_name_passes_model_gate():
     from unittest.mock import AsyncMock, patch
@@ -1141,3 +1261,39 @@ async def test_route_request_routing_group_name_passes_model_gate():
 
     assert response == "group_response"
     spy.assert_called_once_with(**data)
+
+
+@pytest.mark.asyncio
+async def test_route_request_a2a_agent_miss_does_not_consume_model_read_through(monkeypatch):
+    from types import SimpleNamespace
+    from unittest.mock import AsyncMock
+
+    import litellm
+    import litellm.proxy.proxy_server as proxy_server
+
+    model_name = "a2a/agent-nobody-created"
+    router = litellm.Router(
+        model_list=[
+            {
+                "model_name": "some-other-model",
+                "litellm_params": {"model": "openai/gpt-4o", "api_key": "fake"},
+            }
+        ]
+    )
+    fake_prisma, model_table = _fake_prisma_client_with_models([])
+    agents_find_unique = AsyncMock(return_value=None)
+    fake_prisma.db.litellm_agentstable = SimpleNamespace(find_unique=agents_find_unique)
+    monkeypatch.setattr(proxy_server, "prisma_client", fake_prisma)
+    monkeypatch.setattr(proxy_server, "store_model_in_db", True)
+    monkeypatch.setattr(proxy_server, "llm_router", router)
+
+    with pytest.raises(ProxyModelNotFoundError):
+        await route_request(
+            data={"model": model_name, "messages": [{"role": "user", "content": "hi"}]},
+            llm_router=router,
+            user_model=None,
+            route_type="acompletion",
+        )
+
+    assert agents_find_unique.await_count == 2
+    assert model_table.find_many_wheres == []
diff --git a/tests/test_litellm/responses/test_responses_websocket_all_providers.py b/tests/test_litellm/responses/test_responses_websocket_all_providers.py
index 4509abc7749..2d523bfdeb3 100644
--- a/tests/test_litellm/responses/test_responses_websocket_all_providers.py
+++ b/tests/test_litellm/responses/test_responses_websocket_all_providers.py
@@ -1030,6 +1030,171 @@ class TestWebSocketErrorHandling:
         assert "Invalid JSON" in error_event
 
 
+class TestWebSocketProjectQuotaEnforcement:
+    """VERIA regression: the connection-level pre-call hook only runs once,
+    but a WebSocket connection accepts many response.create frames. Every
+    frame must be checked against any registered project ITPM/OTPM quota
+    callback, not just the first one."""
+
+    @pytest.mark.asyncio
+    async def test_managed_handler_blocks_frame_rejected_by_quota_callback(self, monkeypatch):
+        from unittest.mock import AsyncMock, MagicMock
+
+        import litellm
+        from litellm.exceptions import RateLimitError
+        from litellm.litellm_core_utils.litellm_logging import Logging
+        from litellm.responses.streaming_iterator import (
+            ManagedResponsesWebSocketHandler,
+        )
+
+        aresponses_called = False
+
+        async def fake_aresponses(*args, **kwargs):
+            nonlocal aresponses_called
+            aresponses_called = True
+
+        monkeypatch.setattr(litellm, "aresponses", fake_aresponses)
+
+        quota_callback = MagicMock()
+        quota_callback.enforce_project_io_token_quota_for_frame = AsyncMock(
+            side_effect=RateLimitError(message="project OTPM exceeded", llm_provider="", model="")
+        )
+
+        mock_websocket = MagicMock()
+        mock_websocket.send_text = AsyncMock()
+        mock_logging_obj = Logging(
+            model="test-model",
+            messages=[],
+            stream=True,
+            call_type="aresponses",
+            start_time=0,
+            litellm_call_id="test-id",
+            function_id="test-func",
+        )
+        handler = ManagedResponsesWebSocketHandler(
+            websocket=mock_websocket,
+            model="test-model",
+            logging_obj=mock_logging_obj,
+            quota_callbacks=[quota_callback],
+        )
+
+        await handler._process_response_create(json.dumps({"type": "response.create", "input": "hi"}))
+
+        quota_callback.enforce_project_io_token_quota_for_frame.assert_awaited_once()
+        assert aresponses_called is False
+        mock_websocket.send_text.assert_called_once()
+        error_event = mock_websocket.send_text.call_args[0][0]
+        assert "rate_limit_exceeded" in error_event
+
+    @pytest.mark.asyncio
+    async def test_managed_handler_forwards_frame_allowed_by_quota_callback(self, monkeypatch):
+        from unittest.mock import AsyncMock, MagicMock
+
+        import litellm
+        from litellm.litellm_core_utils.litellm_logging import Logging
+        from litellm.responses.streaming_iterator import (
+            ManagedResponsesWebSocketHandler,
+        )
+
+        aresponses_called = False
+
+        async def fake_aresponses(*args, **kwargs):
+            nonlocal aresponses_called
+            aresponses_called = True
+
+            async def _empty():
+                return
+                yield
+
+            return _empty()
+
+        monkeypatch.setattr(litellm, "aresponses", fake_aresponses)
+
+        quota_callback = MagicMock()
+        quota_callback.enforce_project_io_token_quota_for_frame = AsyncMock(return_value=None)
+
+        mock_websocket = MagicMock()
+        mock_websocket.send_text = AsyncMock()
+        mock_logging_obj = Logging(
+            model="test-model",
+            messages=[],
+            stream=True,
+            call_type="aresponses",
+            start_time=0,
+            litellm_call_id="test-id",
+            function_id="test-func",
+        )
+        handler = ManagedResponsesWebSocketHandler(
+            websocket=mock_websocket,
+            model="test-model",
+            logging_obj=mock_logging_obj,
+            quota_callbacks=[quota_callback],
+        )
+
+        await handler._process_response_create(json.dumps({"type": "response.create", "input": "hi"}))
+
+        quota_callback.enforce_project_io_token_quota_for_frame.assert_awaited_once()
+        assert aresponses_called is True
+
+    @pytest.mark.asyncio
+    async def test_native_handler_blocks_frame_rejected_by_quota_callback(self):
+        from unittest.mock import AsyncMock, MagicMock
+
+        from litellm.exceptions import RateLimitError
+        from litellm.responses.streaming_iterator import ResponsesWebSocketStreaming
+
+        quota_callback = MagicMock()
+        quota_callback.enforce_project_io_token_quota_for_frame = AsyncMock(
+            side_effect=RateLimitError(message="project OTPM exceeded", llm_provider="", model="")
+        )
+
+        mock_backend_ws = MagicMock()
+        mock_backend_ws.send = AsyncMock()
+        mock_websocket = MagicMock()
+        mock_websocket.send_text = AsyncMock()
+
+        handler = ResponsesWebSocketStreaming(
+            websocket=mock_websocket,
+            backend_ws=mock_backend_ws,
+            logging_obj=MagicMock(),
+            authorized_model="gpt-4o",
+            quota_callbacks=[quota_callback],
+        )
+
+        allowed = await handler._enforce_or_reject_frame(
+            json.dumps({"type": "response.create", "input": "hi"})
+        )
+
+        assert allowed is False
+        mock_backend_ws.send.assert_not_called()
+        mock_websocket.send_text.assert_called_once()
+        assert "rate_limit_exceeded" in mock_websocket.send_text.call_args[0][0]
+
+    @pytest.mark.asyncio
+    async def test_native_handler_forwards_frame_allowed_by_quota_callback(self):
+        from unittest.mock import AsyncMock, MagicMock
+
+        from litellm.responses.streaming_iterator import ResponsesWebSocketStreaming
+
+        quota_callback = MagicMock()
+        quota_callback.enforce_project_io_token_quota_for_frame = AsyncMock(return_value=None)
+
+        handler = ResponsesWebSocketStreaming(
+            websocket=MagicMock(),
+            backend_ws=MagicMock(),
+            logging_obj=MagicMock(),
+            authorized_model="gpt-4o",
+            quota_callbacks=[quota_callback],
+        )
+
+        allowed = await handler._enforce_or_reject_frame(
+            json.dumps({"type": "response.create", "input": "hi"})
+        )
+
+        assert allowed is True
+        quota_callback.enforce_project_io_token_quota_for_frame.assert_awaited_once()
+
+
 class TestNativeWebSocketGuardrails:
     @pytest.mark.asyncio
     async def test_response_create_injects_authorized_model(self):
diff --git a/tests/test_litellm/router_utils/test_fallback_event_handlers.py b/tests/test_litellm/router_utils/test_fallback_event_handlers.py
index 68395737469..24477248a8a 100644
--- a/tests/test_litellm/router_utils/test_fallback_event_handlers.py
+++ b/tests/test_litellm/router_utils/test_fallback_event_handlers.py
@@ -1,4 +1,5 @@
 import json
+from typing import NoReturn
 from unittest.mock import MagicMock, patch
 
 import httpx
@@ -167,6 +168,10 @@ async def _acreate_batch(*args, **kwargs):
     raise AssertionError("only used for its __name__")
 
 
+async def _acreate_file(*args: object, **kwargs: object) -> NoReturn:
+    raise AssertionError("only used for its __name__")
+
+
 @pytest.mark.asyncio
 async def test_run_async_fallback_keeps_uploaded_file_requests_in_their_model_group():
     """An input_file_id only exists under the credentials of the group it was uploaded
@@ -229,6 +234,46 @@ async def test_run_async_fallback_allows_same_model_group_retry_for_uploaded_fil
     assert router.attempted_model_groups == ["openai-group"]
 
 
+@pytest.mark.asyncio
+async def test_run_async_fallback_keeps_file_creation_in_its_model_group():
+    """A file created for batches lands in the account of the deployment that stored it,
+    and its id is only usable against the model group the caller named. A cross-group
+    fallback silently stores the file with the wrong provider."""
+    router = AttemptRecordingRouter()
+
+    with pytest.raises(RuntimeError, match="azure connection error"):
+        await run_async_fallback(
+            litellm_router=router,
+            fallback_model_group=["openai-group"],
+            original_model_group="azure-group",
+            original_exception=RuntimeError("azure connection error"),
+            max_fallbacks=3,
+            fallback_depth=0,
+            model="azure-group",
+            original_function=_acreate_file,
+        )
+
+    assert router.attempted_model_groups == []
+
+
+@pytest.mark.asyncio
+async def test_run_async_fallback_allows_same_model_group_retry_for_file_creation():
+    router = AttemptRecordingRouter()
+
+    await run_async_fallback(
+        litellm_router=router,
+        fallback_model_group=[{"model": "azure-group", "_target_order": 2}],
+        original_model_group="azure-group",
+        original_exception=RuntimeError("first deployment failed"),
+        max_fallbacks=3,
+        fallback_depth=0,
+        model="azure-group",
+        original_function=_acreate_file,
+    )
+
+    assert router.attempted_model_groups == ["azure-group"]
+
+
 @pytest.mark.asyncio
 async def test_run_async_fallback_still_crosses_model_groups_without_an_uploaded_file():
     router = AttemptRecordingRouter()
diff --git a/tests/test_litellm/test_conftest.py b/tests/test_litellm/test_conftest.py
new file mode 100644
index 00000000000..cca4f7c3ef2
--- /dev/null
+++ b/tests/test_litellm/test_conftest.py
@@ -0,0 +1,43 @@
+import os
+import subprocess
+import sys
+from pathlib import Path
+from typing import Final
+
+REPO_ROOT: Final = Path(__file__).resolve().parents[2]
+
+PROXY_BASE_URL_SENSITIVE_NODE: Final = (
+    "tests/test_litellm/proxy/management_endpoints/test_mcp_management_endpoints.py"
+    "::TestTemporaryMCPSessionEndpoints"
+    "::test_mcp_token_opens_sealed_passthrough_code_and_exchanges_with_minted_client"
+)
+
+COVERAGE_SUBPROCESS_VARS: Final = frozenset(
+    {"COV_CORE_SOURCE", "COV_CORE_CONFIG", "COV_CORE_DATAFILE", "COV_CORE_CONTEXT", "COVERAGE_PROCESS_START"}
+)
+
+
+def test_host_proxy_base_url_cannot_reach_request_derived_url_tests():
+    child_env: Final = {
+        key: value for key, value in os.environ.items() if key not in COVERAGE_SUBPROCESS_VARS
+    } | {"PROXY_BASE_URL": "https://leaked-host-origin.example.com"}
+
+    completed: Final = subprocess.run(
+        [
+            sys.executable,
+            "-m",
+            "pytest",
+            PROXY_BASE_URL_SENSITIVE_NODE,
+            "-q",
+            "--no-header",
+            "-p",
+            "no:cacheprovider",
+        ],
+        cwd=REPO_ROOT,
+        env=child_env,
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+
+    assert completed.returncode == 0, completed.stdout + completed.stderr
diff --git a/tests/test_litellm/test_logging.py b/tests/test_litellm/test_logging.py
index 9ab362f6cd5..784ec5b6cf4 100644
--- a/tests/test_litellm/test_logging.py
+++ b/tests/test_litellm/test_logging.py
@@ -177,7 +177,10 @@ def test_json_formatter_parses_embedded_python_dict_repr():
     # Python dict parsed and promoted to first-class properties
     assert obj["model_name"] == "text-embedding-3-large"
     assert "litellm_params" in obj
-    assert obj["litellm_params"]["api_key"] == "sk**********"
+    # Redacted, not passed through: SecretRedactionFilter already collapses this
+    # pair in the plain path before any formatter sees it, so the JSON path matching
+    # it is production parity. The key survives because redaction is per-value here.
+    assert obj["litellm_params"]["api_key"] == "REDACTED"
     assert obj["litellm_params"]["tpm"] == 1000000
     assert obj["litellm_params"]["use_in_pass_through"] is False
     assert "model_info" in obj
@@ -185,6 +188,38 @@ def test_json_formatter_parses_embedded_python_dict_repr():
     assert obj["model_info"]["db_model"] is False
 
 
+def test_json_formatter_output_stays_parseable_when_a_secret_is_redacted():
+    """Redaction must collapse the value only, never the surrounding JSON member.
+
+    Redacting the serialized document turned '"api_key": "sk-..."' into a bare
+    REDACTED token, so the line stopped being valid JSON entirely.
+    """
+    formatter = JsonFormatter()
+    record = logging.LogRecord(
+        name="LiteLLM",
+        level=logging.INFO,
+        pathname="",
+        lineno=0,
+        msg="calling deployment",
+        args=(),
+        exc_info=None,
+    )
+    record.deployment = {
+        "api_key": "sk-abcdefghijklmnopqrstuvwxyz0123456789",
+        "aws_secret_access_key": "wJalrXUtnFEMIQAfakeKEYbPxRfiCYEXAMPLEKEY",
+        "aws_region_name": "us-east-1",
+        "nested": {"tokens": ["Bearer abcdefghijklmnop", "keep-me"]},
+    }
+
+    obj = json.loads(formatter.format(record))
+
+    assert obj["deployment"]["api_key"] == "REDACTED"
+    assert obj["deployment"]["aws_secret_access_key"] == "REDACTED"
+    # Non-secret siblings stay legible so the logs remain useful
+    assert obj["deployment"]["aws_region_name"] == "us-east-1"
+    assert obj["deployment"]["nested"]["tokens"] == ["REDACTED", "keep-me"]
+
+
 def test_json_formatter_includes_component_field():
     """
     Test that JsonFormatter always emits a 'component' field equal to the logger name.
diff --git a/tests/test_litellm/test_responses_api_bridge_non_stream.py b/tests/test_litellm/test_responses_api_bridge_non_stream.py
index 25a3bc2dbba..c272b151865 100644
--- a/tests/test_litellm/test_responses_api_bridge_non_stream.py
+++ b/tests/test_litellm/test_responses_api_bridge_non_stream.py
@@ -1,6 +1,6 @@
 import os
 import sys
-from typing import Optional
+from typing import Final, Optional
 from unittest.mock import Mock
 
 import pytest
@@ -192,6 +192,32 @@ def test_transform_usage_with_cached_tokens_only():
     print("✓ Transformation works with cached_tokens only")
 
 
+def test_transform_usage_maps_nested_cache_creation_input_tokens():
+    """
+    Regression (LIT-5757): DashScope nests cache_creation_input_tokens inside
+    prompt_tokens_details; the bridge must surface it as cache_write_tokens.
+    """
+    usage: Final = Usage(
+        prompt_tokens=2059,
+        completion_tokens=31,
+        total_tokens=2090,
+        prompt_tokens_details={
+            "cached_tokens": 0,
+            "text_tokens": 2059,
+            "cache_type": "ephemeral",
+            "cache_creation_input_tokens": 2048,
+            "cache_creation": {"ephemeral_5m_input_tokens": 2048},
+        },
+    )
+
+    responses_usage: Final = LiteLLMCompletionResponsesConfig._transform_chat_completion_usage_to_responses_usage(
+        usage
+    )
+
+    assert responses_usage.input_tokens_details is not None
+    assert responses_usage.input_tokens_details.cache_write_tokens == 2048
+
+
 def test_transform_usage_with_reasoning_tokens_only():
     """
     Test transformation when only reasoning_tokens is provided (no cached_tokens).
diff --git a/tests/test_litellm/test_router.py b/tests/test_litellm/test_router.py
index 49ed236356c..65debae9a16 100644
--- a/tests/test_litellm/test_router.py
+++ b/tests/test_litellm/test_router.py
@@ -492,6 +492,54 @@ async def test_async_router_acreate_file_with_jsonl():
         assert first_call_content == non_jsonl_content
 
 
+@pytest.mark.asyncio
+async def test_async_router_acreate_file_does_not_fall_back_across_model_groups():
+    """A file created for batches only exists under the credentials of the model group
+    the caller named. A cross-group fallback silently stores it with the wrong provider
+    and the later batch create against the named group permanently fails."""
+    from unittest.mock import MagicMock, patch
+
+    router = litellm.Router(
+        model_list=[
+            {
+                "model_name": "azure-gpt",
+                "litellm_params": {
+                    "model": "azure/my-azure-deployment",
+                    "api_base": "http://127.0.0.1:9",
+                    "api_key": "dummy-key",
+                    "api_version": "2024-06-01",
+                },
+            },
+            {
+                "model_name": "openai-gpt",
+                "litellm_params": {"model": "gpt-4o-mini"},
+            },
+        ],
+        fallbacks=[{"azure-gpt": ["openai-gpt"]}],
+    )
+
+    def fail_azure(*args: object, **kwargs: object) -> MagicMock:
+        if kwargs.get("model") == "azure/my-azure-deployment":
+            raise litellm.APIConnectionError(
+                message="Connection error.",
+                llm_provider="azure",
+                model="azure/my-azure-deployment",
+            )
+        return MagicMock()
+
+    with patch("litellm.acreate_file", side_effect=fail_azure) as mock_acreate_file:
+        with pytest.raises(litellm.APIConnectionError):
+            await router.acreate_file(
+                model="azure-gpt",
+                purpose="batch",
+                file=MagicMock(),
+            )
+
+        called_models = [call.kwargs.get("model") for call in mock_acreate_file.call_args_list]
+        assert "azure/my-azure-deployment" in called_models
+        assert "gpt-4o-mini" not in called_models
+
+
 @pytest.mark.asyncio
 async def test_async_router_acreate_file_uses_deployment_custom_llm_provider():
     """
@@ -7595,6 +7643,95 @@ def test_pre_call_checks_keeps_deployment_when_provider_is_unresolvable(monkeypa
     assert len(result) == 1
 
 
+class TestUpsertDeploymentRollback:
+    """
+    Regression tests: `upsert_deployment` pops the previous deployment before
+    re-adding the edited one. When the re-add raises under
+    `ignore_invalid_deployments=True`, the pop must be rolled back so this pod
+    keeps serving the previous configuration instead of silently dropping a live
+    deployment (the "Error upserting deployment" drop behind the access-group
+    reload 500 in the 2-replica e2e suite).
+    """
+
+    def test_failed_upsert_keeps_previous_deployment_serving(self):
+        from litellm.types.router import Deployment, LiteLLM_Params, ModelInfo
+
+        router = litellm.Router(
+            model_list=[
+                {
+                    "model_name": "prod-model",
+                    "litellm_params": {"model": "gpt-4o", "api_key": "sk-old"},
+                    "model_info": {"id": "prod-1", "db_model": True},
+                }
+            ],
+            ignore_invalid_deployments=True,
+        )
+
+        result = router.upsert_deployment(
+            deployment=Deployment(
+                model_name="prod-model",
+                litellm_params=LiteLLM_Params(model="auto_router/broken"),
+                model_info=ModelInfo(id="prod-1", db_model=True),
+            )
+        )
+
+        assert result is None
+        restored = router.get_deployment(model_id="prod-1")
+        assert restored is not None
+        assert restored.litellm_params.model == "gpt-4o"
+        assert [model["model_name"] for model in router.model_list] == ["prod-model"]
+
+    def test_failed_fresh_add_returns_none_without_restore(self):
+        from litellm.types.router import Deployment, LiteLLM_Params, ModelInfo
+
+        router = litellm.Router(model_list=[], ignore_invalid_deployments=True)
+
+        result = router.upsert_deployment(
+            deployment=Deployment(
+                model_name="fresh-router",
+                litellm_params=LiteLLM_Params(model="auto_router/broken"),
+                model_info=ModelInfo(id="fresh-1", db_model=True),
+            )
+        )
+
+        assert result is None
+        assert router.get_deployment(model_id="fresh-1") is None
+        assert router.model_list == []
+
+    def test_restore_re_adds_popped_deployment(self):
+        router = litellm.Router(
+            model_list=[
+                {
+                    "model_name": "prod-model",
+                    "litellm_params": {"model": "gpt-4o", "api_key": "sk-old"},
+                    "model_info": {"id": "prod-1", "db_model": True},
+                }
+            ],
+            ignore_invalid_deployments=True,
+        )
+        previous = router.get_deployment(model_id="prod-1")
+        router.delete_deployment(id="prod-1")
+        assert router.has_model_id("prod-1") is False
+
+        router._restore_deployment_after_failed_upsert(
+            previous_deployment=previous, model_id="prod-1"
+        )
+
+        restored = router.get_deployment(model_id="prod-1")
+        assert restored is not None
+        assert restored.litellm_params.model == "gpt-4o"
+
+        router._restore_deployment_after_failed_upsert(
+            previous_deployment=previous, model_id="prod-1"
+        )
+        assert len(router.model_list) == 1
+
+        router._restore_deployment_after_failed_upsert(
+            previous_deployment=None, model_id="prod-1"
+        )
+        assert len(router.model_list) == 1
+
+
 class TestConsumedRequestTagsStamp:
     """Issue #36621: when a request's tags select a tagged pre-routing strategy, those
     tags are consumed by the selection; the hook must stamp the rewritten model group so
@@ -7794,6 +7931,21 @@ class TestTaggedAutoRouterOnSharedModelName:
         assert response is not None
         assert response.model == "gemini-flash"
 
+    @pytest.mark.asyncio
+    async def test_request_level_tag_filtering_from_key_settings_bypasses_the_marker(self):
+        router = self._router(marker_tags=["route"], include_plain_sibling=True, enable_tag_filtering=False)
+
+        assert await self._hook_response(router, {"enable_tag_filtering": True}) is None
+
+    @pytest.mark.asyncio
+    async def test_globally_disabled_filtering_still_lets_the_marker_capture_untagged_requests(self):
+        router = self._router(marker_tags=["route"], include_plain_sibling=True, enable_tag_filtering=False)
+
+        response = await self._hook_response(router, {})
+
+        assert response is not None
+        assert response.model == "gemini-flash"
+
     @pytest.mark.asyncio
     async def test_marker_only_alias_still_captures_untagged_requests(self):
         router = self._router(marker_tags=["route"], include_plain_sibling=False, enable_tag_filtering=True)
diff --git a/tests/test_litellm/test_secret_redaction.py b/tests/test_litellm/test_secret_redaction.py
index a5f3f912339..0188d87dfdb 100644
--- a/tests/test_litellm/test_secret_redaction.py
+++ b/tests/test_litellm/test_secret_redaction.py
@@ -495,3 +495,54 @@ def test_redaction_survives_uvicorn_logging_reconfiguration():
             lg.handlers[:] = handlers
             lg.setLevel(level)
             lg.propagate = True
+
+
+def test_aws_credential_redaction_catches_quoted_values():
+    """AWS creds appear as quoted dict-repr values, not just bare key=value."""
+    cases = (
+        "{'aws_secret_access_key': 'wJalrXUtnFEMIK7MDENGbPxRfiCYEXAMPLEKEY'}",
+        '{"aws_session_token": "IQoJb3JpZ2luX2VjEaCXVzLWVhc3QtMSJHMEUCIQ"}',
+        "aws_session_token: 'FwoGZXIvYXdzEBYaDHh4eHh4eHh4eHh4eCLLAe'",
+        "aws_secret_access_key=wJalrXUtnFEMIK7MDENGbPxRfiCYEXAMPLEKEY",
+        "{'aws_access_key_id': 'not-an-akia-shaped-value'}",
+    )
+    for secret_line in cases:
+        result = redact_string(secret_line)
+        assert "REDACTED" in result, f"AWS redaction missed: {secret_line!r}"
+        assert "wJalrXUtnFEMIK7MDENGbPxRfiCYEXAMPLEKEY" not in result
+        assert "IQoJb3JpZ2luX2VjEaCXVzLWVhc3QtMSJHMEUCIQ" not in result
+
+    safe = "'aws_region_name': 'us-east-1'"
+    assert redact_string(safe) == safe
+
+
+@pytest.mark.parametrize(
+    "extra",
+    (
+        {"api_base": {f"https://host/v1?key={SECRET}"}},
+        {"blob": {"authorization": f"Bearer {SECRET}"}},
+        {"blob": [f"Bearer {SECRET}"]},
+        {"blob": ({"nested": {"deep": SECRET}},)},
+    ),
+    ids=("set", "dict", "list", "nested"),
+)
+def test_json_formatter_redacts_non_string_extra_values(extra):
+    """SecretRedactionFilter only scrubs str attrs, so containers must be caught on render."""
+    buf = StringIO()
+    handler = logging.StreamHandler(buf)
+    handler.setFormatter(JsonFormatter())
+    handler.addFilter(_secret_filter)
+
+    logger = logging.getLogger("test_json_extra_redaction")
+    logger.handlers = [handler]
+    logger.setLevel(logging.DEBUG)
+    logger.propagate = False
+    try:
+        logger.warning("request sent", extra=extra)
+    finally:
+        logger.handlers = []
+
+    output = buf.getvalue()
+    assert output.strip(), "no record captured"
+    assert SECRET not in output, f"non-string extra leaked a secret: {output}"
+    assert "REDACTED" in output
diff --git a/tests/test_litellm/test_thinking_enabled.py b/tests/test_litellm/test_thinking_enabled.py
index 8ba406c395a..744b258e617 100644
--- a/tests/test_litellm/test_thinking_enabled.py
+++ b/tests/test_litellm/test_thinking_enabled.py
@@ -60,6 +60,7 @@ class TestIsThinkingEnabled:
             ({"reasoning_effort": "medium"}, True),
             # both thinking enabled and reasoning_effort returns True
             ({"thinking": {"type": "enabled"}, "reasoning_effort": "high"}, True),
+            ({"thinking": True}, True),
             # falsy thinking values should not crash
             ({"thinking": False}, False),
             ({"thinking": 0}, False),
diff --git a/tests/test_litellm/test_utils.py b/tests/test_litellm/test_utils.py
index afdfdf170ac..efccdc4a986 100644
--- a/tests/test_litellm/test_utils.py
+++ b/tests/test_litellm/test_utils.py
@@ -3766,6 +3766,20 @@ class TestValidateAndFixThinkingParam:
         assert "budgetTokens" in thinking
         assert "budget_tokens" not in thinking
 
+    def test_bool_true_maps_to_enabled_with_default_budget(self):
+        from litellm.constants import DEFAULT_REASONING_EFFORT_MEDIUM_THINKING_BUDGET
+        from litellm.utils import validate_and_fix_thinking_param
+
+        assert validate_and_fix_thinking_param(thinking=True) == {
+            "type": "enabled",
+            "budget_tokens": DEFAULT_REASONING_EFFORT_MEDIUM_THINKING_BUDGET,
+        }
+
+    def test_bool_false_returns_none(self):
+        from litellm.utils import validate_and_fix_thinking_param
+
+        assert validate_and_fix_thinking_param(thinking=False) is None
+
 
 def test_deepseek_v4_models_in_cost_map():
     """
diff --git a/tests/test_litellm/types/test_types_utils.py b/tests/test_litellm/types/test_types_utils.py
index cd5e8dda012..672aa84cc73 100644
--- a/tests/test_litellm/types/test_types_utils.py
+++ b/tests/test_litellm/types/test_types_utils.py
@@ -1,5 +1,6 @@
 import os
 import sys
+from typing import Final
 
 import pytest
 
@@ -75,6 +76,29 @@ def test_usage_dump():
     assert new_usage.prompt_tokens_details.web_search_requests == 1
 
 
+def test_prompt_tokens_details_maps_nested_cache_creation_input_tokens():
+    """Regression (LIT-5757): DashScope nests the Anthropic-spelled
+    cache_creation_input_tokens inside prompt_tokens_details. It must populate
+    the canonical cache_write_tokens/cache_creation_tokens pair, without
+    overriding an explicitly provided canonical value."""
+    from litellm.types.utils import PromptTokensDetailsWrapper
+
+    nested: Final = PromptTokensDetailsWrapper(
+        cached_tokens=0, text_tokens=2059, cache_creation_input_tokens=2048
+    )
+    assert nested.cache_write_tokens == 2048
+    assert nested.cache_creation_tokens == 2048
+
+    explicit: Final = PromptTokensDetailsWrapper(
+        cache_write_tokens=100, cache_creation_input_tokens=2048
+    )
+    assert explicit.cache_write_tokens == 100
+    assert explicit.cache_creation_tokens == 100
+
+    non_int: Final = PromptTokensDetailsWrapper(cache_creation_input_tokens=None)
+    assert not hasattr(non_int, "cache_write_tokens")
+
+
 def test_usage_server_tool_use_dict_is_coerced_and_round_trips():
     from litellm.types.utils import ServerToolUse, Usage
 
diff --git a/type-discipline-budget.json b/type-discipline-budget.json
index 94c1f9b86f9..e7cfff93aa4 100644
--- a/type-discipline-budget.json
+++ b/type-discipline-budget.json
@@ -1,9 +1,9 @@
 {
   "LIT001": {
-    "limit": 22897
+    "limit": 22892
   },
   "LIT002": {
-    "limit": 26888
+    "limit": 26886
   },
   "LIT003": {
     "limit": 269
@@ -27,7 +27,7 @@
     "limit": 0
   },
   "LIT010": {
-    "limit": 16713
+    "limit": 16699
   },
   "LIT011": {
     "limit": 5590
diff --git a/ui/litellm-dashboard/eslint-suppressions.json b/ui/litellm-dashboard/eslint-suppressions.json
index ed72e784a35..c471355db68 100644
--- a/ui/litellm-dashboard/eslint-suppressions.json
+++ b/ui/litellm-dashboard/eslint-suppressions.json
@@ -793,16 +793,6 @@
       "count": 1
     }
   },
-  "src/app/(dashboard)/models-and-endpoints/panels/AddModelPanel.tsx": {
-    "no-restricted-imports": {
-      "count": 1
-    }
-  },
-  "src/app/(dashboard)/models-and-endpoints/panels/LlmCredentialsPanel.tsx": {
-    "no-restricted-imports": {
-      "count": 1
-    }
-  },
   "src/app/(dashboard)/models-and-endpoints/utils/modelDataTransformer.ts": {
     "prefer-const": {
       "count": 6
@@ -1055,11 +1045,6 @@
       "count": 1
     }
   },
-  "src/app/(dashboard)/policies/_components/impact_popover.test.tsx": {
-    "react/display-name": {
-      "count": 1
-    }
-  },
   "src/app/(dashboard)/policies/_components/impact_popover.tsx": {
     "local/filename-pascal-case": {
       "count": 1
@@ -1073,11 +1058,6 @@
       "count": 1
     }
   },
-  "src/app/(dashboard)/policies/_components/index.test.tsx": {
-    "react/display-name": {
-      "count": 1
-    }
-  },
   "src/app/(dashboard)/policies/_components/index.tsx": {
     "local/filename-pascal-case": {
       "count": 1
@@ -1750,7 +1730,7 @@
   },
   "src/components/add_model/AddModelForm.test.tsx": {
     "no-restricted-imports": {
-      "count": 2
+      "count": 1
     }
   },
   "src/components/add_model/AddModelForm.tsx": {
@@ -1761,7 +1741,7 @@
       "count": 1
     },
     "no-restricted-imports": {
-      "count": 3
+      "count": 2
     }
   },
   "src/components/add_model/ClassificationMethodConfig.tsx": {
@@ -1813,9 +1793,6 @@
     },
     "no-restricted-imports": {
       "count": 3
-    },
-    "prefer-const": {
-      "count": 2
     }
   },
   "src/components/add_model/auto_router_connection_test.tsx": {
@@ -1826,17 +1803,6 @@
   "src/components/add_model/cache_control_settings.tsx": {
     "local/filename-pascal-case": {
       "count": 1
-    },
-    "no-restricted-imports": {
-      "count": 1
-    },
-    "prefer-const": {
-      "count": 1
-    }
-  },
-  "src/components/add_model/conditional_public_model_name.test.tsx": {
-    "no-restricted-imports": {
-      "count": 1
     }
   },
   "src/components/add_model/conditional_public_model_name.tsx": {
@@ -1863,11 +1829,6 @@
       "count": 1
     }
   },
-  "src/components/add_model/litellm_model_name.test.tsx": {
-    "no-restricted-imports": {
-      "count": 1
-    }
-  },
   "src/components/add_model/litellm_model_name.tsx": {
     "local/filename-pascal-case": {
       "count": 1
@@ -1887,11 +1848,6 @@
       "count": 2
     }
   },
-  "src/components/add_model/provider_specific_fields.test.tsx": {
-    "no-restricted-imports": {
-      "count": 1
-    }
-  },
   "src/components/add_model/provider_specific_fields.tsx": {
     "local/filename-pascal-case": {
       "count": 1
@@ -2063,14 +2019,6 @@
       "count": 1
     }
   },
-  "src/components/common_components/chartUtils.tsx": {
-    "local/filename-pascal-case": {
-      "count": 1
-    },
-    "no-nested-ternary": {
-      "count": 1
-    }
-  },
   "src/components/common_components/check_openapi_schema.tsx": {
     "local/filename-pascal-case": {
       "count": 1
@@ -2294,15 +2242,6 @@
     "local/filename-pascal-case": {
       "count": 1
     },
-    "local/no-complex-jsx-arrow": {
-      "count": 1
-    },
-    "max-lines": {
-      "count": 1
-    },
-    "no-nested-ternary": {
-      "count": 14
-    },
     "no-restricted-imports": {
       "count": 1
     },
@@ -2361,21 +2300,10 @@
       "count": 1
     }
   },
-  "src/components/organisms/create_key_button.test.tsx": {
-    "@typescript-eslint/no-require-imports": {
-      "count": 1
-    },
-    "react/display-name": {
-      "count": 8
-    }
-  },
   "src/components/organisms/create_key_button.tsx": {
     "local/filename-pascal-case": {
       "count": 1
     },
-    "local/no-complex-jsx-arrow": {
-      "count": 2
-    },
     "max-lines": {
       "count": 1
     },
@@ -2669,15 +2597,6 @@
   "src/components/templates/key_edit_view.tsx": {
     "local/filename-pascal-case": {
       "count": 1
-    },
-    "local/no-complex-jsx-arrow": {
-      "count": 2
-    },
-    "no-nested-ternary": {
-      "count": 2
-    },
-    "no-restricted-imports": {
-      "count": 1
     }
   },
   "src/components/templates/key_info_view.tsx": {
@@ -3062,9 +2981,6 @@
   "tests/setupTests.ts": {
     "@typescript-eslint/no-this-alias": {
       "count": 1
-    },
-    "react/display-name": {
-      "count": 1
     }
   }
 }
\ No newline at end of file
diff --git a/ui/litellm-dashboard/package-lock.json b/ui/litellm-dashboard/package-lock.json
index 93ee979f37d..186d38234d5 100644
--- a/ui/litellm-dashboard/package-lock.json
+++ b/ui/litellm-dashboard/package-lock.json
@@ -18,7 +18,6 @@
         "@tanstack/react-pacer": "0.22.1",
         "@tanstack/react-query": "5.100.7",
         "@tanstack/react-table": "8.21.3",
-        "@tremor/react": "3.18.7",
         "@types/papaparse": "5.5.2",
         "antd": "5.29.3",
         "cva": "1.0.0-beta.4",
@@ -1460,87 +1459,12 @@
         "@floating-ui/utils": "^0.2.11"
       }
     },
-    "node_modules/@floating-ui/react": {
-      "version": "0.19.2",
-      "resolved": "https://registry.npmjs.org/@floating-ui/react/-/react-0.19.2.tgz",
-      "integrity": "sha512-JyNk4A0Ezirq8FlXECvRtQOX/iBe5Ize0W/pLkrZjfHW9GUV7Xnq6zm6fyZuQzaHHqEnVizmvlA96e1/CkZv+w==",
-      "license": "MIT",
-      "dependencies": {
-        "@floating-ui/react-dom": "^1.3.0",
-        "aria-hidden": "^1.1.3",
-        "tabbable": "^6.0.1"
-      },
-      "peerDependencies": {
-        "react": ">=16.8.0",
-        "react-dom": ">=16.8.0"
-      }
-    },
-    "node_modules/@floating-ui/react-dom": {
-      "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/@floating-ui/react-dom/-/react-dom-1.3.0.tgz",
-      "integrity": "sha512-htwHm67Ji5E/pROEAr7f8IKFShuiCKHwUC/UY4vC3I5jiSvGFAYnSYiZO5MlGmads+QqvUkR9ANHEguGrDv72g==",
-      "license": "MIT",
-      "dependencies": {
-        "@floating-ui/dom": "^1.2.1"
-      },
-      "peerDependencies": {
-        "react": ">=16.8.0",
-        "react-dom": ">=16.8.0"
-      }
-    },
     "node_modules/@floating-ui/utils": {
       "version": "0.2.11",
       "resolved": "https://registry.npmjs.org/@floating-ui/utils/-/utils-0.2.11.tgz",
       "integrity": "sha512-RiB/yIh78pcIxl6lLMG0CgBXAZ2Y0eVHqMPYugu+9U0AeT6YBeiJpf7lbdJNIugFP5SIjwNRgo4DhR1Qxi26Gg==",
       "license": "MIT"
     },
-    "node_modules/@headlessui/react": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@headlessui/react/-/react-2.2.0.tgz",
-      "integrity": "sha512-RzCEg+LXsuI7mHiSomsu/gBJSjpupm6A1qIZ5sWjd7JhARNlMiSA4kKfJpCKwU9tE+zMRterhhrP74PvfJrpXQ==",
-      "license": "MIT",
-      "dependencies": {
-        "@floating-ui/react": "^0.26.16",
-        "@react-aria/focus": "^3.17.1",
-        "@react-aria/interactions": "^3.21.3",
-        "@tanstack/react-virtual": "^3.8.1"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "peerDependencies": {
-        "react": "^18 || ^19 || ^19.0.0-rc",
-        "react-dom": "^18 || ^19 || ^19.0.0-rc"
-      }
-    },
-    "node_modules/@headlessui/react/node_modules/@floating-ui/react": {
-      "version": "0.26.28",
-      "resolved": "https://registry.npmjs.org/@floating-ui/react/-/react-0.26.28.tgz",
-      "integrity": "sha512-yORQuuAtVpiRjpMhdc0wJj06b9JFjrYF4qp96j++v2NBpbi6SEGF7donUJ3TMieerQ6qVkAv1tgr7L4r5roTqw==",
-      "license": "MIT",
-      "dependencies": {
-        "@floating-ui/react-dom": "^2.1.2",
-        "@floating-ui/utils": "^0.2.8",
-        "tabbable": "^6.0.0"
-      },
-      "peerDependencies": {
-        "react": ">=16.8.0",
-        "react-dom": ">=16.8.0"
-      }
-    },
-    "node_modules/@headlessui/react/node_modules/@floating-ui/react-dom": {
-      "version": "2.1.8",
-      "resolved": "https://registry.npmjs.org/@floating-ui/react-dom/-/react-dom-2.1.8.tgz",
-      "integrity": "sha512-cC52bHwM/n/CxS87FH0yWdngEZrjdtLW/qVruo68qg+prK7ZQ4YGdut2GyDVpoGeAYe/h899rVeOVm6Oi40k2A==",
-      "license": "MIT",
-      "dependencies": {
-        "@floating-ui/dom": "^1.7.6"
-      },
-      "peerDependencies": {
-        "react": ">=16.8.0",
-        "react-dom": ">=16.8.0"
-      }
-    },
     "node_modules/@headlessui/tailwindcss": {
       "version": "0.2.2",
       "resolved": "https://registry.npmjs.org/@headlessui/tailwindcss/-/tailwindcss-0.2.2.tgz",
@@ -2141,33 +2065,6 @@
         "url": "https://opencollective.com/libvips"
       }
     },
-    "node_modules/@internationalized/date": {
-      "version": "3.12.1",
-      "resolved": "https://registry.npmjs.org/@internationalized/date/-/date-3.12.1.tgz",
-      "integrity": "sha512-6IedsVWXyq4P9Tj+TxuU8WGWM70hYLl12nbYU8jkikVpa6WXapFazPUcHUMDMoWftIDE2ILDkFFte6W2nFCkRQ==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@swc/helpers": "^0.5.0"
-      }
-    },
-    "node_modules/@internationalized/number": {
-      "version": "3.6.6",
-      "resolved": "https://registry.npmjs.org/@internationalized/number/-/number-3.6.6.tgz",
-      "integrity": "sha512-iFgmQaXHE0vytNfpLZWOC2mEJCBRzcUxt53Xf/yCXG93lRvqas237i3r7X4RKMwO3txiyZD4mQjKAByFv6UGSQ==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@swc/helpers": "^0.5.0"
-      }
-    },
-    "node_modules/@internationalized/string": {
-      "version": "3.2.8",
-      "resolved": "https://registry.npmjs.org/@internationalized/string/-/string-3.2.8.tgz",
-      "integrity": "sha512-NdbMQUSfXLYIQol5VyMtinm9pZDciiMfN7RtmSuSB78io1hqwJ0naYfxyW6vgxWBkzWymQa/3uLDlbfmshtCaA==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@swc/helpers": "^0.5.0"
-      }
-    },
     "node_modules/@istanbuljs/schema": {
       "version": "0.1.6",
       "resolved": "https://registry.npmjs.org/@istanbuljs/schema/-/schema-0.1.6.tgz",
@@ -2876,44 +2773,6 @@
         "react-dom": ">=16.9.0"
       }
     },
-    "node_modules/@react-aria/focus": {
-      "version": "3.22.0",
-      "resolved": "https://registry.npmjs.org/@react-aria/focus/-/focus-3.22.0.tgz",
-      "integrity": "sha512-ZfDOVuVhqDsM9mkNji3QUZ/d40JhlVgXrDkrfXylM1035QCrcTHN7m2DpbE95sU2A8EQb4wikvt5jM6K/73BPg==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@swc/helpers": "^0.5.0",
-        "react-aria": "3.48.0"
-      },
-      "peerDependencies": {
-        "react": "^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1",
-        "react-dom": "^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1"
-      }
-    },
-    "node_modules/@react-aria/interactions": {
-      "version": "3.28.0",
-      "resolved": "https://registry.npmjs.org/@react-aria/interactions/-/interactions-3.28.0.tgz",
-      "integrity": "sha512-OXwdU1EWFdMxmr/K1CXNGJzmNlCClByb+PuCaqUyzBymHPCGVhawirLIon/CrIN5psh3AiWpHSh4H0WeJdVpng==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@react-types/shared": "^3.34.0",
-        "@swc/helpers": "^0.5.0",
-        "react-aria": "3.48.0"
-      },
-      "peerDependencies": {
-        "react": "^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1",
-        "react-dom": "^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1"
-      }
-    },
-    "node_modules/@react-types/shared": {
-      "version": "3.34.0",
-      "resolved": "https://registry.npmjs.org/@react-types/shared/-/shared-3.34.0.tgz",
-      "integrity": "sha512-gp6xo/s2lX54AlTjOiqwDnxA7UW79BNvI9dB9pr3LZTzRKCd1ZA+ZbgKw/ReIiWuvvVw/8QFJpnqeeFyLocMcQ==",
-      "license": "Apache-2.0",
-      "peerDependencies": {
-        "react": "^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1"
-      }
-    },
     "node_modules/@redocly/ajv": {
       "version": "8.11.2",
       "resolved": "https://registry.npmjs.org/@redocly/ajv/-/ajv-8.11.2.tgz",
@@ -3839,23 +3698,6 @@
         "react-dom": ">=16.8"
       }
     },
-    "node_modules/@tanstack/react-virtual": {
-      "version": "3.13.24",
-      "resolved": "https://registry.npmjs.org/@tanstack/react-virtual/-/react-virtual-3.13.24.tgz",
-      "integrity": "sha512-aIJvz5OSkhNIhZIpYivrxrPTKYsjW9Uzy+sP/mx0S3sev2HyvPb7xmjbYvokzEpfgYHy/HjzJ2zFAETuUfgCpg==",
-      "license": "MIT",
-      "dependencies": {
-        "@tanstack/virtual-core": "3.14.0"
-      },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/tannerlinsley"
-      },
-      "peerDependencies": {
-        "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
-        "react-dom": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0"
-      }
-    },
     "node_modules/@tanstack/store": {
       "version": "0.11.0",
       "resolved": "https://registry.npmjs.org/@tanstack/store/-/store-0.11.0.tgz",
@@ -3879,16 +3721,6 @@
         "url": "https://github.com/sponsors/tannerlinsley"
       }
     },
-    "node_modules/@tanstack/virtual-core": {
-      "version": "3.14.0",
-      "resolved": "https://registry.npmjs.org/@tanstack/virtual-core/-/virtual-core-3.14.0.tgz",
-      "integrity": "sha512-JLANqGy/D6k4Ujmh8Tr25lGimuOXNiaVyXaCAZS0W+1390sADdGnyUdSWNIfd49gebtIxGMij4IktRVzrdr12Q==",
-      "license": "MIT",
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/tannerlinsley"
-      }
-    },
     "node_modules/@testing-library/dom": {
       "version": "10.4.1",
       "resolved": "https://registry.npmjs.org/@testing-library/dom/-/dom-10.4.1.tgz",
@@ -3978,93 +3810,6 @@
         "@testing-library/dom": ">=7.21.4"
       }
     },
-    "node_modules/@tremor/react": {
-      "version": "3.18.7",
-      "resolved": "https://registry.npmjs.org/@tremor/react/-/react-3.18.7.tgz",
-      "integrity": "sha512-nmqvf/1m0GB4LXc7v2ftdfSLoZhy5WLrhV6HNf0SOriE6/l8WkYeWuhQq8QsBjRi94mUIKLJ/VC3/Y/pj6VubQ==",
-      "license": "Apache 2.0",
-      "dependencies": {
-        "@floating-ui/react": "^0.19.2",
-        "@headlessui/react": "2.2.0",
-        "date-fns": "^3.6.0",
-        "react-day-picker": "^8.10.1",
-        "react-transition-state": "^2.1.2",
-        "recharts": "^2.13.3",
-        "tailwind-merge": "^2.5.2"
-      },
-      "peerDependencies": {
-        "react": "^18.0.0",
-        "react-dom": ">=16.6.0"
-      }
-    },
-    "node_modules/@tremor/react/node_modules/eventemitter3": {
-      "version": "4.0.7",
-      "resolved": "https://registry.npmjs.org/eventemitter3/-/eventemitter3-4.0.7.tgz",
-      "integrity": "sha512-8guHBZCwKnFhYdHr2ysuRWErTwhoN2X8XELRlrRwpmfeY2jjuUN4taQMsULKUVo1K4DvZl+0pgfyoysHxvmvEw==",
-      "license": "MIT"
-    },
-    "node_modules/@tremor/react/node_modules/react-is": {
-      "version": "18.3.1",
-      "resolved": "https://registry.npmjs.org/react-is/-/react-is-18.3.1.tgz",
-      "integrity": "sha512-/LLMVyas0ljjAtoYiPqYiL8VWXzUUdThrmU5+n20DZv+a+ClRoevUzw5JxU+Ieh5/c87ytoTBV9G1FiKfNJdmg==",
-      "license": "MIT"
-    },
-    "node_modules/@tremor/react/node_modules/recharts": {
-      "version": "2.15.4",
-      "resolved": "https://registry.npmjs.org/recharts/-/recharts-2.15.4.tgz",
-      "integrity": "sha512-UT/q6fwS3c1dHbXv2uFgYJ9BMFHu3fwnd7AYZaEQhXuYQ4hgsxLvsUXzGdKeZrW5xopzDCvuA2N41WJ88I7zIw==",
-      "deprecated": "1.x and 2.x branches are no longer active. Bump to Recharts v3 to receive latest features and bugfixes. See https://github.com/recharts/recharts/wiki/3.0-migration-guide",
-      "license": "MIT",
-      "dependencies": {
-        "clsx": "^2.0.0",
-        "eventemitter3": "^4.0.1",
-        "lodash": "^4.17.21",
-        "react-is": "^18.3.1",
-        "react-smooth": "^4.0.4",
-        "recharts-scale": "^0.4.4",
-        "tiny-invariant": "^1.3.1",
-        "victory-vendor": "^36.6.8"
-      },
-      "engines": {
-        "node": ">=14"
-      },
-      "peerDependencies": {
-        "react": "^16.0.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
-        "react-dom": "^16.0.0 || ^17.0.0 || ^18.0.0 || ^19.0.0"
-      }
-    },
-    "node_modules/@tremor/react/node_modules/tailwind-merge": {
-      "version": "2.6.1",
-      "resolved": "https://registry.npmjs.org/tailwind-merge/-/tailwind-merge-2.6.1.tgz",
-      "integrity": "sha512-Oo6tHdpZsGpkKG88HJ8RR1rg/RdnEkQEfMoEk2x1XRI3F1AxeU+ijRXpiVUF4UbLfcxxRGw6TbUINKYdWVsQTQ==",
-      "license": "MIT",
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/dcastil"
-      }
-    },
-    "node_modules/@tremor/react/node_modules/victory-vendor": {
-      "version": "36.9.2",
-      "resolved": "https://registry.npmjs.org/victory-vendor/-/victory-vendor-36.9.2.tgz",
-      "integrity": "sha512-PnpQQMuxlwYdocC8fIJqVXvkeViHYzotI+NJrCuav0ZYFoq912ZHBk3mCeuj+5/VpodOjPe1z0Fk2ihgzlXqjQ==",
-      "license": "MIT AND ISC",
-      "dependencies": {
-        "@types/d3-array": "^3.0.3",
-        "@types/d3-ease": "^3.0.0",
-        "@types/d3-interpolate": "^3.0.1",
-        "@types/d3-scale": "^4.0.2",
-        "@types/d3-shape": "^3.1.0",
-        "@types/d3-time": "^3.0.0",
-        "@types/d3-timer": "^3.0.0",
-        "d3-array": "^3.1.6",
-        "d3-ease": "^3.0.1",
-        "d3-interpolate": "^3.0.1",
-        "d3-scale": "^4.0.2",
-        "d3-shape": "^3.1.0",
-        "d3-time": "^3.0.0",
-        "d3-timer": "^3.0.1"
-      }
-    },
     "node_modules/@tybys/wasm-util": {
       "version": "0.10.3",
       "resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.3.tgz",
@@ -5203,18 +4948,6 @@
       "dev": true,
       "license": "Python-2.0"
     },
-    "node_modules/aria-hidden": {
-      "version": "1.2.6",
-      "resolved": "https://registry.npmjs.org/aria-hidden/-/aria-hidden-1.2.6.tgz",
-      "integrity": "sha512-ik3ZgC9dY/lYVVM++OISsaYDeg1tb0VtP5uL3ouh1koGOaUMDPpbFIei4JkFimWUFPn90sbMNMXQAIVOlnYKJA==",
-      "license": "MIT",
-      "dependencies": {
-        "tslib": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
     "node_modules/aria-query": {
       "version": "5.3.0",
       "resolved": "https://registry.npmjs.org/aria-query/-/aria-query-5.3.0.tgz",
@@ -6314,16 +6047,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/dom-helpers": {
-      "version": "5.2.1",
-      "resolved": "https://registry.npmjs.org/dom-helpers/-/dom-helpers-5.2.1.tgz",
-      "integrity": "sha512-nRCa7CK3VTrM2NmGkIy4cbK7IZlgBE/PYMn55rrXefr5xXDP0LdtfPnblFDoVdcAfslJ7or6iqAUnx0CCGIWQA==",
-      "license": "MIT",
-      "dependencies": {
-        "@babel/runtime": "^7.8.7",
-        "csstype": "^3.0.2"
-      }
-    },
     "node_modules/dunder-proto": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz",
@@ -7201,15 +6924,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/fast-equals": {
-      "version": "5.4.1",
-      "resolved": "https://registry.npmjs.org/fast-equals/-/fast-equals-5.4.1.tgz",
-      "integrity": "sha512-DjlFSM5Pk9cGcL0q5QXl66eGzx0N6szNgaswwc5ZphlBohjTVJSnGgI+rJVOgOi65qUoQnDZN4nDqi33udtydQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=6.0.0"
-      }
-    },
     "node_modules/fast-glob": {
       "version": "3.3.1",
       "resolved": "https://registry.npmjs.org/fast-glob/-/fast-glob-3.3.1.tgz",
@@ -9229,12 +8943,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/lodash": {
-      "version": "4.18.1",
-      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.18.1.tgz",
-      "integrity": "sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==",
-      "license": "MIT"
-    },
     "node_modules/lodash.merge": {
       "version": "4.6.2",
       "resolved": "https://registry.npmjs.org/lodash.merge/-/lodash.merge-4.6.2.tgz",
@@ -11868,27 +11576,6 @@
         "node": ">=0.10.0"
       }
     },
-    "node_modules/react-aria": {
-      "version": "3.48.0",
-      "resolved": "https://registry.npmjs.org/react-aria/-/react-aria-3.48.0.tgz",
-      "integrity": "sha512-jQjd4rBEIMqecBaAKYJbVGK6EqIHLa5znVQ7jwFyK5vCyljoj6KhgtiahmcIPsG5vG5vEDLw+ba+bEWn6A2P4w==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@internationalized/date": "^3.12.1",
-        "@internationalized/number": "^3.6.6",
-        "@internationalized/string": "^3.2.8",
-        "@react-types/shared": "^3.34.0",
-        "@swc/helpers": "^0.5.0",
-        "aria-hidden": "^1.2.3",
-        "clsx": "^2.0.0",
-        "react-stately": "3.46.0",
-        "use-sync-external-store": "^1.6.0"
-      },
-      "peerDependencies": {
-        "react": "^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1",
-        "react-dom": "^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1"
-      }
-    },
     "node_modules/react-copy-to-clipboard": {
       "version": "5.1.1",
       "resolved": "https://registry.npmjs.org/react-copy-to-clipboard/-/react-copy-to-clipboard-5.1.1.tgz",
@@ -11902,20 +11589,6 @@
         "react": ">=15.3.0"
       }
     },
-    "node_modules/react-day-picker": {
-      "version": "8.10.2",
-      "resolved": "https://registry.npmjs.org/react-day-picker/-/react-day-picker-8.10.2.tgz",
-      "integrity": "sha512-LK68OTbHB3oJNhl9cA0qVizzp3o26w61YSjAFkYi67N86iro32wx86kSNeFU/hq+gI8m1yzWhnomMLfZ041RzQ==",
-      "license": "MIT",
-      "funding": {
-        "type": "individual",
-        "url": "https://github.com/sponsors/gpbl"
-      },
-      "peerDependencies": {
-        "date-fns": "^2.28.0 || ^3.0.0",
-        "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0"
-      }
-    },
     "node_modules/react-dom": {
       "version": "18.3.1",
       "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-18.3.1.tgz",
@@ -12013,38 +11686,6 @@
         }
       }
     },
-    "node_modules/react-smooth": {
-      "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/react-smooth/-/react-smooth-4.0.4.tgz",
-      "integrity": "sha512-gnGKTpYwqL0Iii09gHobNolvX4Kiq4PKx6eWBCYYix+8cdw+cGo3do906l1NBPKkSWx1DghC1dlWG9L2uGd61Q==",
-      "license": "MIT",
-      "dependencies": {
-        "fast-equals": "^5.0.1",
-        "prop-types": "^15.8.1",
-        "react-transition-group": "^4.4.5"
-      },
-      "peerDependencies": {
-        "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0",
-        "react-dom": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0"
-      }
-    },
-    "node_modules/react-stately": {
-      "version": "3.46.0",
-      "resolved": "https://registry.npmjs.org/react-stately/-/react-stately-3.46.0.tgz",
-      "integrity": "sha512-OdxhWvHgs2L4OJGIs7hnuTr5WjjMM6enhNEAMRqiekhF8+ITvA2LRwNftOZwcogaoCslGYq5S2VQTQwnm0GbCA==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@internationalized/date": "^3.12.1",
-        "@internationalized/number": "^3.6.6",
-        "@internationalized/string": "^3.2.8",
-        "@react-types/shared": "^3.34.0",
-        "@swc/helpers": "^0.5.0",
-        "use-sync-external-store": "^1.6.0"
-      },
-      "peerDependencies": {
-        "react": "^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1"
-      }
-    },
     "node_modules/react-syntax-highlighter": {
       "version": "15.6.6",
       "resolved": "https://registry.npmjs.org/react-syntax-highlighter/-/react-syntax-highlighter-15.6.6.tgz",
@@ -12062,32 +11703,6 @@
         "react": ">= 0.14.0"
       }
     },
-    "node_modules/react-transition-group": {
-      "version": "4.4.5",
-      "resolved": "https://registry.npmjs.org/react-transition-group/-/react-transition-group-4.4.5.tgz",
-      "integrity": "sha512-pZcd1MCJoiKiBR2NRxeCRg13uCXbydPnmB4EOeRrY7480qNWO8IIgQG6zlDkm6uRMsURXPuKq0GWtiM59a5Q6g==",
-      "license": "BSD-3-Clause",
-      "dependencies": {
-        "@babel/runtime": "^7.5.5",
-        "dom-helpers": "^5.0.1",
-        "loose-envify": "^1.4.0",
-        "prop-types": "^15.6.2"
-      },
-      "peerDependencies": {
-        "react": ">=16.6.0",
-        "react-dom": ">=16.6.0"
-      }
-    },
-    "node_modules/react-transition-state": {
-      "version": "2.3.3",
-      "resolved": "https://registry.npmjs.org/react-transition-state/-/react-transition-state-2.3.3.tgz",
-      "integrity": "sha512-wsIyg07ohlWEAYDZHvuXh/DY7mxlcLb0iqVv2aMXJ0gwgPVKNWKhOyNyzuJy/tt/6urSq0WT6BBZ/tdpybaAsQ==",
-      "license": "MIT",
-      "peerDependencies": {
-        "react": ">=16.8.0",
-        "react-dom": ">=16.8.0"
-      }
-    },
     "node_modules/recharts": {
       "version": "3.9.2",
       "resolved": "https://registry.npmjs.org/recharts/-/recharts-3.9.2.tgz",
@@ -12118,15 +11733,6 @@
         "react-is": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0"
       }
     },
-    "node_modules/recharts-scale": {
-      "version": "0.4.5",
-      "resolved": "https://registry.npmjs.org/recharts-scale/-/recharts-scale-0.4.5.tgz",
-      "integrity": "sha512-kivNFO+0OcUNu7jQquLXAxz1FIwZj8nrj+YkOKc5694NbjCvcT6aSZiIzNzd2Kul4o4rTto8QVR9lMNtxD4G1w==",
-      "license": "MIT",
-      "dependencies": {
-        "decimal.js-light": "^2.4.1"
-      }
-    },
     "node_modules/redent": {
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/redent/-/redent-3.0.0.tgz",
@@ -13200,12 +12806,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/tabbable": {
-      "version": "6.4.0",
-      "resolved": "https://registry.npmjs.org/tabbable/-/tabbable-6.4.0.tgz",
-      "integrity": "sha512-05PUHKSNE8ou2dwIxTngl4EzcnsCDZGJ/iCLtDflR/SHB/ny14rXc+qU5P4mG9JkusiV7EivzY9Mhm55AzAvCg==",
-      "license": "MIT"
-    },
     "node_modules/tailwind-merge": {
       "version": "3.4.0",
       "resolved": "https://registry.npmjs.org/tailwind-merge/-/tailwind-merge-3.4.0.tgz",
diff --git a/ui/litellm-dashboard/package.json b/ui/litellm-dashboard/package.json
index 483ab39c336..9407ff25a1f 100644
--- a/ui/litellm-dashboard/package.json
+++ b/ui/litellm-dashboard/package.json
@@ -31,7 +31,6 @@
     "@tanstack/react-pacer": "0.22.1",
     "@tanstack/react-query": "5.100.7",
     "@tanstack/react-table": "8.21.3",
-    "@tremor/react": "3.18.7",
     "@types/papaparse": "5.5.2",
     "antd": "5.29.3",
     "cva": "1.0.0-beta.4",
@@ -103,7 +102,6 @@
     "axios": "1.13.6",
     "postcss": "8.5.23",
     "esbuild": "0.28.1",
-    "date-fns": "^4.4.0",
     "sharp": "^0.35.0"
   },
   "engines": {
diff --git a/ui/litellm-dashboard/src/app/(dashboard)/guardrails/_components/content_filter/TagsInput.tsx b/ui/litellm-dashboard/src/app/(dashboard)/guardrails/_components/content_filter/TagsInput.tsx
index 0d799474399..6fb1508497e 100644
--- a/ui/litellm-dashboard/src/app/(dashboard)/guardrails/_components/content_filter/TagsInput.tsx
+++ b/ui/litellm-dashboard/src/app/(dashboard)/guardrails/_components/content_filter/TagsInput.tsx
@@ -28,6 +28,7 @@ interface TagsInputProps {
   emptyText?: string;
   tokenSeparators?: string[];
   loading?: boolean;
+  disabled?: boolean;
   id?: string;
 }
 
@@ -48,6 +49,7 @@ export const TagsInput = ({
   emptyText = "No matching options",
   tokenSeparators = [],
   loading = false,
+  disabled = false,
   id,
 }: TagsInputProps) => {
   const anchor = useComboboxAnchor();
@@ -103,6 +105,7 @@ export const TagsInput = ({
       itemToStringLabel={(option: TagsInputOption) => option.label}
       filter={matchesQuery}
       openOnInputClick
+      disabled={disabled || loading}
     >
       <ComboboxChips render={<div ref={anchor} />} className="min-h-8 py-1 text-sm">
         <ComboboxValue>
diff --git a/ui/litellm-dashboard/src/app/(dashboard)/guardrails/_components/guardrail_info.test.tsx b/ui/litellm-dashboard/src/app/(dashboard)/guardrails/_components/guardrail_info.test.tsx
index 320e0b5baef..b6ee130d50a 100644
--- a/ui/litellm-dashboard/src/app/(dashboard)/guardrails/_components/guardrail_info.test.tsx
+++ b/ui/litellm-dashboard/src/app/(dashboard)/guardrails/_components/guardrail_info.test.tsx
@@ -1,5 +1,6 @@
 import * as networking from "@/components/networking";
 import { fireEvent, render, waitFor, within } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
 import { afterEach, describe, expect, it, vi } from "vitest";
 import GuardrailInfoView from "./guardrail_info";
 
@@ -136,7 +137,7 @@ describe("Guardrail Info", () => {
 
     vi.mocked(networking.getGuardrailProviderSpecificParams).mockResolvedValue({});
 
-    const { getByText, container } = render(
+    const { getByText, findByText, container } = render(
       <GuardrailInfoView guardrailId="123" onClose={() => {}} accessToken="123" isAdmin={true} />,
     );
 
@@ -152,18 +153,9 @@ describe("Guardrail Info", () => {
       expect(getByText("Guardrail Settings")).toBeInTheDocument();
     });
 
-    // Find the info icon and hover over it
-    const infoIcon = within(container).getByRole("img", { name: "info-circle" });
-    expect(infoIcon).toBeInTheDocument();
+    await userEvent.hover(within(container).getByRole("img", { name: "info-circle" }));
 
-    if (infoIcon) {
-      fireEvent.mouseEnter(infoIcon);
-
-      // Wait for the tooltip to appear
-      await waitFor(() => {
-        expect(getByText("Guardrail is defined in the config file and cannot be edited.")).toBeInTheDocument();
-      });
-    }
+    expect(await findByText("Guardrail is defined in the config file and cannot be edited.")).toBeInTheDocument();
   });
 
   it("should render the guardrail info", async () => {
diff --git a/ui/litellm-dashboard/src/app/(dashboard)/guardrails/_components/guardrail_info.tsx b/ui/litellm-dashboard/src/app/(dashboard)/guardrails/_components/guardrail_info.tsx
index caac09a1c83..e80ddac932f 100644
--- a/ui/litellm-dashboard/src/app/(dashboard)/guardrails/_components/guardrail_info.tsx
+++ b/ui/litellm-dashboard/src/app/(dashboard)/guardrails/_components/guardrail_info.tsx
@@ -6,7 +6,8 @@ import {
 } from "@/components/networking";
 import { copyToClipboard as utilCopyToClipboard } from "@/utils/dataUtils";
 import { CodeOutlined, EyeInvisibleOutlined, InfoCircleOutlined, StopOutlined } from "@ant-design/icons";
-import { Button as AntdButton, Tooltip } from "antd";
+
+import { Button as AntdButton } from "antd";
 import { ArrowLeft, CheckIcon, CopyIcon } from "lucide-react";
 import { Badge } from "@/components/ui/badge";
 import { Card } from "@/components/ui/card";
@@ -21,7 +22,7 @@ import { Input } from "@/components/ui/input";
 import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from "@/components/ui/select";
 import { Separator } from "@/components/ui/separator";
 import { Textarea } from "@/components/ui/textarea";
-import { TooltipProvider } from "@/components/ui/tooltip";
+import { SimpleTooltip, TooltipProvider } from "@/components/ui/tooltip";
 import {
   asText,
   GuardrailField,
@@ -663,9 +664,9 @@ const GuardrailInfoView: React.FC<GuardrailInfoProps> = ({ guardrailId, onClose,
                 <div className="flex justify-between items-center mb-4">
                   <h3 className="text-lg font-medium">Guardrail Settings</h3>
                   {isConfigGuardrail && (
-                    <Tooltip title="Guardrail is defined in the config file and cannot be edited.">
+                    <SimpleTooltip content="Guardrail is defined in the config file and cannot be edited.">
                       <InfoCircleOutlined />
-                    </Tooltip>
+                    </SimpleTooltip>
                   )}
                   {!isEditing &&
                     !isConfigGuardrail &&
diff --git a/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/AwsSigV4Fields.tsx b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/AwsSigV4Fields.tsx
index d4ae537bffa..09016bda266 100644
--- a/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/AwsSigV4Fields.tsx
+++ b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/AwsSigV4Fields.tsx
@@ -1,7 +1,25 @@
 import React from "react";
-import { Form, Input, Tooltip } from "antd";
+import { Input, Tooltip } from "antd";
 import { InfoCircleOutlined } from "@ant-design/icons";
 
+import { MountedFormField } from "@/components/common_components/MountedFormField";
+import { antdRequired } from "@/components/common_components/antdFormRules";
+import { requiredWhenSiblingSet, textControl } from "./mcpFieldRules";
+
+const fieldClassName = "rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500";
+
+const FieldLabel: React.FC<{ label: string; tooltip: string }> = ({ label, tooltip }) => (
+  <span className="text-sm font-medium text-gray-700 flex items-center">
+    {label}
+    <Tooltip title={tooltip}>
+      <InfoCircleOutlined className="ml-2 text-blue-400 hover:text-blue-600 cursor-help" />
+    </Tooltip>
+  </span>
+);
+
+const ACCESS_KEY_PATH = ["credentials", "aws_access_key_id"] as const;
+const SECRET_KEY_PATH = ["credentials", "aws_secret_access_key"] as const;
+
 const AwsSigV4Fields: React.FC = () => (
   <>
     <p className="text-sm text-gray-500 mb-2">
@@ -15,140 +33,120 @@ const AwsSigV4Fields: React.FC = () => (
         View docs &rarr;
       </a>
     </p>
-    <Form.Item
-      label={
-        <span className="text-sm font-medium text-gray-700 flex items-center">
-          AWS Region
-          <Tooltip title="AWS region for SigV4 signing (e.g., us-east-1)">
-            <InfoCircleOutlined className="ml-2 text-blue-400 hover:text-blue-600 cursor-help" />
-          </Tooltip>
-        </span>
-      }
+    <MountedFormField
+      label={<FieldLabel label="AWS Region" tooltip="AWS region for SigV4 signing (e.g., us-east-1)" />}
       name={["credentials", "aws_region_name"]}
-      rules={[{ required: true, message: "AWS region is required for SigV4 auth" }]}
+      required
+      rules={{ validate: { required: antdRequired("AWS region is required for SigV4 auth") } }}
     >
-      <Input placeholder="us-east-1" className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500" />
-    </Form.Item>
-    <Form.Item
+      {(control) => <Input {...textControl(control)} placeholder="us-east-1" className={fieldClassName} />}
+    </MountedFormField>
+    <MountedFormField
       label={
-        <span className="text-sm font-medium text-gray-700 flex items-center">
-          AWS Service Name
-          <Tooltip title="AWS service name for SigV4 signing. Defaults to 'bedrock-agentcore'.">
-            <InfoCircleOutlined className="ml-2 text-blue-400 hover:text-blue-600 cursor-help" />
-          </Tooltip>
-        </span>
+        <FieldLabel
+          label="AWS Service Name"
+          tooltip="AWS service name for SigV4 signing. Defaults to 'bedrock-agentcore'."
+        />
       }
       name={["credentials", "aws_service_name"]}
     >
-      <Input
-        placeholder="bedrock-agentcore"
-        className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500"
-      />
-    </Form.Item>
-    <Form.Item
+      {(control) => <Input {...textControl(control)} placeholder="bedrock-agentcore" className={fieldClassName} />}
+    </MountedFormField>
+    <MountedFormField
       label={
-        <span className="text-sm font-medium text-gray-700 flex items-center">
-          AWS Access Key ID
-          <Tooltip title="Optional. If not provided, falls back to the boto3 credential chain (IAM role, env vars, etc.).">
-            <InfoCircleOutlined className="ml-2 text-blue-400 hover:text-blue-600 cursor-help" />
-          </Tooltip>
-        </span>
+        <FieldLabel
+          label="AWS Access Key ID"
+          tooltip="Optional. If not provided, falls back to the boto3 credential chain (IAM role, env vars, etc.)."
+        />
       }
-      name={["credentials", "aws_access_key_id"]}
-      dependencies={[["credentials", "aws_secret_access_key"]]}
-      rules={[
-        ({ getFieldValue }) => ({
-          validator(_, value) {
-            const secretKey = getFieldValue(["credentials", "aws_secret_access_key"]);
-            if (secretKey && !value) {
-              return Promise.reject(new Error("Access Key ID is required when Secret Access Key is provided"));
-            }
-            return Promise.resolve();
-          },
-        }),
-      ]}
+      name={ACCESS_KEY_PATH}
+      rules={{
+        deps: ["credentials.aws_secret_access_key"],
+        validate: {
+          pairedWithSecret: requiredWhenSiblingSet(
+            SECRET_KEY_PATH,
+            "Access Key ID is required when Secret Access Key is provided",
+          ),
+        },
+      }}
     >
-      <Input.Password
-        placeholder="AKIA... (optional — uses IAM role if blank)"
-        className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500"
-      />
-    </Form.Item>
-    <Form.Item
+      {(control) => (
+        <Input.Password
+          {...textControl(control)}
+          placeholder="AKIA... (optional — uses IAM role if blank)"
+          className={fieldClassName}
+        />
+      )}
+    </MountedFormField>
+    <MountedFormField
       label={
-        <span className="text-sm font-medium text-gray-700 flex items-center">
-          AWS Secret Access Key
-          <Tooltip title="Optional. Required if AWS Access Key ID is provided.">
-            <InfoCircleOutlined className="ml-2 text-blue-400 hover:text-blue-600 cursor-help" />
-          </Tooltip>
-        </span>
+        <FieldLabel label="AWS Secret Access Key" tooltip="Optional. Required if AWS Access Key ID is provided." />
       }
-      name={["credentials", "aws_secret_access_key"]}
-      dependencies={[["credentials", "aws_access_key_id"]]}
-      rules={[
-        ({ getFieldValue }) => ({
-          validator(_, value) {
-            const accessKeyId = getFieldValue(["credentials", "aws_access_key_id"]);
-            if (accessKeyId && !value) {
-              return Promise.reject(new Error("Secret Access Key is required when Access Key ID is provided"));
-            }
-            return Promise.resolve();
-          },
-        }),
-      ]}
+      name={SECRET_KEY_PATH}
+      rules={{
+        deps: ["credentials.aws_access_key_id"],
+        validate: {
+          pairedWithAccessKey: requiredWhenSiblingSet(
+            ACCESS_KEY_PATH,
+            "Secret Access Key is required when Access Key ID is provided",
+          ),
+        },
+      }}
     >
-      <Input.Password
-        placeholder="Enter secret key (optional — uses IAM role if blank)"
-        className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500"
-      />
-    </Form.Item>
-    <Form.Item
-      label={
-        <span className="text-sm font-medium text-gray-700 flex items-center">
-          AWS Session Token
-          <Tooltip title="Optional. Only needed for temporary STS credentials.">
-            <InfoCircleOutlined className="ml-2 text-blue-400 hover:text-blue-600 cursor-help" />
-          </Tooltip>
-        </span>
-      }
+      {(control) => (
+        <Input.Password
+          {...textControl(control)}
+          placeholder="Enter secret key (optional — uses IAM role if blank)"
+          className={fieldClassName}
+        />
+      )}
+    </MountedFormField>
+    <MountedFormField
+      label={<FieldLabel label="AWS Session Token" tooltip="Optional. Only needed for temporary STS credentials." />}
       name={["credentials", "aws_session_token"]}
     >
-      <Input.Password
-        placeholder="Enter session token (optional)"
-        className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500"
-      />
-    </Form.Item>
-    <Form.Item
+      {(control) => (
+        <Input.Password
+          {...textControl(control)}
+          placeholder="Enter session token (optional)"
+          className={fieldClassName}
+        />
+      )}
+    </MountedFormField>
+    <MountedFormField
       label={
-        <span className="text-sm font-medium text-gray-700 flex items-center">
-          AWS Role ARN
-          <Tooltip title="Optional. IAM role ARN to assume via STS before signing. If set, LiteLLM calls sts:AssumeRole to get temporary credentials. Uses ambient credentials (IAM role, env vars) as the source identity unless explicit keys are also provided.">
-            <InfoCircleOutlined className="ml-2 text-blue-400 hover:text-blue-600 cursor-help" />
-          </Tooltip>
-        </span>
+        <FieldLabel
+          label="AWS Role ARN"
+          tooltip="Optional. IAM role ARN to assume via STS before signing. If set, LiteLLM calls sts:AssumeRole to get temporary credentials. Uses ambient credentials (IAM role, env vars) as the source identity unless explicit keys are also provided."
+        />
       }
       name={["credentials", "aws_role_name"]}
     >
-      <Input
-        placeholder="arn:aws:iam::123456789012:role/MyRole (optional)"
-        className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500"
-      />
-    </Form.Item>
-    <Form.Item
+      {(control) => (
+        <Input
+          {...textControl(control)}
+          placeholder="arn:aws:iam::123456789012:role/MyRole (optional)"
+          className={fieldClassName}
+        />
+      )}
+    </MountedFormField>
+    <MountedFormField
       label={
-        <span className="text-sm font-medium text-gray-700 flex items-center">
-          AWS Session Name
-          <Tooltip title="Optional. Session name for the AssumeRole call — appears in CloudTrail logs. Auto-generated if omitted.">
-            <InfoCircleOutlined className="ml-2 text-blue-400 hover:text-blue-600 cursor-help" />
-          </Tooltip>
-        </span>
+        <FieldLabel
+          label="AWS Session Name"
+          tooltip="Optional. Session name for the AssumeRole call — appears in CloudTrail logs. Auto-generated if omitted."
+        />
       }
       name={["credentials", "aws_session_name"]}
     >
-      <Input
-        placeholder="litellm-prod (optional, auto-generated if blank)"
-        className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500"
-      />
-    </Form.Item>
+      {(control) => (
+        <Input
+          {...textControl(control)}
+          placeholder="litellm-prod (optional, auto-generated if blank)"
+          className={fieldClassName}
+        />
+      )}
+    </MountedFormField>
   </>
 );
 
diff --git a/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/CreateMCPServer.integration.test.tsx b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/CreateMCPServer.integration.test.tsx
index f08aacb5522..78d89b7e19e 100644
--- a/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/CreateMCPServer.integration.test.tsx
+++ b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/CreateMCPServer.integration.test.tsx
@@ -2147,7 +2147,7 @@ describe("CreateMCPServer dcr_bridge toggle", () => {
   });
 
   // Forcing dcr_bridge false for every non-client-forwarded auth type is covered in
-  // createServerPayload.test.ts. The two form-state cases below stay: they prove the Form.Item
+  // createServerPayload.test.ts. The two form-state cases below stay: they prove the field
   // unmounts on a switch away, and that the live value survives a client-forwarded swap.
 
   it("forces dcr_bridge: false when the auth type is switched away after toggling", async () => {
@@ -2179,7 +2179,7 @@ describe("CreateMCPServer dcr_bridge toggle", () => {
     });
     expect(getDcrToggle()).toHaveAttribute("aria-checked", "true");
 
-    // The Form.Item is mounted in both client-forwarded modes, so switching between them keeps the
+    // The field is mounted in both client-forwarded modes, so switching between them keeps the
     // live toggle value rather than forcing it back to the default or to false.
     await selectAntOption("Authentication", "OAuth Delegate (client-supplied upstream token)");
     await waitFor(() => {
diff --git a/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/CreateMCPServer.permissions.integration.test.tsx b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/CreateMCPServer.permissions.integration.test.tsx
new file mode 100644
index 00000000000..788be106d8a
--- /dev/null
+++ b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/CreateMCPServer.permissions.integration.test.tsx
@@ -0,0 +1,160 @@
+import { act, fireEvent, render, screen, waitFor } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import * as networking from "@/components/networking";
+import CreateMCPServer from "./CreateMCPServer";
+import { selectAntOption } from "./testUtils";
+
+vi.mock("@/components/networking", () => ({
+  createMCPServer: vi.fn(),
+  fetchOpenAPIRegistry: vi.fn().mockResolvedValue({ apis: [] }),
+  registerMCPServer: vi.fn(),
+  storeMCPOAuthUserCredential: vi.fn().mockResolvedValue({}),
+  testMCPToolsListRequest: vi.fn().mockResolvedValue({ tools: [], error: null }),
+}));
+
+vi.mock("@/utils/mcpTokenStore", () => ({
+  setToken: vi.fn(),
+}));
+
+vi.mock("./OpenAPIQuickPicker", () => ({
+  default: () => null,
+}));
+
+vi.mock("@/hooks/useMcpOAuthFlow", () => ({
+  useMcpOAuthFlow: () => ({
+    startOAuthFlow: vi.fn(),
+    status: "idle",
+    error: null,
+    tokenResponse: null,
+    reset: vi.fn(),
+  }),
+}));
+
+vi.mock("./mcp_server_cost_config", () => ({
+  default: () => <div data-testid="mcp-cost-config" />,
+}));
+
+vi.mock("./mcp_tool_configuration", () => ({
+  default: () => <div data-testid="mcp-tool-config" />,
+}));
+
+vi.mock("./mcp_connection_status", () => ({
+  default: () => <div data-testid="mcp-connection-status" />,
+}));
+
+vi.mock("./StdioConfiguration", () => ({
+  default: () => <div data-testid="stdio-config" />,
+}));
+
+const defaultProps = {
+  userRole: "Admin",
+  accessToken: "test-token",
+  onCreateSuccess: vi.fn(),
+  isModalVisible: true,
+  setModalVisible: vi.fn(),
+  availableAccessGroups: ["group-a", "group-b"],
+};
+
+const getServerNameInput = () => document.getElementById("server_name") as HTMLInputElement;
+
+const switchFor = (labelText: string): HTMLElement => {
+  const label = screen.getByText(labelText);
+  const row = label.closest(".flex.items-start.justify-between");
+  const control = row?.querySelector("button[role='switch']");
+  if (control === null || control === undefined) {
+    throw new Error(`no switch found for "${labelText}"`);
+  }
+  return control as HTMLElement;
+};
+
+const fillMinimalHttpServer = async (name: string) => {
+  await selectAntOption("Transport Type", "Streamable HTTP");
+  await waitFor(() => {
+    expect(screen.getByPlaceholderText("https://your-mcp-server.com")).toBeInTheDocument();
+  });
+  const user = userEvent.setup({ delay: null });
+  await user.type(getServerNameInput(), name);
+  await user.type(screen.getByPlaceholderText("https://your-mcp-server.com"), "https://example.com/mcp");
+  await selectAntOption("Authentication", "None");
+};
+
+const submitAndReadPayload = async () => {
+  await act(async () => {
+    fireEvent.click(screen.getByRole("button", { name: "Add MCP Server" }));
+  });
+  await waitFor(() => expect(networking.createMCPServer).toHaveBeenCalledTimes(1));
+  return vi.mocked(networking.createMCPServer).mock.calls[0][1];
+};
+
+const createdServer = {
+  server_id: "new-server-1",
+  server_name: "Perm_Server",
+  alias: "Perm_Server",
+  url: "https://example.com/mcp",
+  transport: "http",
+  auth_type: "none",
+  created_at: "2024-01-01T00:00:00Z",
+  created_by: "user-1",
+  updated_at: "2024-01-01T00:00:00Z",
+  updated_by: "user-1",
+};
+
+describe("CreateMCPServer permission toggles reaching the payload", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    vi.mocked(networking.createMCPServer).mockResolvedValue(createdServer);
+  });
+
+  it("sends the panel's untouched defaults rather than dropping the keys the panel owns", async () => {
+    render(<CreateMCPServer {...defaultProps} />);
+    await fillMinimalHttpServer("Perm_Server");
+
+    const payload = await submitAndReadPayload();
+
+    expect(payload.allow_all_keys).toBe(false);
+    expect(payload.available_on_public_internet).toBe(true);
+  });
+
+  it("sends allow_all_keys true once the operator turns the public-to-all-keys switch on", async () => {
+    render(<CreateMCPServer {...defaultProps} />);
+    await fillMinimalHttpServer("Perm_Server");
+
+    await act(async () => {
+      fireEvent.click(switchFor("Allow All LiteLLM Keys"));
+    });
+
+    const payload = await submitAndReadPayload();
+
+    expect(payload.allow_all_keys).toBe(true);
+  });
+
+  it("sends available_on_public_internet false when the operator restricts the server to the internal network", async () => {
+    render(<CreateMCPServer {...defaultProps} />);
+    await fillMinimalHttpServer("Perm_Server");
+
+    const internalOnly = switchFor("Internal network only");
+    expect(internalOnly).toHaveAttribute("aria-checked", "false");
+
+    await act(async () => {
+      fireEvent.click(internalOnly);
+    });
+    expect(internalOnly).toHaveAttribute("aria-checked", "true");
+
+    const payload = await submitAndReadPayload();
+
+    expect(payload.available_on_public_internet).toBe(false);
+  });
+
+  it("omits delegate_auth_to_upstream's true value on a none-auth server, whose gate never mounts that switch", async () => {
+    render(<CreateMCPServer {...defaultProps} />);
+    await fillMinimalHttpServer("Perm_Server");
+
+    expect(screen.getByText("Allow All LiteLLM Keys")).toBeInTheDocument();
+    expect(screen.queryByText("Delegate auth to upstream (PKCE passthrough)")).not.toBeInTheDocument();
+
+    const payload = await submitAndReadPayload();
+
+    expect(payload.delegate_auth_to_upstream).toBe(false);
+  });
+});
diff --git a/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/CreateMCPServer.tsx b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/CreateMCPServer.tsx
index ed8d3bddc98..92bdd14754c 100644
--- a/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/CreateMCPServer.tsx
+++ b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/CreateMCPServer.tsx
@@ -1,5 +1,6 @@
 import React, { useState } from "react";
-import { Modal, Tooltip, Form, Select, Input as AntdInput, InputNumber, Collapse } from "antd";
+import { Modal, Tooltip, Select, Input as AntdInput, InputNumber, Collapse } from "antd";
+import { FormProvider, useForm, useWatch } from "react-hook-form";
 import { InfoCircleOutlined } from "@ant-design/icons";
 import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
@@ -49,6 +50,16 @@ import { validateMCPServerUrl, validateMCPServerName } from "./utils";
 import { toast } from "@/lib/toast";
 import { useMcpOAuthFlow } from "@/hooks/useMcpOAuthFlow";
 import { useTestMCPConnection } from "@/hooks/useTestMCPConnection";
+import {
+  MountedFormField,
+  MountedFormProvider,
+  projectMountedValues,
+  useMountRegistry,
+  type MountedFormValues,
+} from "@/components/common_components/MountedFormField";
+import { antdRequired, antdRules } from "@/components/common_components/antdFormRules";
+import { allFieldsValue, mountedPaths, resetFields, setFieldsValue, singleBranchChange } from "./mcpFormStore";
+import { numberControl, notOnlyWhitespace, selectControl, textControl } from "./mcpFieldRules";
 import mcpLogo from "../../../../../public/assets/logos/mcp_logo.png";
 
 export const mcpLogoImg = mcpLogo.src;
@@ -76,6 +87,13 @@ const payloadErrorMessage = (result: Exclude<BuildCreatePayloadResult, { kind: "
   }
 };
 
+const CREATE_DEFAULTS: MountedFormValues = {
+  allow_all_keys: false,
+  available_on_public_internet: true,
+  delegate_auth_to_upstream: false,
+  oauth_passthrough: false,
+};
+
 const CreateMCPServer: React.FC<CreateMCPServerProps> = ({
   userID,
   userRole,
@@ -87,7 +105,8 @@ const CreateMCPServer: React.FC<CreateMCPServerProps> = ({
   prefillData,
   onBackToDiscovery,
 }) => {
-  const [form] = Form.useForm();
+  const form = useForm<MountedFormValues>({ mode: "onChange", defaultValues: CREATE_DEFAULTS });
+  const registry = useMountRegistry();
   const [isLoading, setIsLoading] = useState(false);
   const [costConfig, setCostConfig] = useState<MCPServerCostInfo>({});
   const [formValues, setFormValues] = useState<Record<string, any>>({});
@@ -136,6 +155,8 @@ const CreateMCPServer: React.FC<CreateMCPServerProps> = ({
     enabled: true,
   });
 
+  const authSectionMounted = transportType !== "stdio" && transportType !== "";
+  const watchedAuthType = useWatch({ control: form.control, name: "auth_type" }) as string | undefined;
   const authType = formValues.auth_type as string | undefined;
   const shouldShowAuthValueField = authType ? AUTH_TYPES_REQUIRING_AUTH_VALUE.includes(authType) : false;
   const isOAuthAuthType = authType === AUTH_TYPE.OAUTH2;
@@ -147,7 +168,7 @@ const CreateMCPServer: React.FC<CreateMCPServerProps> = ({
   const persistCreateUiState = () => {
     writeCreateUiSnapshot({
       modalVisible: isModalVisible,
-      formValues: form.getFieldsValue(true),
+      formValues: allFieldsValue(form),
       transportType,
       costConfig,
       allowedTools,
@@ -170,11 +191,11 @@ const CreateMCPServer: React.FC<CreateMCPServerProps> = ({
     // Merge the ref-held DCR client so a re-authorize reuses the registered client instead of
     // re-registering; the form store itself never holds the DCR client (see onTokenReceived).
     getCredentials: () => ({
-      ...((form.getFieldValue("credentials") as Record<string, unknown> | undefined) ?? {}),
+      ...((allFieldsValue(form).credentials as Record<string, unknown> | undefined) ?? {}),
       ...(dcrClientRef.current ?? {}),
     }),
     getTemporaryPayload: () => {
-      const values = form.getFieldsValue(true);
+      const values = allFieldsValue(form);
       const transport = values.transport || transportType;
       // For OpenAPI transport the form has spec_path instead of url.
       // We pass the spec_path as url so the temp-session endpoint has something
@@ -218,12 +239,12 @@ const CreateMCPServer: React.FC<CreateMCPServerProps> = ({
         return;
       }
 
-      if (isClientForwardedTokenMode(form.getFieldValue("auth_type"))) {
+      if (isClientForwardedTokenMode(allFieldsValue(form).auth_type)) {
         // Browser-only modes: the token is held in local state (oauthAccessToken) for tool preview
         // and committed to sessionStorage on submit; it must never be written into form.credentials,
         // which would persist it as server-level credentials on the created server row. Mirrors the
         // edit form's onTokenReceived early return.
-        setAuthorizedIdentity(getOAuthAuthorizationIdentity(form.getFieldsValue(true)));
+        setAuthorizedIdentity(getOAuthAuthorizationIdentity(allFieldsValue(form)));
         toast.success(
           "Token held for this browser session. Tools can now be previewed and configured; the token is not saved to LiteLLM.",
         );
@@ -240,7 +261,7 @@ const CreateMCPServer: React.FC<CreateMCPServerProps> = ({
           }
         : null;
 
-      const current = (form.getFieldValue("credentials") as Record<string, unknown> | undefined) ?? {};
+      const current = (allFieldsValue(form).credentials as Record<string, unknown> | undefined) ?? {};
       const nextCredentials = {
         ...(preservedAdminCredentials(current) ?? {}),
         ...(current.scopes !== undefined && { scopes: current.scopes }),
@@ -252,10 +273,10 @@ const CreateMCPServer: React.FC<CreateMCPServerProps> = ({
       // Path-replace (not deep-merge) so a re-authorize with fewer token fields does not leave stale
       // siblings from the previous token behind; the admin-typed client keys and scopes are carried
       // explicitly above.
-      form.setFieldValue("credentials", nextCredentials);
+      form.setValue("credentials", nextCredentials);
       // Capture the identity AFTER writing the token so the held token is not spuriously invalidated by
       // its own credential write.
-      setAuthorizedIdentity(getOAuthAuthorizationIdentity(form.getFieldsValue(true)));
+      setAuthorizedIdentity(getOAuthAuthorizationIdentity(allFieldsValue(form)));
 
       toast.success("OAuth authorization successful! Please click 'Create MCP Server' to save the configuration.");
     },
@@ -277,10 +298,10 @@ const CreateMCPServer: React.FC<CreateMCPServerProps> = ({
     // Capture the admin-typed app before resetFields destroys it, then re-apply it: the app is
     // upstream-scoped config, not minted material, so it survives every invalidation (the token is
     // what gets discarded). Token-shaped keys are excluded by the helper's key filter.
-    const keptAdminCredentials = preservedAdminCredentials(form.getFieldValue("credentials"));
-    form.resetFields([...CLEARED_ON_INVALIDATION]);
+    const keptAdminCredentials = preservedAdminCredentials(allFieldsValue(form).credentials);
+    resetFields(form, [...CLEARED_ON_INVALIDATION]);
     if (keptAdminCredentials) {
-      form.setFieldsValue({ credentials: keptAdminCredentials });
+      setFieldsValue(form, { credentials: keptAdminCredentials });
     }
     // Re-apply the in-flight edit last; rc-field-form deep-merges nested objects, so a changed
     // credentials sub-field composes with the preserved sibling instead of replacing the object.
@@ -288,7 +309,7 @@ const CreateMCPServer: React.FC<CreateMCPServerProps> = ({
       CLEARED_ON_INVALIDATION.filter((key) => key in changedValues).map((key) => [key, changedValues[key]]),
     );
     if (Object.keys(preserved).length > 0) {
-      form.setFieldsValue(preserved);
+      setFieldsValue(form, preserved);
     }
   };
 
@@ -337,7 +358,7 @@ const CreateMCPServer: React.FC<CreateMCPServerProps> = ({
       // wait until transportType state catches up so the URL field is mounted
       return;
     }
-    form.setFieldsValue(pendingRestoredValues.values);
+    setFieldsValue(form, pendingRestoredValues.values);
     setFormValues(pendingRestoredValues.values);
     setPendingRestoredValues(null);
   }, [pendingRestoredValues, form, transportType]);
@@ -381,11 +402,20 @@ const CreateMCPServer: React.FC<CreateMCPServerProps> = ({
       prefillValues.url = prefillData.url;
     }
 
-    form.setFieldsValue(prefillValues);
+    setFieldsValue(form, prefillValues);
     setFormValues(prefillValues);
     setAliasManuallyEdited(false);
   }, [isModalVisible, prefillData, form]);
 
+  const handleSubmit = async (event: React.FormEvent) => {
+    event.preventDefault();
+    const isValid = await form.trigger(mountedPaths(registry) as string[]);
+    if (!isValid) {
+      return;
+    }
+    await handleCreate(projectMountedValues(registry, form.getValues));
+  };
+
   const handleCreate = async (values: Record<string, unknown>) => {
     const built = buildCreateServerPayload(values, {
       transportType,
@@ -446,7 +476,7 @@ const CreateMCPServer: React.FC<CreateMCPServerProps> = ({
             description: "Once an admin approves it, the server will appear in your MCP Servers list.",
           });
         }
-        form.resetFields();
+        form.reset(CREATE_DEFAULTS);
         setCostConfig({});
         clearTools();
         setAllowedTools([]);
@@ -466,7 +496,7 @@ const CreateMCPServer: React.FC<CreateMCPServerProps> = ({
 
   // state
   const handleCancel = () => {
-    form.resetFields();
+    form.reset(CREATE_DEFAULTS);
     setCostConfig({});
     clearTools();
     setAllowedTools([]);
@@ -489,11 +519,11 @@ const CreateMCPServer: React.FC<CreateMCPServerProps> = ({
           ? { url: undefined, command: undefined, args: undefined, env: undefined }
           : { spec_path: undefined, command: undefined, args: undefined, env: undefined };
 
-    form.setFieldsValue(transportValues);
-    if (isHeldOAuthTokenStale(form.getFieldsValue(true), authorizedIdentity)) {
+    setFieldsValue(form, transportValues);
+    if (isHeldOAuthTokenStale(allFieldsValue(form), authorizedIdentity)) {
       clearHeldOAuthToken();
     }
-    setFormValues(form.getFieldsValue(true));
+    setFormValues(allFieldsValue(form));
   };
 
   // Generate options with existing groups and potential new group
@@ -532,7 +562,7 @@ const CreateMCPServer: React.FC<CreateMCPServerProps> = ({
   React.useEffect(() => {
     if (!aliasManuallyEdited && formValues.server_name) {
       const normalized = formValues.server_name.replace(/\s+/g, "_");
-      form.setFieldsValue({ alias: normalized });
+      setFieldsValue(form, { alias: normalized });
       setFormValues((prev) => ({ ...prev, alias: normalized }));
     }
   }, [formValues.server_name]);
@@ -549,7 +579,7 @@ const CreateMCPServer: React.FC<CreateMCPServerProps> = ({
     const wasVisible = wasModalVisibleRef.current;
     wasModalVisibleRef.current = isModalVisible;
     if (!isModalVisible && wasVisible) {
-      form.resetFields();
+      form.reset(CREATE_DEFAULTS);
       setFormValues({});
       setOauthAccessToken(null);
       clearTools();
@@ -582,19 +612,35 @@ const CreateMCPServer: React.FC<CreateMCPServerProps> = ({
       const upstreamChanged = ["url", "spec_path", "issuer", "authorization_url", "token_url", "registration_url"].some(
         (key) => key in changedValues,
       );
-      const hasDeclaredApp = preservedDeclaredAppCredentials(form.getFieldValue("credentials")) !== undefined;
+      const hasDeclaredApp = preservedDeclaredAppCredentials(allFieldsValue(form).credentials) !== undefined;
       if (upstreamChanged && hasDeclaredApp) {
         setAppMayNotMatchUpstream(true);
       }
     }
-    if (isHeldOAuthTokenStale(form.getFieldsValue(true), authorizedIdentity)) {
+    if (isHeldOAuthTokenStale(allFieldsValue(form), authorizedIdentity)) {
       clearHeldOAuthToken(changedValues);
-      setFormValues(form.getFieldsValue(true));
+      setFormValues(allFieldsValue(form));
       return;
     }
     setFormValues(allValues);
   };
 
+  const valuesChangeRef = React.useRef(handleFormValuesChange);
+  valuesChangeRef.current = handleFormValuesChange;
+
+  React.useEffect(() => {
+    const subscription = form.watch((values, { name, type }) => {
+      if (type !== "change" || name === undefined) {
+        return;
+      }
+      valuesChangeRef.current(
+        singleBranchChange(name, values as MountedFormValues),
+        projectMountedValues(registry, form.getValues),
+      );
+    });
+    return () => subscription.unsubscribe();
+  }, [form, registry]);
+
   // rendering
   return (
     <Modal
@@ -636,334 +682,370 @@ const CreateMCPServer: React.FC<CreateMCPServerProps> = ({
       }}
     >
       <div className="mt-6">
-        <Form
-          form={form}
-          onFinish={handleCreate}
-          onValuesChange={handleFormValuesChange}
-          layout="vertical"
-          className="space-y-6"
-        >
-          {!isAdmin && (
-            <div className="rounded-md bg-blue-50 border border-blue-200 px-4 py-3 text-sm text-blue-800">
-              Your submission will be sent for admin review. Once approved, the server will appear in your MCP Servers
-              list. The request must be made with a team-scoped API key.
-            </div>
-          )}
-          <div className="grid grid-cols-1 gap-6">
-            <Form.Item
-              label={
-                <span className="text-sm font-medium text-gray-700 flex items-center">
-                  MCP Server Name
-                  <Tooltip title="Best practice: Use a descriptive name that indicates the server's purpose (e.g., 'GitHub_MCP', 'Email_Service'). Cannot contain spaces or hyphens; use underscores instead. Names must comply with SEP-986 and will be rejected if invalid (https://modelcontextprotocol.io/specification/2025-11-25/server/tools#tool-names).">
-                    <InfoCircleOutlined className="ml-2 text-blue-400 hover:text-blue-600 cursor-help" />
-                  </Tooltip>
-                </span>
-              }
-              name="server_name"
-              rules={[
-                { required: false, message: "Please enter a server name" },
-                { validator: (_, value) => validateMCPServerName(value) },
-              ]}
-            >
-              <Input
-                placeholder="e.g., GitHub_MCP, Zapier_MCP, etc."
-                className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500"
-              />
-            </Form.Item>
+        <FormProvider {...form}>
+          <MountedFormProvider value={{ control: form.control, registry }}>
+            <form onSubmit={handleSubmit} className="space-y-6">
+              {!isAdmin && (
+                <div className="rounded-md bg-blue-50 border border-blue-200 px-4 py-3 text-sm text-blue-800">
+                  Your submission will be sent for admin review. Once approved, the server will appear in your MCP
+                  Servers list. The request must be made with a team-scoped API key.
+                </div>
+              )}
+              <div className="grid grid-cols-1 gap-6">
+                <MountedFormField
+                  label={
+                    <span className="text-sm font-medium text-gray-700 flex items-center">
+                      MCP Server Name
+                      <Tooltip title="Best practice: Use a descriptive name that indicates the server's purpose (e.g., 'GitHub_MCP', 'Email_Service'). Cannot contain spaces or hyphens; use underscores instead. Names must comply with SEP-986 and will be rejected if invalid (https://modelcontextprotocol.io/specification/2025-11-25/server/tools#tool-names).">
+                        <InfoCircleOutlined className="ml-2 text-blue-400 hover:text-blue-600 cursor-help" />
+                      </Tooltip>
+                    </span>
+                  }
+                  name="server_name"
+                  rules={{ validate: antdRules({ validator: (_, value) => validateMCPServerName(value) }) }}
+                >
+                  {(control) => (
+                    <Input
+                      {...textControl(control)}
+                      placeholder="e.g., GitHub_MCP, Zapier_MCP, etc."
+                      className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500"
+                    />
+                  )}
+                </MountedFormField>
 
-            <Form.Item
-              label={
-                <span className="text-sm font-medium text-gray-700 flex items-center">
-                  Alias
-                  <Tooltip title="A short, unique identifier for this server. Defaults to the server name if not provided. Cannot contain spaces or hyphens; use underscores instead.">
-                    <InfoCircleOutlined className="ml-2 text-blue-400 hover:text-blue-600 cursor-help" />
-                  </Tooltip>
-                </span>
-              }
-              name="alias"
-              rules={[{ required: false }, { validator: (_, value) => validateMCPServerName(value) }]}
-            >
-              <Input
-                placeholder="e.g., GitHub_MCP, Zapier_MCP, etc."
-                className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500"
-                onChange={() => setAliasManuallyEdited(true)}
-              />
-            </Form.Item>
+                <MountedFormField
+                  label={
+                    <span className="text-sm font-medium text-gray-700 flex items-center">
+                      Alias
+                      <Tooltip title="A short, unique identifier for this server. Defaults to the server name if not provided. Cannot contain spaces or hyphens; use underscores instead.">
+                        <InfoCircleOutlined className="ml-2 text-blue-400 hover:text-blue-600 cursor-help" />
+                      </Tooltip>
+                    </span>
+                  }
+                  name="alias"
+                  rules={{ validate: antdRules({ validator: (_, value) => validateMCPServerName(value) }) }}
+                >
+                  {(control) => (
+                    <Input
+                      {...textControl(control)}
+                      placeholder="e.g., GitHub_MCP, Zapier_MCP, etc."
+                      className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500"
+                      onChange={(event) => {
+                        control.onChange(event);
+                        setAliasManuallyEdited(true);
+                      }}
+                    />
+                  )}
+                </MountedFormField>
 
-            <Form.Item
-              label={<span className="text-sm font-medium text-gray-700">Description</span>}
-              name="description"
-              rules={[
-                {
-                  required: false,
-                  message: "Please enter a server description",
-                },
-              ]}
-            >
-              <Input
-                placeholder="Brief description of what this server does"
-                className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500"
-              />
-            </Form.Item>
+                <MountedFormField
+                  label={<span className="text-sm font-medium text-gray-700">Description</span>}
+                  name="description"
+                >
+                  {(control) => (
+                    <Input
+                      {...textControl(control)}
+                      placeholder="Brief description of what this server does"
+                      className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500"
+                    />
+                  )}
+                </MountedFormField>
 
-            <MCPLogoSelector value={logoUrl} onChange={setLogoUrl} />
+                <MCPLogoSelector value={logoUrl} onChange={setLogoUrl} />
 
-            <Form.Item
-              label={<span className="text-sm font-medium text-gray-700">GitHub / Source URL</span>}
-              name="source_url"
-            >
-              <Input
-                placeholder="https://github.com/org/mcp-server"
-                className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500"
-              />
-            </Form.Item>
+                <MountedFormField
+                  label={<span className="text-sm font-medium text-gray-700">GitHub / Source URL</span>}
+                  name="source_url"
+                >
+                  {(control) => (
+                    <Input
+                      {...textControl(control)}
+                      placeholder="https://github.com/org/mcp-server"
+                      className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500"
+                    />
+                  )}
+                </MountedFormField>
 
-            <Form.Item
-              label={<span className="text-sm font-medium text-gray-700">Transport Type</span>}
-              name="transport"
-              rules={[{ required: true, message: "Please select a transport type" }]}
-            >
-              <Select
-                placeholder="Select transport"
-                className="rounded-lg"
-                size="large"
-                onChange={handleTransportChange}
-                value={transportType}
-              >
-                <Select.Option value="http">Streamable HTTP (Recommended)</Select.Option>
-                <Select.Option value="sse">Server-Sent Events (SSE)</Select.Option>
-                <Select.Option value="stdio">Standard Input/Output (stdio)</Select.Option>
-                <Select.Option value={TRANSPORT.OPENAPI}>OpenAPI Spec</Select.Option>
-              </Select>
-            </Form.Item>
+                <MountedFormField
+                  label={<span className="text-sm font-medium text-gray-700">Transport Type</span>}
+                  name="transport"
+                  required
+                  rules={{ validate: { required: antdRequired("Please select a transport type") } }}
+                >
+                  {(control) => (
+                    <Select
+                      {...selectControl<string>(control)}
+                      placeholder="Select transport"
+                      className="rounded-lg"
+                      size="large"
+                      onChange={(value: string) => {
+                        control.onChange(value);
+                        handleTransportChange(value);
+                      }}
+                    >
+                      <Select.Option value="http">Streamable HTTP (Recommended)</Select.Option>
+                      <Select.Option value="sse">Server-Sent Events (SSE)</Select.Option>
+                      <Select.Option value="stdio">Standard Input/Output (stdio)</Select.Option>
+                      <Select.Option value={TRANSPORT.OPENAPI}>OpenAPI Spec</Select.Option>
+                    </Select>
+                  )}
+                </MountedFormField>
 
-            {/* URL field - only show for HTTP and SSE */}
-            {(transportType === "http" || transportType === "sse") && (
-              <Form.Item
-                label={<span className="text-sm font-medium text-gray-700">MCP Server URL</span>}
-                name="url"
-                rules={[
-                  { required: true, message: "Please enter a server URL" },
-                  { validator: (_, value) => validateMCPServerUrl(value) },
-                ]}
-              >
-                <AntdInput
-                  placeholder="https://your-mcp-server.com"
-                  className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500"
-                />
-              </Form.Item>
-            )}
+                {/* URL field - only show for HTTP and SSE */}
+                {(transportType === "http" || transportType === "sse") && (
+                  <MountedFormField
+                    label={<span className="text-sm font-medium text-gray-700">MCP Server URL</span>}
+                    name="url"
+                    required
+                    rules={{
+                      validate: {
+                        required: antdRequired("Please enter a server URL"),
+                        ...antdRules({ validator: (_, value) => validateMCPServerUrl(value) }),
+                      },
+                    }}
+                  >
+                    {(control) => (
+                      <AntdInput
+                        {...textControl(control)}
+                        placeholder="https://your-mcp-server.com"
+                        className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500"
+                      />
+                    )}
+                  </MountedFormField>
+                )}
 
-            {/* OpenAPI: logo picker + spec URL input */}
-            {transportType === TRANSPORT.OPENAPI && (
-              <OpenAPIFormSection
-                form={form}
-                accessToken={isModalVisible ? accessToken : null}
-                onValuesChange={(updates) =>
-                  handleFormValuesChange(updates, { ...form.getFieldsValue(true), ...updates })
-                }
-                onKeyToolsChange={setKeyTools}
-                onLogoUrlChange={setLogoUrl}
-                onOAuthDocsUrlChange={setOauthDocsUrl}
-              />
-            )}
+                {/* OpenAPI: logo picker + spec URL input */}
+                {transportType === TRANSPORT.OPENAPI && (
+                  <OpenAPIFormSection
+                    form={form}
+                    accessToken={isModalVisible ? accessToken : null}
+                    onValuesChange={(updates) =>
+                      handleFormValuesChange(updates, { ...allFieldsValue(form), ...updates })
+                    }
+                    onKeyToolsChange={setKeyTools}
+                    onLogoUrlChange={setLogoUrl}
+                    onOAuthDocsUrlChange={setOauthDocsUrl}
+                  />
+                )}
 
-            {/* BYOK toggle - only for OpenAPI */}
-            {transportType === TRANSPORT.OPENAPI && <OpenApiByokFields />}
+                {/* BYOK toggle - only for OpenAPI */}
+                {transportType === TRANSPORT.OPENAPI && <OpenApiByokFields />}
 
-            <Form.Item
-              label={
-                <span className="text-sm font-medium text-gray-700 flex items-center">
-                  Max Concurrent Requests (optional)
-                  <Tooltip title="Maximum number of tool calls LiteLLM will run against this server at the same time. Additional calls wait for a free slot. Leave blank for no limit.">
-                    <InfoCircleOutlined className="ml-2 text-blue-400 hover:text-blue-600 cursor-help" />
-                  </Tooltip>
-                </span>
-              }
-              name="max_concurrent_requests"
-            >
-              <InputNumber
-                min={1}
-                precision={0}
-                placeholder="e.g. 10"
-                style={{ width: "100%" }}
-                className="rounded-lg"
-              />
-            </Form.Item>
+                <MountedFormField
+                  label={
+                    <span className="text-sm font-medium text-gray-700 flex items-center">
+                      Max Concurrent Requests (optional)
+                      <Tooltip title="Maximum number of tool calls LiteLLM will run against this server at the same time. Additional calls wait for a free slot. Leave blank for no limit.">
+                        <InfoCircleOutlined className="ml-2 text-blue-400 hover:text-blue-600 cursor-help" />
+                      </Tooltip>
+                    </span>
+                  }
+                  name="max_concurrent_requests"
+                >
+                  {(control) => (
+                    <InputNumber
+                      {...numberControl(control)}
+                      min={1}
+                      precision={0}
+                      placeholder="e.g. 10"
+                      style={{ width: "100%" }}
+                      className="rounded-lg"
+                    />
+                  )}
+                </MountedFormField>
 
-            {/* Authentication - show for HTTP, SSE, and OpenAPI */}
-            {transportType !== "stdio" && transportType !== "" && (
-              <Collapse
-                defaultActiveKey={["auth"]}
-                className="mb-4"
-                items={[
-                  {
-                    key: "auth",
-                    label: <span className="text-sm font-semibold text-gray-700">Authentication</span>,
-                    children: (
-                      <>
-                        <Form.Item name="auth_type" rules={[{ required: true, message: "Please select an auth type" }]}>
-                          <Select placeholder="Select auth type" className="rounded-lg" size="large" virtual={false}>
-                            <Select.Option value="none">None</Select.Option>
-                            <Select.Option value="api_key">API Key</Select.Option>
-                            <Select.Option value="bearer_token">Bearer Token</Select.Option>
-                            <Select.Option value="token">Token</Select.Option>
-                            <Select.Option value="basic">Basic Auth</Select.Option>
-                            <Select.Option value="oauth2">OAuth</Select.Option>
-                            <Select.Option value="oauth2_token_exchange">OAuth Token Exchange (OBO)</Select.Option>
-                            <Select.Option value="oauth2_id_jag">ID-JAG (Okta Cross App Access)</Select.Option>
-                            <Select.Option value="aws_sigv4">AWS SigV4 (Bedrock AgentCore MCPs)</Select.Option>
-                            <Select.Option value="true_passthrough">True Passthrough (no LiteLLM auth)</Select.Option>
-                            <Select.Option value="oauth_delegate">
-                              OAuth Delegate (client-supplied upstream token)
-                            </Select.Option>
-                          </Select>
-                        </Form.Item>
+                {/* Authentication - show for HTTP, SSE, and OpenAPI */}
+                {transportType !== "stdio" && transportType !== "" && (
+                  <Collapse
+                    defaultActiveKey={["auth"]}
+                    className="mb-4"
+                    items={[
+                      {
+                        key: "auth",
+                        label: <span className="text-sm font-semibold text-gray-700">Authentication</span>,
+                        children: (
+                          <>
+                            <MountedFormField
+                              name="auth_type"
+                              required
+                              rules={{ validate: { required: antdRequired("Please select an auth type") } }}
+                            >
+                              {(control) => (
+                                <Select
+                                  {...selectControl<string>(control)}
+                                  placeholder="Select auth type"
+                                  className="rounded-lg"
+                                  size="large"
+                                  virtual={false}
+                                >
+                                  <Select.Option value="none">None</Select.Option>
+                                  <Select.Option value="api_key">API Key</Select.Option>
+                                  <Select.Option value="bearer_token">Bearer Token</Select.Option>
+                                  <Select.Option value="token">Token</Select.Option>
+                                  <Select.Option value="basic">Basic Auth</Select.Option>
+                                  <Select.Option value="oauth2">OAuth</Select.Option>
+                                  <Select.Option value="oauth2_token_exchange">
+                                    OAuth Token Exchange (OBO)
+                                  </Select.Option>
+                                  <Select.Option value="oauth2_id_jag">ID-JAG (Okta Cross App Access)</Select.Option>
+                                  <Select.Option value="aws_sigv4">AWS SigV4 (Bedrock AgentCore MCPs)</Select.Option>
+                                  <Select.Option value="true_passthrough">
+                                    True Passthrough (no LiteLLM auth)
+                                  </Select.Option>
+                                  <Select.Option value="oauth_delegate">
+                                    OAuth Delegate (client-supplied upstream token)
+                                  </Select.Option>
+                                </Select>
+                              )}
+                            </MountedFormField>
 
-                        <TruePassthroughWarning authType={authType} />
+                            <TruePassthroughWarning authType={authType} />
 
-                        <PassthroughAuthorizeSection
-                          authType={authType}
-                          dcrBridgeInitialChecked
-                          oauthFlow={{
-                            startOAuthFlow,
-                            status: oauthStatus,
-                            error: oauthError,
-                            tokenResponse: oauthTokenResponse,
-                          }}
-                          appMayNotMatchUpstream={appMayNotMatchUpstream}
-                        />
-
-                        {shouldShowAuthValueField && (
-                          <Form.Item
-                            label={
-                              <span className="text-sm font-medium text-gray-700 flex items-center">
-                                Authentication Value
-                                <Tooltip title="Token, password, or header value to send with each request for the selected auth type.">
-                                  <InfoCircleOutlined className="ml-2 text-blue-400 hover:text-blue-600 cursor-help" />
-                                </Tooltip>
-                              </span>
-                            }
-                            name={["credentials", "auth_value"]}
-                            rules={[
-                              {
-                                validator: (_, value) =>
-                                  value && typeof value === "string" && value.trim() === ""
-                                    ? Promise.reject(new Error("Authentication value cannot be empty whitespace"))
-                                    : Promise.resolve(),
-                              },
-                            ]}
-                          >
-                            <AntdInput.Password
-                              placeholder="Enter token or secret"
-                              className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500"
+                            <PassthroughAuthorizeSection
+                              authType={authType}
+                              dcrBridgeInitialChecked
+                              oauthFlow={{
+                                startOAuthFlow,
+                                status: oauthStatus,
+                                error: oauthError,
+                                tokenResponse: oauthTokenResponse,
+                              }}
+                              appMayNotMatchUpstream={appMayNotMatchUpstream}
                             />
-                          </Form.Item>
-                        )}
 
-                        {isOAuthAuthType && (
-                          <OAuthFormFields
-                            isM2M={isM2MFlow}
-                            initialFlowType={OAUTH_FLOW.INTERACTIVE}
-                            docsUrl={oauthDocsUrl}
-                            oauthFlow={{
-                              startOAuthFlow,
-                              status: oauthStatus,
-                              error: oauthError,
-                              tokenResponse: oauthTokenResponse,
-                            }}
-                          />
-                        )}
+                            {shouldShowAuthValueField && (
+                              <MountedFormField
+                                label={
+                                  <span className="text-sm font-medium text-gray-700 flex items-center">
+                                    Authentication Value
+                                    <Tooltip title="Token, password, or header value to send with each request for the selected auth type.">
+                                      <InfoCircleOutlined className="ml-2 text-blue-400 hover:text-blue-600 cursor-help" />
+                                    </Tooltip>
+                                  </span>
+                                }
+                                name={["credentials", "auth_value"]}
+                                rules={{
+                                  validate: {
+                                    notWhitespace: notOnlyWhitespace("Authentication value cannot be empty whitespace"),
+                                  },
+                                }}
+                              >
+                                {(control) => (
+                                  <AntdInput.Password
+                                    {...textControl(control)}
+                                    placeholder="Enter token or secret"
+                                    className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500"
+                                  />
+                                )}
+                              </MountedFormField>
+                            )}
 
-                        {isTokenExchangeAuthType && <TokenExchangeFormFields />}
+                            {isOAuthAuthType && (
+                              <OAuthFormFields
+                                isM2M={isM2MFlow}
+                                initialFlowType={OAUTH_FLOW.INTERACTIVE}
+                                docsUrl={oauthDocsUrl}
+                                oauthFlow={{
+                                  startOAuthFlow,
+                                  status: oauthStatus,
+                                  error: oauthError,
+                                  tokenResponse: oauthTokenResponse,
+                                }}
+                              />
+                            )}
 
-                        {isIdJagAuthType && <IdJagFormFields />}
-                      </>
-                    ),
-                  },
-                ]}
-              />
-            )}
+                            {isTokenExchangeAuthType && <TokenExchangeFormFields />}
 
-            {transportType !== "stdio" && transportType !== "" && isAwsSigV4AuthType && <AwsSigV4Fields />}
+                            {isIdJagAuthType && <IdJagFormFields />}
+                          </>
+                        ),
+                      },
+                    ]}
+                  />
+                )}
 
-            {/* Stdio Configuration - only show for stdio transport */}
-            <StdioConfiguration isVisible={transportType === "stdio"} />
-          </div>
+                {transportType !== "stdio" && transportType !== "" && isAwsSigV4AuthType && <AwsSigV4Fields />}
 
-          {/* Environment Variables Section */}
-          <div className="mt-8">
-            <EnvVarsSection />
-          </div>
+                {/* Stdio Configuration - only show for stdio transport */}
+                <StdioConfiguration isVisible={transportType === "stdio"} />
+              </div>
 
-          {/* Permission Management / Access Control Section */}
-          <div className="mt-8">
-            <MCPPermissionManagement
-              availableAccessGroups={availableAccessGroups}
-              mcpServer={null}
-              searchValue={searchValue}
-              setSearchValue={setSearchValue}
-              getAccessGroupOptions={getAccessGroupOptions}
-            />
-          </div>
+              {/* Environment Variables Section */}
+              <div className="mt-8">
+                <EnvVarsSection />
+              </div>
 
-          {/* Connection Status Section */}
-          <div className="mt-8 pt-6 border-t border-gray-200">
-            <MCPConnectionStatus
-              formValues={formValues}
-              tools={tools}
-              isLoadingTools={isLoadingTools}
-              toolsError={toolsError}
-              toolsErrorStatus={toolsErrorStatus}
-              toolsErrorStackTrace={toolsErrorStackTrace}
-              canFetchTools={canFetchTools}
-              fetchTools={fetchTools}
-            />
-          </div>
+              {/* Permission Management / Access Control Section */}
+              <div className="mt-8">
+                <MCPPermissionManagement
+                  availableAccessGroups={availableAccessGroups}
+                  mcpServer={null}
+                  mountedAuthType={authSectionMounted ? watchedAuthType : undefined}
+                  searchValue={searchValue}
+                  setSearchValue={setSearchValue}
+                  getAccessGroupOptions={getAccessGroupOptions}
+                />
+              </div>
 
-          {/* Tool Configuration Section */}
-          <div className="mt-6">
-            <MCPToolConfiguration
-              accessToken={accessToken}
-              formValues={formValues}
-              allowedTools={allowedTools}
-              existingAllowedTools={null}
-              onAllowedToolsChange={setAllowedTools}
-              hasToolAllowlistInteraction={hasToolAllowlistInteraction}
-              onToolAllowlistInteraction={() => setHasToolAllowlistInteraction(true)}
-              toolNameToDisplayName={toolNameToDisplayName}
-              toolNameToDescription={toolNameToDescription}
-              onToolNameToDisplayNameChange={setToolNameToDisplayName}
-              onToolNameToDescriptionChange={setToolNameToDescription}
-              keyTools={keyTools}
-              externalTools={tools}
-              externalIsLoading={isLoadingTools}
-              externalError={toolsError}
-              externalErrorStatus={toolsErrorStatus}
-              externalCanFetch={canFetchTools}
-            />
-          </div>
+              {/* Connection Status Section */}
+              <div className="mt-8 pt-6 border-t border-gray-200">
+                <MCPConnectionStatus
+                  formValues={formValues}
+                  tools={tools}
+                  isLoadingTools={isLoadingTools}
+                  toolsError={toolsError}
+                  toolsErrorStatus={toolsErrorStatus}
+                  toolsErrorStackTrace={toolsErrorStackTrace}
+                  canFetchTools={canFetchTools}
+                  fetchTools={fetchTools}
+                />
+              </div>
 
-          {/* Cost Configuration Section */}
-          <div className="mt-6">
-            <MCPServerCostConfig
-              value={costConfig}
-              onChange={setCostConfig}
-              tools={tools.filter((tool) => allowedTools.includes(tool.name))}
-              disabled={false}
-            />
-          </div>
+              {/* Tool Configuration Section */}
+              <div className="mt-6">
+                <MCPToolConfiguration
+                  accessToken={accessToken}
+                  formValues={formValues}
+                  allowedTools={allowedTools}
+                  existingAllowedTools={null}
+                  onAllowedToolsChange={setAllowedTools}
+                  hasToolAllowlistInteraction={hasToolAllowlistInteraction}
+                  onToolAllowlistInteraction={() => setHasToolAllowlistInteraction(true)}
+                  toolNameToDisplayName={toolNameToDisplayName}
+                  toolNameToDescription={toolNameToDescription}
+                  onToolNameToDisplayNameChange={setToolNameToDisplayName}
+                  onToolNameToDescriptionChange={setToolNameToDescription}
+                  keyTools={keyTools}
+                  externalTools={tools}
+                  externalIsLoading={isLoadingTools}
+                  externalError={toolsError}
+                  externalErrorStatus={toolsErrorStatus}
+                  externalCanFetch={canFetchTools}
+                />
+              </div>
 
-          <div className="flex items-center justify-end space-x-3 pt-6 border-t border-gray-100">
-            <Button variant="secondary" onClick={handleCancel}>
-              Cancel
-            </Button>
-            <Button type="submit" disabled={isLoading} aria-busy={isLoading}>
-              {isLoading && <UiLoadingSpinner className="size-4" />}
-              {isLoading ? "Creating..." : "Add MCP Server"}
-            </Button>
-          </div>
-        </Form>
+              {/* Cost Configuration Section */}
+              <div className="mt-6">
+                <MCPServerCostConfig
+                  value={costConfig}
+                  onChange={setCostConfig}
+                  tools={tools.filter((tool) => allowedTools.includes(tool.name))}
+                  disabled={false}
+                />
+              </div>
+
+              <div className="flex items-center justify-end space-x-3 pt-6 border-t border-gray-100">
+                <Button variant="secondary" onClick={handleCancel}>
+                  Cancel
+                </Button>
+                <Button type="submit" disabled={isLoading} aria-busy={isLoading}>
+                  {isLoading && <UiLoadingSpinner className="size-4" />}
+                  {isLoading ? "Creating..." : "Add MCP Server"}
+                </Button>
+              </div>
+            </form>
+          </MountedFormProvider>
+        </FormProvider>
       </div>
     </Modal>
   );
diff --git a/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/DcrBridgeToggle.tsx b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/DcrBridgeToggle.tsx
index 49c182aa6be..35b23f9873c 100644
--- a/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/DcrBridgeToggle.tsx
+++ b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/DcrBridgeToggle.tsx
@@ -1,16 +1,19 @@
 import React from "react";
-import { Form, Switch, Tooltip } from "antd";
+import { Switch, Tooltip } from "antd";
 import { InfoCircleOutlined } from "@ant-design/icons";
+
+import { MountedFormField } from "@/components/common_components/MountedFormField";
 import { isClientForwardedTokenMode } from "@/components/mcp_tools/types";
+import { switchControl } from "./mcpFieldRules";
 
 /**
  * DCR-bridge toggle for the client-forwarded token modes (true_passthrough /
  * oauth_delegate); self-gates to those two auth types and renders nothing
  * otherwise. When on, OAuth-only clients like Claude Desktop can register and
  * sign in through the gateway; when off, the gateway relays the upstream
- * server's own OAuth metadata instead. `initialChecked` seeds the antd
- * Form.Item `initialValue` (not the Switch's DOM defaultChecked): the create
- * form defaults it on, the edit form seeds it from the stored value.
+ * server's own OAuth metadata instead. `initialChecked` seeds the field's
+ * default value (not the Switch's DOM defaultChecked): the create form defaults
+ * it on, the edit form seeds it from the stored value.
  */
 export default function DcrBridgeToggle({
   authType,
@@ -21,7 +24,7 @@ export default function DcrBridgeToggle({
 }) {
   if (!isClientForwardedTokenMode(authType)) return null;
   return (
-    <Form.Item
+    <MountedFormField
       label={
         <span className="text-sm font-medium text-gray-700 flex items-center">
           Gateway-hosted sign-in (DCR bridge)
@@ -31,10 +34,9 @@ export default function DcrBridgeToggle({
         </span>
       }
       name="dcr_bridge"
-      valuePropName="checked"
-      initialValue={initialChecked}
+      defaultValue={initialChecked}
     >
-      <Switch />
-    </Form.Item>
+      {(control) => <Switch {...switchControl(control)} />}
+    </MountedFormField>
   );
 }
diff --git a/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/EnvVarsSection.test.tsx b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/EnvVarsSection.test.tsx
new file mode 100644
index 00000000000..a57bde7eb9d
--- /dev/null
+++ b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/EnvVarsSection.test.tsx
@@ -0,0 +1,86 @@
+import React from "react";
+import { describe, it, expect, vi } from "vitest";
+import { render, screen } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { FormProvider, useForm } from "react-hook-form";
+
+import {
+  MountedFormProvider,
+  projectMountedValues,
+  useMountRegistry,
+  type MountedFormValues,
+} from "@/components/common_components/MountedFormField";
+import EnvVarsSection from "./EnvVarsSection";
+
+const renderSection = (defaultValues: MountedFormValues) => {
+  const onFinish = vi.fn();
+  const Harness: React.FC = () => {
+    const form = useForm<MountedFormValues>({ mode: "onChange", defaultValues });
+    const registry = useMountRegistry();
+    return (
+      <FormProvider {...form}>
+        <MountedFormProvider value={{ control: form.control, registry }}>
+          <form
+            onSubmit={(event) => {
+              event.preventDefault();
+              onFinish(projectMountedValues(registry, form.getValues));
+            }}
+          >
+            <EnvVarsSection />
+            <button type="submit">Submit</button>
+          </form>
+        </MountedFormProvider>
+      </FormProvider>
+    );
+  };
+  render(<Harness />);
+  return onFinish;
+};
+
+describe("EnvVarsSection", () => {
+  it("submits a per-user row whole, keeping the value key whose input the scope hides", async () => {
+    const onFinish = renderSection({
+      env_vars: [{ name: "DB_USER", value: "admin", scope: "user", description: "Your DB username" }],
+    });
+
+    expect(screen.queryByPlaceholderText("e.g. postgresql")).not.toBeInTheDocument();
+    await userEvent.click(screen.getByText("Submit"));
+
+    expect(onFinish).toHaveBeenCalledWith(
+      expect.objectContaining({
+        env_vars: [{ name: "DB_USER", value: "admin", scope: "user", description: "Your DB username" }],
+      }),
+    );
+  });
+
+  it("submits an empty env_vars key when the list has no rows, rather than dropping the key", async () => {
+    const onFinish = renderSection({ env_vars: [] });
+
+    await userEvent.click(screen.getByText("Submit"));
+
+    expect(onFinish.mock.calls[0][0]).toHaveProperty("env_vars", []);
+  });
+
+  it("carries a row added after mount into the submitted list, scoped global without the user picking one", async () => {
+    const onFinish = renderSection({ env_vars: [] });
+
+    await userEvent.click(screen.getByText("Add Variable"));
+    await userEvent.type(screen.getByPlaceholderText("e.g. DB_PROTOCOL"), "DB_PROTOCOL");
+    await userEvent.type(screen.getByPlaceholderText("e.g. postgresql"), "postgresql");
+    await userEvent.click(screen.getByText("Submit"));
+
+    expect(onFinish).toHaveBeenCalledWith(
+      expect.objectContaining({
+        env_vars: [expect.objectContaining({ name: "DB_PROTOCOL", value: "postgresql", scope: "global" })],
+      }),
+    );
+  });
+
+  it("rejects a variable name that starts with a digit", async () => {
+    renderSection({ env_vars: [{ name: "", value: "", scope: "global", description: "" }] });
+
+    await userEvent.type(screen.getByPlaceholderText("e.g. DB_PROTOCOL"), "9LIVES");
+
+    expect(await screen.findByText("Use letters, digits, underscores; cannot start with a digit.")).toBeInTheDocument();
+  });
+});
diff --git a/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/EnvVarsSection.tsx b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/EnvVarsSection.tsx
index fbaacc40263..539a06910c1 100644
--- a/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/EnvVarsSection.tsx
+++ b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/EnvVarsSection.tsx
@@ -1,6 +1,16 @@
 import React from "react";
-import { Form, Input, Select, Button, Tooltip, Typography } from "antd";
+import { Input, Select, Button, Tooltip, Typography } from "antd";
 import { InfoCircleOutlined, MinusCircleOutlined, PlusOutlined } from "@ant-design/icons";
+import { useFieldArray, useFormContext, useWatch } from "react-hook-form";
+
+import {
+  MountedFormField,
+  useMountedName,
+  type MountedFormValues,
+} from "@/components/common_components/MountedFormField";
+import { antdRequired } from "@/components/common_components/antdFormRules";
+import { matchesPattern, selectControl, textControl } from "./mcpFieldRules";
+import { listControl } from "./mcpFormStore";
 
 const { Text } = Typography;
 
@@ -9,6 +19,8 @@ const SCOPE_OPTIONS = [
   { value: "user", label: "Per-user" },
 ];
 
+const VARIABLE_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
+
 /**
  * Form section for admin-configured MCP environment variables.
  *
@@ -20,6 +32,10 @@ const SCOPE_OPTIONS = [
  * The parent form reads the ``env_vars`` field from the form values.
  */
 const EnvVarsSection: React.FC = () => {
+  const { control } = useFormContext<MountedFormValues>();
+  const { fields, append, remove } = useFieldArray({ control: listControl(control), name: "env_vars" });
+  useMountedName("env_vars");
+
   return (
     <div className="rounded-lg border border-gray-200 bg-gray-50 p-4">
       <div className="flex items-center gap-2 mb-1">
@@ -48,60 +64,52 @@ const EnvVarsSection: React.FC = () => {
         </code>
       </Text>
 
-      <Form.List name="env_vars">
-        {(fields, { add, remove }) => (
-          <div className="space-y-2">
-            {fields.length > 0 && (
-              <div className="flex gap-3 px-1 text-xs font-medium text-gray-500 uppercase tracking-wide">
-                <div style={{ flex: 1 }}>Variable Name</div>
-                <div style={{ flex: 1 }}>Value / Description</div>
-                <div style={{ width: 160 }}>Scope</div>
-                <div style={{ width: 24 }} />
-              </div>
-            )}
-            {fields.map(({ key, name, ...restField }) => (
-              <div key={key} className="flex gap-3 items-start">
-                <Form.Item
-                  {...restField}
-                  name={[name, "name"]}
-                  className="mb-0"
-                  style={{ flex: 1 }}
-                  rules={[
-                    { required: true, message: "Variable name is required" },
-                    {
-                      pattern: /^[A-Za-z_][A-Za-z0-9_]*$/,
-                      message: "Use letters, digits, underscores; cannot start with a digit.",
-                    },
-                  ]}
-                >
-                  <Input placeholder="e.g. DB_PROTOCOL" className="rounded-md font-mono" />
-                </Form.Item>
-                <div style={{ flex: 1 }}>
-                  <ScopedValueOrDescription name={name} restField={restField} />
-                </div>
-                <Form.Item
-                  {...restField}
-                  name={[name, "scope"]}
-                  className="mb-0"
-                  initialValue="global"
-                  style={{ width: 160 }}
-                >
-                  <Select options={SCOPE_OPTIONS} />
-                </Form.Item>
-                <div style={{ width: 24, height: 32 }} className="flex items-center justify-center">
-                  <MinusCircleOutlined
-                    onClick={() => remove(name)}
-                    className="text-gray-500 hover:text-red-500 cursor-pointer"
-                  />
-                </div>
-              </div>
-            ))}
-            <Button type="dashed" onClick={() => add({ scope: "global" })} icon={<PlusOutlined />} block>
-              Add Variable
-            </Button>
+      <div className="space-y-2">
+        {fields.length > 0 && (
+          <div className="flex gap-3 px-1 text-xs font-medium text-gray-500 uppercase tracking-wide">
+            <div style={{ flex: 1 }}>Variable Name</div>
+            <div style={{ flex: 1 }}>Value / Description</div>
+            <div style={{ width: 160 }}>Scope</div>
+            <div style={{ width: 24 }} />
           </div>
         )}
-      </Form.List>
+        {fields.map((item, index) => (
+          <div key={item.id} className="flex gap-3 items-start">
+            <MountedFormField
+              name={["env_vars", String(index), "name"]}
+              className="mb-0 flex-1"
+              rules={{
+                validate: {
+                  required: antdRequired("Variable name is required"),
+                  pattern: matchesPattern(
+                    VARIABLE_NAME_PATTERN,
+                    "Use letters, digits, underscores; cannot start with a digit.",
+                  ),
+                },
+              }}
+            >
+              {(control) => (
+                <Input {...textControl(control)} placeholder="e.g. DB_PROTOCOL" className="rounded-md font-mono" />
+              )}
+            </MountedFormField>
+            <div style={{ flex: 1 }}>
+              <ScopedValueOrDescription index={index} />
+            </div>
+            <MountedFormField name={["env_vars", String(index), "scope"]} className="mb-0 w-40" defaultValue="global">
+              {(control) => <Select {...selectControl<string>(control)} options={SCOPE_OPTIONS} />}
+            </MountedFormField>
+            <div style={{ width: 24, height: 32 }} className="flex items-center justify-center">
+              <MinusCircleOutlined
+                onClick={() => remove(index)}
+                className="text-gray-500 hover:text-red-500 cursor-pointer"
+              />
+            </div>
+          </div>
+        ))}
+        <Button type="dashed" onClick={() => append({ scope: "global" })} icon={<PlusOutlined />} block>
+          Add Variable
+        </Button>
+      </div>
     </div>
   );
 };
@@ -109,33 +117,33 @@ const EnvVarsSection: React.FC = () => {
 // For instance-scoped vars this column holds the admin value. For per-user
 // vars the value comes from each user later, so the column instead captures an
 // optional description that the per-user fill-in modal shows as a hint.
-const ScopedValueOrDescription: React.FC<{
-  name: number;
-  restField: object;
-}> = ({ name, restField }) => {
-  const isPerUser = Form.useWatch(["env_vars", name, "scope"]) === "user";
+const ScopedValueOrDescription: React.FC<{ index: number }> = ({ index }) => {
+  const isPerUser = useWatch({ name: `env_vars.${index}.scope` }) === "user";
   if (isPerUser) {
     return (
-      <Form.Item {...restField} name={[name, "description"]} className="mb-0">
-        <Input
-          addonBefore={
-            <Tooltip title="Per-user variables have no shared value. This text is only a hint shown to each user when they fill in their own value.">
-              <span className="text-xs text-gray-500 cursor-help whitespace-nowrap">
-                <InfoCircleOutlined className="mr-1" />
-                Hint
-              </span>
-            </Tooltip>
-          }
-          placeholder="e.g. Your DB username"
-          styles={{ input: { color: "#9ca3af" } }}
-        />
-      </Form.Item>
+      <MountedFormField name={["env_vars", String(index), "description"]} className="mb-0">
+        {(control) => (
+          <Input
+            {...textControl(control)}
+            addonBefore={
+              <Tooltip title="Per-user variables have no shared value. This text is only a hint shown to each user when they fill in their own value.">
+                <span className="text-xs text-gray-500 cursor-help whitespace-nowrap">
+                  <InfoCircleOutlined className="mr-1" />
+                  Hint
+                </span>
+              </Tooltip>
+            }
+            placeholder="e.g. Your DB username"
+            styles={{ input: { color: "#9ca3af" } }}
+          />
+        )}
+      </MountedFormField>
     );
   }
   return (
-    <Form.Item {...restField} name={[name, "value"]} className="mb-0">
-      <Input placeholder="e.g. postgresql" className="rounded-md font-mono" />
-    </Form.Item>
+    <MountedFormField name={["env_vars", String(index), "value"]} className="mb-0">
+      {(control) => <Input {...textControl(control)} placeholder="e.g. postgresql" className="rounded-md font-mono" />}
+    </MountedFormField>
   );
 };
 
diff --git a/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/IdJagFormFields.tsx b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/IdJagFormFields.tsx
index e8730a5b974..9a6f4ab571f 100644
--- a/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/IdJagFormFields.tsx
+++ b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/IdJagFormFields.tsx
@@ -1,7 +1,11 @@
 import React from "react";
-import { Form, Input, Select, Tooltip } from "antd";
+import { Input, Select, Tooltip } from "antd";
 import { InfoCircleOutlined } from "@ant-design/icons";
 
+import { MountedFormField } from "@/components/common_components/MountedFormField";
+import { antdRequired } from "@/components/common_components/antdFormRules";
+import { requiredUnlessSiblingSet, selectControl, textControl } from "./mcpFieldRules";
+
 interface IdJagFormFieldsProps {
   isEditing?: boolean;
 }
@@ -17,12 +21,16 @@ const FieldLabel: React.FC<{ label: string; tooltip: string }> = ({ label, toolt
   </span>
 );
 
+const PRIVATE_KEY_PATH = ["credentials", "client_private_key"] as const;
+
 const IdJagFormFields: React.FC<IdJagFormFieldsProps> = ({ isEditing = false }) => {
   const placeholderSuffix = isEditing ? " (leave blank to keep existing)" : "";
+  const requiredWhenCreating = (message: string) =>
+    isEditing ? undefined : { validate: { required: antdRequired(message) } };
 
   return (
     <>
-      <Form.Item
+      <MountedFormField
         label={
           <FieldLabel
             label="Org Token Endpoint (leg 1)"
@@ -30,11 +38,18 @@ const IdJagFormFields: React.FC<IdJagFormFieldsProps> = ({ isEditing = false })
           />
         }
         name="token_exchange_endpoint"
-        rules={[{ required: !isEditing, message: "The org token endpoint is required for ID-JAG" }]}
+        required={!isEditing}
+        rules={requiredWhenCreating("The org token endpoint is required for ID-JAG")}
       >
-        <Input placeholder="https://your-org.okta.com/oauth2/v1/token" className={fieldClassName} />
-      </Form.Item>
-      <Form.Item
+        {(control) => (
+          <Input
+            {...textControl(control)}
+            placeholder="https://your-org.okta.com/oauth2/v1/token"
+            className={fieldClassName}
+          />
+        )}
+      </MountedFormField>
+      <MountedFormField
         label={
           <FieldLabel
             label="Resource Token Endpoint (leg 2)"
@@ -42,18 +57,32 @@ const IdJagFormFields: React.FC<IdJagFormFieldsProps> = ({ isEditing = false })
           />
         }
         name={["credentials", "id_jag_resource_token_endpoint"]}
-        rules={[{ required: !isEditing, message: "The resource token endpoint is required for ID-JAG" }]}
+        required={!isEditing}
+        rules={requiredWhenCreating("The resource token endpoint is required for ID-JAG")}
       >
-        <Input placeholder="https://upstream.example.com/oauth2/token" className={fieldClassName} />
-      </Form.Item>
-      <Form.Item
+        {(control) => (
+          <Input
+            {...textControl(control)}
+            placeholder="https://upstream.example.com/oauth2/token"
+            className={fieldClassName}
+          />
+        )}
+      </MountedFormField>
+      <MountedFormField
         label={<FieldLabel label="Client ID" tooltip="OAuth2 client ID LiteLLM authenticates as on both legs." />}
         name={["credentials", "client_id"]}
-        rules={[{ required: !isEditing, message: "Client ID is required for ID-JAG" }]}
+        required={!isEditing}
+        rules={requiredWhenCreating("Client ID is required for ID-JAG")}
       >
-        <Input.Password placeholder={`Enter OAuth client ID${placeholderSuffix}`} className={fieldClassName} />
-      </Form.Item>
-      <Form.Item
+        {(control) => (
+          <Input.Password
+            {...textControl(control)}
+            placeholder={`Enter OAuth client ID${placeholderSuffix}`}
+            className={fieldClassName}
+          />
+        )}
+      </MountedFormField>
+      <MountedFormField
         label={
           <FieldLabel
             label="Client Secret"
@@ -61,36 +90,47 @@ const IdJagFormFields: React.FC<IdJagFormFieldsProps> = ({ isEditing = false })
           />
         }
         name={["credentials", "client_secret"]}
-        dependencies={[["credentials", "client_private_key"]]}
-        rules={[
-          ({ getFieldValue }) => ({
-            validator: (_, value) => {
-              if (isEditing || value || getFieldValue(["credentials", "client_private_key"])) {
-                return Promise.resolve();
+        rules={
+          isEditing
+            ? undefined
+            : {
+                deps: ["credentials.client_private_key"],
+                validate: {
+                  secretOrPrivateKey: requiredUnlessSiblingSet(
+                    PRIVATE_KEY_PATH,
+                    "Provide either a client secret or a client private key",
+                  ),
+                },
               }
-              return Promise.reject(new Error("Provide either a client secret or a client private key"));
-            },
-          }),
-        ]}
+        }
       >
-        <Input.Password placeholder={`Enter OAuth client secret${placeholderSuffix}`} className={fieldClassName} />
-      </Form.Item>
-      <Form.Item
+        {(control) => (
+          <Input.Password
+            {...textControl(control)}
+            placeholder={`Enter OAuth client secret${placeholderSuffix}`}
+            className={fieldClassName}
+          />
+        )}
+      </MountedFormField>
+      <MountedFormField
         label={
           <FieldLabel
             label="Client Private Key (PEM)"
             tooltip="PEM private key signing the RFC 7523 private_key_jwt client assertion. Okta Cross App Access normally requires this. When set it takes precedence over the client secret."
           />
         }
-        name={["credentials", "client_private_key"]}
+        name={PRIVATE_KEY_PATH}
       >
-        <Input.TextArea
-          rows={3}
-          placeholder={`-----BEGIN PRIVATE KEY-----${placeholderSuffix}`}
-          className={fieldClassName}
-        />
-      </Form.Item>
-      <Form.Item
+        {(control) => (
+          <Input.TextArea
+            {...textControl(control)}
+            rows={3}
+            placeholder={`-----BEGIN PRIVATE KEY-----${placeholderSuffix}`}
+            className={fieldClassName}
+          />
+        )}
+      </MountedFormField>
+      <MountedFormField
         label={
           <FieldLabel
             label="Private Key ID (optional)"
@@ -99,9 +139,9 @@ const IdJagFormFields: React.FC<IdJagFormFieldsProps> = ({ isEditing = false })
         }
         name={["credentials", "client_private_key_id"]}
       >
-        <Input placeholder="my-signing-key-1" className={fieldClassName} />
-      </Form.Item>
-      <Form.Item
+        {(control) => <Input {...textControl(control)} placeholder="my-signing-key-1" className={fieldClassName} />}
+      </MountedFormField>
+      <MountedFormField
         label={
           <FieldLabel
             label="Client Assertion Signing Algorithm (optional)"
@@ -110,9 +150,9 @@ const IdJagFormFields: React.FC<IdJagFormFieldsProps> = ({ isEditing = false })
         }
         name={["credentials", "client_assertion_signing_alg"]}
       >
-        <Input placeholder="RS256" className={fieldClassName} />
-      </Form.Item>
-      <Form.Item
+        {(control) => <Input {...textControl(control)} placeholder="RS256" className={fieldClassName} />}
+      </MountedFormField>
+      <MountedFormField
         label={
           <FieldLabel
             label="Audience (optional)"
@@ -121,9 +161,11 @@ const IdJagFormFields: React.FC<IdJagFormFieldsProps> = ({ isEditing = false })
         }
         name="audience"
       >
-        <Input placeholder="https://upstream.example.com" className={fieldClassName} />
-      </Form.Item>
-      <Form.Item
+        {(control) => (
+          <Input {...textControl(control)} placeholder="https://upstream.example.com" className={fieldClassName} />
+        )}
+      </MountedFormField>
+      <MountedFormField
         label={
           <FieldLabel
             label="Resource Indicator (optional)"
@@ -132,9 +174,11 @@ const IdJagFormFields: React.FC<IdJagFormFieldsProps> = ({ isEditing = false })
         }
         name={["credentials", "id_jag_resource"]}
       >
-        <Input placeholder="https://upstream.example.com/mcp" className={fieldClassName} />
-      </Form.Item>
-      <Form.Item
+        {(control) => (
+          <Input {...textControl(control)} placeholder="https://upstream.example.com/mcp" className={fieldClassName} />
+        )}
+      </MountedFormField>
+      <MountedFormField
         label={
           <FieldLabel
             label="Subject Token Type (optional)"
@@ -143,14 +187,29 @@ const IdJagFormFields: React.FC<IdJagFormFieldsProps> = ({ isEditing = false })
         }
         name="subject_token_type"
       >
-        <Input placeholder="urn:ietf:params:oauth:token-type:id_token" className={fieldClassName} />
-      </Form.Item>
-      <Form.Item
+        {(control) => (
+          <Input
+            {...textControl(control)}
+            placeholder="urn:ietf:params:oauth:token-type:id_token"
+            className={fieldClassName}
+          />
+        )}
+      </MountedFormField>
+      <MountedFormField
         label={<FieldLabel label="Scopes (optional)" tooltip="Scopes requested on leg 1 of the exchange." />}
         name={["credentials", "scopes"]}
       >
-        <Select mode="tags" tokenSeparators={[","]} placeholder="Add scopes" className="rounded-lg" size="large" />
-      </Form.Item>
+        {(control) => (
+          <Select
+            {...selectControl(control)}
+            mode="tags"
+            tokenSeparators={[","]}
+            placeholder="Add scopes"
+            className="rounded-lg"
+            size="large"
+          />
+        )}
+      </MountedFormField>
     </>
   );
 };
diff --git a/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/MCPPermissionManagement.test.tsx b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/MCPPermissionManagement.test.tsx
index ee6aee86a4d..7d36872cee8 100644
--- a/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/MCPPermissionManagement.test.tsx
+++ b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/MCPPermissionManagement.test.tsx
@@ -1,10 +1,10 @@
 import React from "react";
-import { render, screen } from "@testing-library/react";
+import { screen } from "@testing-library/react";
 import userEvent from "@testing-library/user-event";
 import { describe, it, expect } from "vitest";
-import { Form } from "antd";
 
 import MCPPermissionManagement from "./MCPPermissionManagement";
+import { renderInMcpForm } from "./McpFormTestHarness";
 
 const defaultProps = {
   availableAccessGroups: [],
@@ -12,6 +12,7 @@ const defaultProps = {
   searchValue: "",
   setSearchValue: () => {},
   getAccessGroupOptions: () => [],
+  mountedAuthType: undefined,
 };
 
 describe("MCPPermissionManagement", () => {
@@ -24,22 +25,8 @@ describe("MCPPermissionManagement", () => {
     return user;
   };
 
-  const renderWithForm = (props = {}) => {
-    const Wrapper: React.FC = ({ children }) => {
-      const [form] = Form.useForm();
-      return (
-        <Form form={form} initialValues={{ allow_all_keys: false }}>
-          {children}
-        </Form>
-      );
-    };
-
-    return render(
-      <Wrapper>
-        <MCPPermissionManagement {...defaultProps} {...props} />
-      </Wrapper>,
-    );
-  };
+  const renderWithForm = (props = {}) =>
+    renderInMcpForm(<MCPPermissionManagement {...defaultProps} {...props} />, { allow_all_keys: false });
 
   it("should default allow_all_keys switch to unchecked for new servers", async () => {
     renderWithForm();
@@ -51,27 +38,15 @@ describe("MCPPermissionManagement", () => {
     expect(toggle).not.toBeChecked();
   });
 
-  const renderWithInitialValues = (initialValues: Record<string, unknown>, props = {}) => {
-    const Wrapper: React.FC = ({ children }) => {
-      const [form] = Form.useForm();
-      return (
-        <Form form={form} initialValues={initialValues}>
-          {/* In the real app auth_type is registered by the parent form; the
-              component only watches it. Register a hidden field here so
-              Form.useWatch("auth_type") resolves the initial value. */}
-          <Form.Item name="auth_type" hidden>
-            <input />
-          </Form.Item>
-          {children}
-        </Form>
-      );
-    };
-    return render(
-      <Wrapper>
-        <MCPPermissionManagement {...defaultProps} {...props} />
-      </Wrapper>,
+  const renderWithInitialValues = (initialValues: Record<string, unknown>, props = {}) =>
+    renderInMcpForm(
+      <MCPPermissionManagement
+        {...defaultProps}
+        mountedAuthType={initialValues.auth_type as string | undefined}
+        {...props}
+      />,
+      initialValues,
     );
-  };
 
   it("shows only the oauth2 PKCE-delegation toggle for oauth2 servers", async () => {
     renderWithInitialValues({ allow_all_keys: false, auth_type: "oauth2" });
diff --git a/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/MCPPermissionManagement.tsx b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/MCPPermissionManagement.tsx
index aae13d4b467..3711140562f 100644
--- a/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/MCPPermissionManagement.tsx
+++ b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/MCPPermissionManagement.tsx
@@ -1,7 +1,17 @@
 import React, { useEffect } from "react";
-import { Alert, Form, Select, Tooltip, Collapse, Input, Space, Button, Switch } from "antd";
+import { Alert, Select, Tooltip, Collapse, Input, Space, Button, Switch } from "antd";
 import { InfoCircleOutlined, MinusCircleOutlined, PlusOutlined } from "@ant-design/icons";
+import { useFieldArray, useFormContext, useWatch } from "react-hook-form";
 import { MCPServer, AUTH_TYPE } from "@/components/mcp_tools/types";
+import {
+  MountedFormField,
+  useMountedName,
+  type MountedFormValues,
+} from "@/components/common_components/MountedFormField";
+import { antdRequired } from "@/components/common_components/antdFormRules";
+import { Field, FieldLabel } from "@/components/shared/form/field";
+import { invertedSwitchControl, selectControl, switchControl, textControl } from "./mcpFieldRules";
+import { listControl } from "./mcpFormStore";
 const { Panel } = Collapse;
 
 interface MCPPermissionManagementProps {
@@ -13,20 +23,79 @@ interface MCPPermissionManagementProps {
     value: string;
     label: React.ReactNode;
   }>;
+  /**
+   * The auth type as seen through the gate that mounts the auth_type field.
+   * Callers pass undefined whenever that field is unmounted, because both
+   * toggles below are mounted from this value and the payload only carries
+   * what is mounted.
+   */
+  mountedAuthType: string | null | undefined;
 }
 
+const StaticHeadersFieldArray: React.FC = () => {
+  const { control } = useFormContext<MountedFormValues>();
+  const { fields, append, remove } = useFieldArray({ control: listControl(control), name: "static_headers" });
+  useMountedName("static_headers");
+
+  return (
+    <div className="space-y-3">
+      {fields.map((item, index) => (
+        <Space key={item.id} className="flex w-full" align="baseline" size="middle">
+          <MountedFormField
+            name={["static_headers", String(index), "header"]}
+            className="flex-1"
+            rules={{ validate: { required: antdRequired("Header name is required") } }}
+          >
+            {(headerControl) => (
+              <Input
+                {...textControl(headerControl)}
+                size="large"
+                allowClear
+                className="rounded-lg"
+                placeholder="Header name (e.g., X-API-Key)"
+              />
+            )}
+          </MountedFormField>
+          <MountedFormField
+            name={["static_headers", String(index), "value"]}
+            className="flex-1"
+            rules={{ validate: { required: antdRequired("Header value is required") } }}
+          >
+            {(valueControl) => (
+              <Input
+                {...textControl(valueControl)}
+                size="large"
+                allowClear
+                className="rounded-lg"
+                placeholder="Header value"
+              />
+            )}
+          </MountedFormField>
+          <MinusCircleOutlined
+            onClick={() => remove(index)}
+            className="text-gray-500 hover:text-red-500 cursor-pointer"
+          />
+        </Space>
+      ))}
+      <Button type="dashed" onClick={() => append({})} icon={<PlusOutlined />} block>
+        Add Static Header
+      </Button>
+    </div>
+  );
+};
+
 const MCPPermissionManagement: React.FC<MCPPermissionManagementProps> = ({
   availableAccessGroups,
   mcpServer,
   searchValue,
   setSearchValue,
   getAccessGroupOptions,
+  mountedAuthType,
 }) => {
-  const form = Form.useFormInstance();
-  const watchedAuthType = Form.useWatch("auth_type", form);
-  const isOAuth2 = watchedAuthType === AUTH_TYPE.OAUTH2;
-  const isNoneAuth = watchedAuthType === AUTH_TYPE.NONE || watchedAuthType == null;
-  const watchedExtraHeaders = Form.useWatch("extra_headers", form);
+  const { setValue } = useFormContext<MountedFormValues>();
+  const isOAuth2 = mountedAuthType === AUTH_TYPE.OAUTH2;
+  const isNoneAuth = mountedAuthType === AUTH_TYPE.NONE || mountedAuthType == null;
+  const watchedExtraHeaders = useWatch({ name: "extra_headers" });
   const hasAuthorizationHeader =
     Array.isArray(watchedExtraHeaders) &&
     watchedExtraHeaders.some((h) => typeof h === "string" && h.toLowerCase() === "authorization");
@@ -39,8 +108,8 @@ const MCPPermissionManagement: React.FC<MCPPermissionManagementProps> = ({
   // Kept as separate flags so neither silently implies the other and existing
   // oauth2 servers can't regress into pass-through behavior.
   const canEnableOAuthPassthrough = isNoneAuth && hasAuthorizationHeader;
-  const watchedDelegateAuth = Form.useWatch("delegate_auth_to_upstream", form);
-  const watchedPublicInternet = Form.useWatch("available_on_public_internet", form);
+  const watchedDelegateAuth = useWatch({ name: "delegate_auth_to_upstream" });
+  const watchedPublicInternet = useWatch({ name: "available_on_public_internet" });
   const showInternalDelegatePkceWarning = isOAuth2 && watchedDelegateAuth === true && watchedPublicInternet === false;
 
   // Set initial values when mcpServer changes
@@ -51,10 +120,10 @@ const MCPPermissionManagement: React.FC<MCPPermissionManagementProps> = ({
           header,
           value: value != null ? String(value) : "",
         }));
-        form.setFieldValue("static_headers", staticHeaders);
+        setValue("static_headers", staticHeaders);
       }
       if (Array.isArray(mcpServer.env_vars) && mcpServer.env_vars.length > 0) {
-        form.setFieldValue(
+        setValue(
           "env_vars",
           mcpServer.env_vars.map((entry) => ({
             name: entry.name,
@@ -65,41 +134,41 @@ const MCPPermissionManagement: React.FC<MCPPermissionManagementProps> = ({
         );
       }
       if (typeof mcpServer.allow_all_keys === "boolean") {
-        form.setFieldValue("allow_all_keys", mcpServer.allow_all_keys);
+        setValue("allow_all_keys", mcpServer.allow_all_keys);
       }
       if (typeof mcpServer.available_on_public_internet === "boolean") {
-        form.setFieldValue("available_on_public_internet", mcpServer.available_on_public_internet);
+        setValue("available_on_public_internet", mcpServer.available_on_public_internet);
       }
       if (typeof mcpServer.delegate_auth_to_upstream === "boolean") {
-        form.setFieldValue("delegate_auth_to_upstream", mcpServer.delegate_auth_to_upstream);
+        setValue("delegate_auth_to_upstream", mcpServer.delegate_auth_to_upstream);
       }
       if (typeof mcpServer.oauth_passthrough === "boolean") {
-        form.setFieldValue("oauth_passthrough", mcpServer.oauth_passthrough);
+        setValue("oauth_passthrough", mcpServer.oauth_passthrough);
       }
     } else {
-      form.setFieldValue("allow_all_keys", false);
-      form.setFieldValue("available_on_public_internet", true);
-      form.setFieldValue("delegate_auth_to_upstream", false);
-      form.setFieldValue("oauth_passthrough", false);
+      setValue("allow_all_keys", false);
+      setValue("available_on_public_internet", true);
+      setValue("delegate_auth_to_upstream", false);
+      setValue("oauth_passthrough", false);
     }
-  }, [mcpServer, form]);
+  }, [mcpServer, setValue]);
 
   // delegate_auth_to_upstream is only honored server-side for oauth2 servers.
   // Force it back to false whenever the user switches away from oauth2 so a
   // stale toggle value doesn't get persisted unexpectedly.
   useEffect(() => {
     if (!isOAuth2) {
-      form.setFieldValue("delegate_auth_to_upstream", false);
+      setValue("delegate_auth_to_upstream", false);
     }
-  }, [isOAuth2, form]);
+  }, [isOAuth2, setValue]);
 
   // oauth_passthrough is only honored for auth_type=none servers that forward
   // Authorization upstream. Force it back to false otherwise.
   useEffect(() => {
     if (!canEnableOAuthPassthrough) {
-      form.setFieldValue("oauth_passthrough", false);
+      setValue("oauth_passthrough", false);
     }
-  }, [canEnableOAuthPassthrough, form]);
+  }, [canEnableOAuthPassthrough, setValue]);
 
   return (
     <Collapse className="bg-gray-50 border border-gray-200 rounded-lg" expandIconPosition="end" ghost={false}>
@@ -130,14 +199,9 @@ const MCPPermissionManagement: React.FC<MCPPermissionManagementProps> = ({
                 Enable if this server should be &quot;public&quot; to all keys.
               </p>
             </div>
-            <Form.Item
-              name="allow_all_keys"
-              valuePropName="checked"
-              initialValue={mcpServer?.allow_all_keys ?? false}
-              className="mb-0"
-            >
-              <Switch />
-            </Form.Item>
+            <MountedFormField name="allow_all_keys" defaultValue={mcpServer?.allow_all_keys ?? false} className="mb-0">
+              {(control) => <Switch {...switchControl(control)} />}
+            </MountedFormField>
           </div>
 
           <div className="flex items-start justify-between gap-4">
@@ -152,16 +216,9 @@ const MCPPermissionManagement: React.FC<MCPPermissionManagementProps> = ({
                 Turn on to restrict access to callers within your internal network only.
               </p>
             </div>
-            <Form.Item
-              name="available_on_public_internet"
-              valuePropName="checked"
-              getValueProps={(value) => ({ checked: !value })}
-              getValueFromEvent={(checked: boolean) => !checked}
-              initialValue={true}
-              className="mb-0"
-            >
-              <Switch />
-            </Form.Item>
+            <MountedFormField name="available_on_public_internet" defaultValue={true} className="mb-0">
+              {(control) => <Switch {...invertedSwitchControl(control)} />}
+            </MountedFormField>
           </div>
 
           {isOAuth2 && (
@@ -177,14 +234,13 @@ const MCPPermissionManagement: React.FC<MCPPermissionManagementProps> = ({
                   Bypass LiteLLM auth so clients authenticate directly with the upstream OAuth MCP server.
                 </p>
               </div>
-              <Form.Item
+              <MountedFormField
                 name="delegate_auth_to_upstream"
-                valuePropName="checked"
-                initialValue={mcpServer?.delegate_auth_to_upstream ?? false}
+                defaultValue={mcpServer?.delegate_auth_to_upstream ?? false}
                 className="mb-0"
               >
-                <Switch />
-              </Form.Item>
+                {(control) => <Switch {...switchControl(control)} />}
+              </MountedFormField>
             </div>
           )}
 
@@ -202,14 +258,13 @@ const MCPPermissionManagement: React.FC<MCPPermissionManagementProps> = ({
                   upstream MCP server.
                 </p>
               </div>
-              <Form.Item
+              <MountedFormField
                 name="oauth_passthrough"
-                valuePropName="checked"
-                initialValue={mcpServer?.oauth_passthrough ?? false}
+                defaultValue={mcpServer?.oauth_passthrough ?? false}
                 className="mb-0"
               >
-                <Switch />
-              </Form.Item>
+                {(control) => <Switch {...switchControl(control)} />}
+              </MountedFormField>
             </div>
           )}
 
@@ -223,7 +278,7 @@ const MCPPermissionManagement: React.FC<MCPPermissionManagementProps> = ({
             />
           )}
 
-          <Form.Item
+          <MountedFormField
             label={
               <span className="text-sm font-medium text-gray-700 flex items-center">
                 MCP Access Groups
@@ -235,21 +290,24 @@ const MCPPermissionManagement: React.FC<MCPPermissionManagementProps> = ({
             name="mcp_access_groups"
             className="mb-4"
           >
-            <Select
-              mode="tags"
-              showSearch
-              placeholder="Select existing groups or type to create new ones"
-              optionFilterProp="value"
-              filterOption={(input, option) => (option?.value ?? "").toLowerCase().includes(input.toLowerCase())}
-              onSearch={(value) => setSearchValue(value)}
-              tokenSeparators={[","]}
-              options={getAccessGroupOptions()}
-              maxTagCount="responsive"
-              allowClear
-            />
-          </Form.Item>
+            {(control) => (
+              <Select
+                {...selectControl(control)}
+                mode="tags"
+                showSearch
+                placeholder="Select existing groups or type to create new ones"
+                optionFilterProp="value"
+                filterOption={(input, option) => (option?.value ?? "").toLowerCase().includes(input.toLowerCase())}
+                onSearch={(value) => setSearchValue(value)}
+                tokenSeparators={[","]}
+                options={getAccessGroupOptions()}
+                maxTagCount="responsive"
+                allowClear
+              />
+            )}
+          </MountedFormField>
 
-          <Form.Item
+          <MountedFormField
             label={
               <span className="text-sm font-medium text-gray-700 flex items-center">
                 Extra Headers
@@ -265,70 +323,34 @@ const MCPPermissionManagement: React.FC<MCPPermissionManagementProps> = ({
             }
             name="extra_headers"
           >
-            <Select
-              mode="tags"
-              placeholder={
-                mcpServer?.extra_headers && mcpServer.extra_headers.length > 0
-                  ? `Currently: ${mcpServer.extra_headers.join(", ")}`
-                  : "Enter header names (e.g., Authorization, X-Custom-Header)"
-              }
-              className="rounded-lg"
-              size="large"
-              tokenSeparators={[","]}
-              allowClear
-            />
-          </Form.Item>
+            {(control) => (
+              <Select
+                {...selectControl(control)}
+                mode="tags"
+                placeholder={
+                  mcpServer?.extra_headers && mcpServer.extra_headers.length > 0
+                    ? `Currently: ${mcpServer.extra_headers.join(", ")}`
+                    : "Enter header names (e.g., Authorization, X-Custom-Header)"
+                }
+                className="rounded-lg"
+                size="large"
+                tokenSeparators={[","]}
+                allowClear
+              />
+            )}
+          </MountedFormField>
 
-          <Form.Item
-            label={
+          <Field>
+            <FieldLabel>
               <span className="text-sm font-medium text-gray-700 flex items-center">
                 Static Headers
                 <Tooltip title="Send these key-value headers with every request to this MCP server.">
                   <InfoCircleOutlined className="ml-2 text-blue-400 hover:text-blue-600 cursor-help" />
                 </Tooltip>
               </span>
-            }
-            required={false}
-          >
-            <Form.List name="static_headers">
-              {(fields, { add, remove }) => (
-                <div className="space-y-3">
-                  {fields.map(({ key, name, ...restField }) => (
-                    <Space key={key} className="flex w-full" align="baseline" size="middle">
-                      <Form.Item
-                        {...restField}
-                        name={[name, "header"]}
-                        className="flex-1"
-                        rules={[{ required: true, message: "Header name is required" }]}
-                      >
-                        <Input
-                          size="large"
-                          allowClear
-                          className="rounded-lg"
-                          placeholder="Header name (e.g., X-API-Key)"
-                        />
-                      </Form.Item>
-                      <Form.Item
-                        {...restField}
-                        name={[name, "value"]}
-                        className="flex-1"
-                        rules={[{ required: true, message: "Header value is required" }]}
-                      >
-                        <Input size="large" allowClear className="rounded-lg" placeholder="Header value" />
-                      </Form.Item>
-                      <MinusCircleOutlined
-                        onClick={() => remove(name)}
-                        className="text-gray-500 hover:text-red-500 cursor-pointer"
-                      />
-                    </Space>
-                  ))}
-                  <Button type="dashed" onClick={() => add()} icon={<PlusOutlined />} block>
-                    Add Static Header
-                  </Button>
-                </div>
-              )}
-            </Form.List>
-          </Form.Item>
+            </FieldLabel>
+            <StaticHeadersFieldArray />
+          </Field>
         </div>
       </Panel>
     </Collapse>
diff --git a/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/McpFormTestHarness.tsx b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/McpFormTestHarness.tsx
new file mode 100644
index 00000000000..0529c9c7c61
--- /dev/null
+++ b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/McpFormTestHarness.tsx
@@ -0,0 +1,37 @@
+import * as React from "react";
+import { render, type RenderResult } from "@testing-library/react";
+import { FormProvider, useForm } from "react-hook-form";
+
+import {
+  MountedFormProvider,
+  projectMountedValues,
+  useMountRegistry,
+  type MountedFormValues,
+} from "@/components/common_components/MountedFormField";
+
+export const McpFormHarness: React.FC<{
+  defaultValues?: MountedFormValues;
+  onFinish?: (values: MountedFormValues) => void;
+  children: React.ReactNode;
+}> = ({ defaultValues, onFinish, children }) => {
+  const form = useForm<MountedFormValues>({ mode: "onChange", defaultValues });
+  const registry = useMountRegistry();
+  return (
+    <FormProvider {...form}>
+      <MountedFormProvider value={{ control: form.control, registry }}>
+        <form
+          onSubmit={(event) => {
+            event.preventDefault();
+            onFinish?.(projectMountedValues(registry, form.getValues));
+          }}
+        >
+          {children}
+          <button type="submit">Submit</button>
+        </form>
+      </MountedFormProvider>
+    </FormProvider>
+  );
+};
+
+export const renderInMcpForm = (ui: React.ReactNode, defaultValues: MountedFormValues = {}): RenderResult =>
+  render(<McpFormHarness defaultValues={defaultValues}>{ui}</McpFormHarness>);
diff --git a/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/OAuthFormFields.test.tsx b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/OAuthFormFields.test.tsx
index 48964490339..21bb2801e8c 100644
--- a/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/OAuthFormFields.test.tsx
+++ b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/OAuthFormFields.test.tsx
@@ -1,24 +1,8 @@
 import React from "react";
 import { describe, it, expect, vi, beforeEach } from "vitest";
 import { render, screen, waitFor, act, fireEvent } from "@testing-library/react";
-import { Form } from "antd";
 import OAuthFormFields from "./OAuthFormFields";
-
-// ── helpers ──────────────────────────────────────────────────────────────────
-
-/** Minimal Ant Form wrapper so Form.Item registers correctly. */
-const WithForm: React.FC<{ children: React.ReactNode; onFinish?: (values: any) => void }> = ({
-  children,
-  onFinish,
-}) => {
-  const [form] = Form.useForm();
-  return (
-    <Form form={form} onFinish={onFinish}>
-      {children}
-      <button type="submit">Submit</button>
-    </Form>
-  );
-};
+import { McpFormHarness as WithForm } from "./McpFormTestHarness";
 
 // ── tests ─────────────────────────────────────────────────────────────────────
 
diff --git a/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/OAuthFormFields.tsx b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/OAuthFormFields.tsx
index cbe6ac18d22..545efb910c4 100644
--- a/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/OAuthFormFields.tsx
+++ b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/OAuthFormFields.tsx
@@ -1,10 +1,13 @@
 import React from "react";
-import { Form, Input as AntdInput, InputNumber, Select, Tooltip } from "antd";
+import { Input as AntdInput, InputNumber, Select, Tooltip } from "antd";
 import { InfoCircleOutlined } from "@ant-design/icons";
 import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
 import { OAUTH_FLOW } from "@/components/mcp_tools/types";
+import { MountedFormField } from "@/components/common_components/MountedFormField";
+import { antdRequired } from "@/components/common_components/antdFormRules";
 import TokenEndpointAuthMethodField from "./TokenEndpointAuthMethodField";
+import { numberControl, parsesAsJson, selectControl, textControl } from "./mcpFieldRules";
 
 interface OAuthFlowStatus {
   startOAuthFlow: () => void;
@@ -41,12 +44,14 @@ const FieldLabel: React.FC<{ label: string; tooltip: string }> = ({ label, toolt
 );
 
 const UpstreamResourceField: React.FC = () => (
-  <Form.Item
+  <MountedFormField
     label={<FieldLabel label="Resource Indicator (optional)" tooltip={UPSTREAM_RESOURCE_TOOLTIP} />}
     name={["credentials", "upstream_resource"]}
   >
-    <Input placeholder="auto, or https://mcp.example.com/mcp" className={fieldClassName} />
-  </Form.Item>
+    {(control) => (
+      <Input {...textControl(control)} placeholder="auto, or https://mcp.example.com/mcp" className={fieldClassName} />
+    )}
+  </MountedFormField>
 );
 
 const OAuthFormFields: React.FC<OAuthFormFieldsProps> = ({
@@ -57,11 +62,12 @@ const OAuthFormFields: React.FC<OAuthFormFieldsProps> = ({
   docsUrl,
 }) => {
   const placeholderSuffix = isEditing ? " (leave blank to keep existing)" : "";
-  const requiredWhenCreating = (message: string) => (isEditing ? [] : [{ required: true, message }]);
+  const requiredWhenCreating = (message: string) =>
+    isEditing ? undefined : { validate: { required: antdRequired(message) } };
 
   return (
     <>
-      <Form.Item
+      <MountedFormField
         label={
           <FieldLabel
             label="OAuth Flow Type"
@@ -69,54 +75,74 @@ const OAuthFormFields: React.FC<OAuthFormFieldsProps> = ({
           />
         }
         name="oauth_flow_type"
-        {...(initialFlowType ? { initialValue: initialFlowType } : {})}
+        {...(initialFlowType ? { defaultValue: initialFlowType } : {})}
       >
-        <Select placeholder="Select OAuth flow" className="rounded-lg" size="large">
-          <Select.Option value={OAUTH_FLOW.M2M}>
-            <div>
-              <span className="font-medium">Machine-to-Machine (M2M)</span>
-              <span className="text-gray-400 text-xs ml-2">server-to-server, no user interaction</span>
-            </div>
-          </Select.Option>
-          <Select.Option value={OAUTH_FLOW.INTERACTIVE}>
-            <div>
-              <span className="font-medium">Interactive (PKCE)</span>
-              <span className="text-gray-400 text-xs ml-2">browser-based user authorization</span>
-            </div>
-          </Select.Option>
-        </Select>
-      </Form.Item>
+        {(control) => (
+          <Select {...selectControl(control)} placeholder="Select OAuth flow" className="rounded-lg" size="large">
+            <Select.Option value={OAUTH_FLOW.M2M}>
+              <div>
+                <span className="font-medium">Machine-to-Machine (M2M)</span>
+                <span className="text-gray-400 text-xs ml-2">server-to-server, no user interaction</span>
+              </div>
+            </Select.Option>
+            <Select.Option value={OAUTH_FLOW.INTERACTIVE}>
+              <div>
+                <span className="font-medium">Interactive (PKCE)</span>
+                <span className="text-gray-400 text-xs ml-2">browser-based user authorization</span>
+              </div>
+            </Select.Option>
+          </Select>
+        )}
+      </MountedFormField>
 
       {isM2M ? (
         <>
-          <Form.Item
+          <MountedFormField
             label={<FieldLabel label="Client ID" tooltip="OAuth2 client ID for the client_credentials grant." />}
             name={["credentials", "client_id"]}
+            required={!isEditing}
             rules={requiredWhenCreating("Client ID is required for M2M OAuth")}
           >
-            <AntdInput.Password placeholder={`Enter OAuth client ID${placeholderSuffix}`} className={fieldClassName} />
-          </Form.Item>
-          <Form.Item
+            {(control) => (
+              <AntdInput.Password
+                {...textControl(control)}
+                placeholder={`Enter OAuth client ID${placeholderSuffix}`}
+                className={fieldClassName}
+              />
+            )}
+          </MountedFormField>
+          <MountedFormField
             label={
               <FieldLabel label="Client Secret" tooltip="OAuth2 client secret for the client_credentials grant." />
             }
             name={["credentials", "client_secret"]}
+            required={!isEditing}
             rules={requiredWhenCreating("Client Secret is required for M2M OAuth")}
           >
-            <AntdInput.Password
-              placeholder={`Enter OAuth client secret${placeholderSuffix}`}
-              className={fieldClassName}
-            />
-          </Form.Item>
-          <Form.Item
+            {(control) => (
+              <AntdInput.Password
+                {...textControl(control)}
+                placeholder={`Enter OAuth client secret${placeholderSuffix}`}
+                className={fieldClassName}
+              />
+            )}
+          </MountedFormField>
+          <MountedFormField
             label={<FieldLabel label="Token URL" tooltip="Token endpoint URL for the client_credentials grant." />}
             name="token_url"
+            required={!isEditing}
             rules={requiredWhenCreating("Token URL is required for M2M OAuth")}
           >
-            <Input placeholder="https://auth.example.com/oauth/token" className={fieldClassName} />
-          </Form.Item>
+            {(control) => (
+              <Input
+                {...textControl(control)}
+                placeholder="https://auth.example.com/oauth/token"
+                className={fieldClassName}
+              />
+            )}
+          </MountedFormField>
           <TokenEndpointAuthMethodField isEditing={isEditing} />
-          <Form.Item
+          <MountedFormField
             label={
               <FieldLabel
                 label="Scopes (optional)"
@@ -125,13 +151,22 @@ const OAuthFormFields: React.FC<OAuthFormFieldsProps> = ({
             }
             name={["credentials", "scopes"]}
           >
-            <Select mode="tags" tokenSeparators={[","]} placeholder="Add scopes" className="rounded-lg" size="large" />
-          </Form.Item>
+            {(control) => (
+              <Select
+                {...selectControl(control)}
+                mode="tags"
+                tokenSeparators={[","]}
+                placeholder="Add scopes"
+                className="rounded-lg"
+                size="large"
+              />
+            )}
+          </MountedFormField>
           <UpstreamResourceField />
         </>
       ) : (
         <>
-          <Form.Item
+          <MountedFormField
             label={
               <span className="flex items-center justify-between w-full">
                 <FieldLabel
@@ -153,9 +188,15 @@ const OAuthFormFields: React.FC<OAuthFormFieldsProps> = ({
             }
             name={["credentials", "client_id"]}
           >
-            <AntdInput.Password placeholder={`Enter client ID${placeholderSuffix}`} className={fieldClassName} />
-          </Form.Item>
-          <Form.Item
+            {(control) => (
+              <AntdInput.Password
+                {...textControl(control)}
+                placeholder={`Enter client ID${placeholderSuffix}`}
+                className={fieldClassName}
+              />
+            )}
+          </MountedFormField>
+          <MountedFormField
             label={
               <FieldLabel
                 label="Client Secret (optional)"
@@ -164,9 +205,15 @@ const OAuthFormFields: React.FC<OAuthFormFieldsProps> = ({
             }
             name={["credentials", "client_secret"]}
           >
-            <AntdInput.Password placeholder={`Enter client secret${placeholderSuffix}`} className={fieldClassName} />
-          </Form.Item>
-          <Form.Item
+            {(control) => (
+              <AntdInput.Password
+                {...textControl(control)}
+                placeholder={`Enter client secret${placeholderSuffix}`}
+                className={fieldClassName}
+              />
+            )}
+          </MountedFormField>
+          <MountedFormField
             label={
               <FieldLabel
                 label="Scopes (optional)"
@@ -175,10 +222,19 @@ const OAuthFormFields: React.FC<OAuthFormFieldsProps> = ({
             }
             name={["credentials", "scopes"]}
           >
-            <Select mode="tags" tokenSeparators={[","]} placeholder="Add scopes" className="rounded-lg" size="large" />
-          </Form.Item>
+            {(control) => (
+              <Select
+                {...selectControl(control)}
+                mode="tags"
+                tokenSeparators={[","]}
+                placeholder="Add scopes"
+                className="rounded-lg"
+                size="large"
+              />
+            )}
+          </MountedFormField>
           <UpstreamResourceField />
-          <Form.Item
+          <MountedFormField
             label={
               <FieldLabel
                 label="Issuer (optional)"
@@ -187,9 +243,11 @@ const OAuthFormFields: React.FC<OAuthFormFieldsProps> = ({
             }
             name="issuer"
           >
-            <Input placeholder="https://issuer.example.com" className={fieldClassName} />
-          </Form.Item>
-          <Form.Item
+            {(control) => (
+              <Input {...textControl(control)} placeholder="https://issuer.example.com" className={fieldClassName} />
+            )}
+          </MountedFormField>
+          <MountedFormField
             label={
               <FieldLabel
                 label="Authorization URL (optional)"
@@ -198,16 +256,28 @@ const OAuthFormFields: React.FC<OAuthFormFieldsProps> = ({
             }
             name="authorization_url"
           >
-            <Input placeholder="https://example.com/oauth/authorize" className={fieldClassName} />
-          </Form.Item>
-          <Form.Item
+            {(control) => (
+              <Input
+                {...textControl(control)}
+                placeholder="https://example.com/oauth/authorize"
+                className={fieldClassName}
+              />
+            )}
+          </MountedFormField>
+          <MountedFormField
             label={<FieldLabel label="Token URL (optional)" tooltip="Optional override for the token endpoint." />}
             name="token_url"
           >
-            <Input placeholder="https://example.com/oauth/token" className={fieldClassName} />
-          </Form.Item>
+            {(control) => (
+              <Input
+                {...textControl(control)}
+                placeholder="https://example.com/oauth/token"
+                className={fieldClassName}
+              />
+            )}
+          </MountedFormField>
           <TokenEndpointAuthMethodField isEditing={isEditing} />
-          <Form.Item
+          <MountedFormField
             label={
               <FieldLabel
                 label="Registration URL (optional)"
@@ -216,9 +286,15 @@ const OAuthFormFields: React.FC<OAuthFormFieldsProps> = ({
             }
             name="registration_url"
           >
-            <Input placeholder="https://example.com/oauth/register" className={fieldClassName} />
-          </Form.Item>
-          <Form.Item
+            {(control) => (
+              <Input
+                {...textControl(control)}
+                placeholder="https://example.com/oauth/register"
+                className={fieldClassName}
+              />
+            )}
+          </MountedFormField>
+          <MountedFormField
             label={
               <FieldLabel
                 label="Token Validation Rules (optional)"
@@ -226,27 +302,18 @@ const OAuthFormFields: React.FC<OAuthFormFieldsProps> = ({
               />
             }
             name="token_validation_json"
-            rules={[
-              {
-                validator: (_: any, value: string) => {
-                  if (!value || value.trim() === "") return Promise.resolve();
-                  try {
-                    JSON.parse(value);
-                    return Promise.resolve();
-                  } catch {
-                    return Promise.reject(new Error("Must be valid JSON"));
-                  }
-                },
-              },
-            ]}
+            rules={{ validate: { json: parsesAsJson("Must be valid JSON") } }}
           >
-            <AntdInput.TextArea
-              placeholder={'{\n  "organization": "my-org",\n  "team.id": "123"\n}'}
-              rows={4}
-              className="font-mono text-sm rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500"
-            />
-          </Form.Item>
-          <Form.Item
+            {(control) => (
+              <AntdInput.TextArea
+                {...textControl(control)}
+                placeholder={'{\n  "organization": "my-org",\n  "team.id": "123"\n}'}
+                rows={4}
+                className="font-mono text-sm rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500"
+              />
+            )}
+          </MountedFormField>
+          <MountedFormField
             label={
               <FieldLabel
                 label="Token Storage TTL (seconds, optional)"
@@ -255,8 +322,16 @@ const OAuthFormFields: React.FC<OAuthFormFieldsProps> = ({
             }
             name="token_storage_ttl_seconds"
           >
-            <InputNumber min={1} placeholder="e.g. 3600" className="w-full rounded-lg" style={{ width: "100%" }} />
-          </Form.Item>
+            {(control) => (
+              <InputNumber
+                {...numberControl(control)}
+                min={1}
+                placeholder="e.g. 3600"
+                className="w-full rounded-lg"
+                style={{ width: "100%" }}
+              />
+            )}
+          </MountedFormField>
           {oauthFlow && (
             <div className="rounded-lg border border-dashed border-gray-300 p-4 space-y-2">
               <p className="text-sm text-gray-600">
diff --git a/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/OpenAPIFormSection.tsx b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/OpenAPIFormSection.tsx
index 073780b359f..78c8bbe73a9 100644
--- a/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/OpenAPIFormSection.tsx
+++ b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/OpenAPIFormSection.tsx
@@ -1,12 +1,15 @@
 import React, { useState } from "react";
-import { Form, Input, Tooltip } from "antd";
+import { Input, Tooltip } from "antd";
 import { InfoCircleOutlined } from "@ant-design/icons";
-import { FormInstance } from "antd/es/form";
 import { AUTH_TYPE, OAUTH_FLOW } from "@/components/mcp_tools/types";
+import { MountedFormField } from "@/components/common_components/MountedFormField";
+import { antdRequired } from "@/components/common_components/antdFormRules";
 import OpenAPIQuickPicker, { OpenAPIRegistryEntry, OpenAPIKeyTool } from "./OpenAPIQuickPicker";
+import { McpForm, resetFields, setFieldsValue } from "./mcpFormStore";
+import { textControl } from "./mcpFieldRules";
 
 interface OpenAPIFormSectionProps {
-  form: FormInstance;
+  form: McpForm;
   accessToken: string | null;
   /** Called when a preset is selected so the parent can sync its formValues state. */
   onValuesChange: (updates: Record<string, any>) => void;
@@ -47,13 +50,11 @@ const OpenAPIFormSection: React.FC<OpenAPIFormSectionProps> = ({
       updates.oauth_flow_type = OAUTH_FLOW.INTERACTIVE;
       updates.authorization_url = entry.oauth.authorization_url;
       updates.token_url = entry.oauth.token_url;
-      form.setFieldsValue(updates);
+      setFieldsValue(form, updates);
       onOAuthDocsUrlChange?.(entry.oauth.docs_url ?? null);
     } else {
-      // resetFields is required to visually clear Ant Design form fields —
-      // setFieldsValue with undefined silently skips undefined keys.
-      form.resetFields(["auth_type", "authorization_url", "token_url"]);
-      form.setFieldsValue(updates);
+      resetFields(form, ["auth_type", "authorization_url", "token_url"]);
+      setFieldsValue(form, updates);
       onOAuthDocsUrlChange?.(null);
     }
     onValuesChange(updates);
@@ -63,7 +64,7 @@ const OpenAPIFormSection: React.FC<OpenAPIFormSectionProps> = ({
     <>
       <OpenAPIQuickPicker accessToken={accessToken} selectedName={selectedPreset} onSelect={handlePresetSelect} />
 
-      <Form.Item
+      <MountedFormField
         label={
           <span className="text-sm font-medium text-gray-700 flex items-center">
             OpenAPI Spec URL
@@ -73,20 +74,25 @@ const OpenAPIFormSection: React.FC<OpenAPIFormSectionProps> = ({
           </span>
         }
         name="spec_path"
-        rules={[{ required: true, message: "Please enter an OpenAPI spec URL" }]}
+        required
+        rules={{ validate: { required: antdRequired("Please enter an OpenAPI spec URL") } }}
       >
-        <Input
-          placeholder="https://petstore3.swagger.io/api/v3/openapi.json"
-          className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500"
-          onChange={() => {
-            // Clear the preset selection when the user manually edits the spec URL
-            // so stale suggested tools from a previous preset don't persist.
-            setSelectedPreset(null);
-            onKeyToolsChange?.([]);
-            onOAuthDocsUrlChange?.(null);
-          }}
-        />
-      </Form.Item>
+        {(control) => (
+          <Input
+            {...textControl(control)}
+            placeholder="https://petstore3.swagger.io/api/v3/openapi.json"
+            className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500"
+            onChange={(event) => {
+              control.onChange(event);
+              // Clear the preset selection when the user manually edits the spec URL
+              // so stale suggested tools from a previous preset don't persist.
+              setSelectedPreset(null);
+              onKeyToolsChange?.([]);
+              onOAuthDocsUrlChange?.(null);
+            }}
+          />
+        )}
+      </MountedFormField>
     </>
   );
 };
diff --git a/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/OpenApiByokFields.tsx b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/OpenApiByokFields.tsx
index 2ac4279e20a..83c841439f0 100644
--- a/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/OpenApiByokFields.tsx
+++ b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/OpenApiByokFields.tsx
@@ -1,91 +1,101 @@
 import React from "react";
-import { Form, Input, Select, Switch, Tooltip } from "antd";
+import { Input, Select, Switch, Tooltip } from "antd";
 import { InfoCircleOutlined } from "@ant-design/icons";
+import { useWatch } from "react-hook-form";
 
-const OpenApiByokFields: React.FC = () => (
-  <>
-    <Form.Item
-      label={
-        <span className="text-sm font-medium text-gray-700 flex items-center gap-2">
-          BYOK (Bring Your Own Key)
-          <Tooltip title="When enabled, each user provides their own API key for this service. Keys are stored per-user and never shared.">
-            <InfoCircleOutlined className="text-blue-400 hover:text-blue-600 cursor-help" />
-          </Tooltip>
-        </span>
-      }
-      name="is_byok"
-      valuePropName="checked"
-    >
-      <Switch />
-    </Form.Item>
+import { MountedFormField } from "@/components/common_components/MountedFormField";
+import { selectControl, switchControl, textControl } from "./mcpFieldRules";
 
-    <Form.Item noStyle shouldUpdate={(prev, cur) => prev.is_byok !== cur.is_byok || prev.auth_type !== cur.auth_type}>
-      {({ getFieldValue }) =>
-        getFieldValue("is_byok") ? (
-          <>
-            {/* Auth format hint */}
-            {getFieldValue("auth_type") && getFieldValue("auth_type") !== "none" && (
-              <div className="mb-4 p-3 bg-blue-50 rounded-lg text-sm text-blue-700 flex items-start gap-2">
-                <InfoCircleOutlined className="mt-0.5 shrink-0" />
-                <span>
-                  User keys will be sent as:{" "}
-                  <code className="font-mono bg-blue-100 px-1 rounded-sm">
-                    {getFieldValue("auth_type") === "bearer_token" && "Authorization: Bearer {key}"}
-                    {getFieldValue("auth_type") === "token" && "Authorization: token {key}"}
-                    {getFieldValue("auth_type") === "api_key" && "x-api-key: {key}"}
-                    {getFieldValue("auth_type") === "basic" && "Authorization: Basic {key}"}
-                    {getFieldValue("auth_type") === "authorization" && "Authorization: {key}"}
-                  </code>
-                  {!getFieldValue("auth_type") && "Set Authentication Type below to specify the format."}
-                </span>
-              </div>
-            )}
-            {!getFieldValue("auth_type") && (
-              <div className="mb-4 p-3 bg-yellow-50 rounded-lg text-sm text-yellow-700 flex items-start gap-2">
-                <InfoCircleOutlined className="mt-0.5 shrink-0" />
-                <span>
-                  Set the <strong>Authentication Type</strong> below to specify how user keys are sent (e.g., Bearer
-                  Token, API Key header).
-                </span>
-              </div>
-            )}
-            <Form.Item
-              label={
-                <span className="text-sm font-medium text-gray-700">
-                  Access Description
-                  <Tooltip title="List of permissions shown to users in the connection modal (e.g. 'Create and manage Jira issues')">
-                    <InfoCircleOutlined className="ml-2 text-blue-400 hover:text-blue-600 cursor-help" />
-                  </Tooltip>
-                </span>
-              }
-              name="byok_description"
-            >
+const AUTH_HEADER_FORMATS: Readonly<Record<string, string>> = {
+  bearer_token: "Authorization: Bearer {key}",
+  token: "Authorization: token {key}",
+  api_key: "x-api-key: {key}",
+  basic: "Authorization: Basic {key}",
+  authorization: "Authorization: {key}",
+};
+
+const OpenApiByokFields: React.FC = () => {
+  const isByok = Boolean(useWatch({ name: "is_byok" }));
+  const authType = useWatch({ name: "auth_type" }) as string | undefined;
+  const hasAuthType = Boolean(authType) && authType !== "none";
+
+  return (
+    <>
+      <MountedFormField
+        label={
+          <span className="text-sm font-medium text-gray-700 flex items-center gap-2">
+            BYOK (Bring Your Own Key)
+            <Tooltip title="When enabled, each user provides their own API key for this service. Keys are stored per-user and never shared.">
+              <InfoCircleOutlined className="text-blue-400 hover:text-blue-600 cursor-help" />
+            </Tooltip>
+          </span>
+        }
+        name="is_byok"
+      >
+        {(control) => <Switch {...switchControl(control)} />}
+      </MountedFormField>
+
+      {isByok && (
+        <>
+          {hasAuthType && (
+            <div className="mb-4 p-3 bg-blue-50 rounded-lg text-sm text-blue-700 flex items-start gap-2">
+              <InfoCircleOutlined className="mt-0.5 shrink-0" />
+              <span>
+                User keys will be sent as:{" "}
+                <code className="font-mono bg-blue-100 px-1 rounded-sm">
+                  {authType === undefined ? "" : AUTH_HEADER_FORMATS[authType]}
+                </code>
+              </span>
+            </div>
+          )}
+          {!authType && (
+            <div className="mb-4 p-3 bg-yellow-50 rounded-lg text-sm text-yellow-700 flex items-start gap-2">
+              <InfoCircleOutlined className="mt-0.5 shrink-0" />
+              <span>
+                Set the <strong>Authentication Type</strong> below to specify how user keys are sent (e.g., Bearer
+                Token, API Key header).
+              </span>
+            </div>
+          )}
+          <MountedFormField
+            label={
+              <span className="text-sm font-medium text-gray-700">
+                Access Description
+                <Tooltip title="List of permissions shown to users in the connection modal (e.g. 'Create and manage Jira issues')">
+                  <InfoCircleOutlined className="ml-2 text-blue-400 hover:text-blue-600 cursor-help" />
+                </Tooltip>
+              </span>
+            }
+            name="byok_description"
+          >
+            {(control) => (
               <Select
+                {...selectControl(control)}
                 mode="tags"
                 placeholder="Add access description items (press Enter after each)"
                 className="w-full"
                 tokenSeparators={[","]}
               />
-            </Form.Item>
+            )}
+          </MountedFormField>
 
-            <Form.Item
-              label={
-                <span className="text-sm font-medium text-gray-700">
-                  API Key Help URL
-                  <Tooltip title="Optional link shown to users to help them find their API key">
-                    <InfoCircleOutlined className="ml-2 text-blue-400 hover:text-blue-600 cursor-help" />
-                  </Tooltip>
-                </span>
-              }
-              name="byok_api_key_help_url"
-            >
-              <Input placeholder="https://docs.example.com/api-keys" />
-            </Form.Item>
-          </>
-        ) : null
-      }
-    </Form.Item>
-  </>
-);
+          <MountedFormField
+            label={
+              <span className="text-sm font-medium text-gray-700">
+                API Key Help URL
+                <Tooltip title="Optional link shown to users to help them find their API key">
+                  <InfoCircleOutlined className="ml-2 text-blue-400 hover:text-blue-600 cursor-help" />
+                </Tooltip>
+              </span>
+            }
+            name="byok_api_key_help_url"
+          >
+            {(control) => <Input {...textControl(control)} placeholder="https://docs.example.com/api-keys" />}
+          </MountedFormField>
+        </>
+      )}
+    </>
+  );
+};
 
 export default OpenApiByokFields;
diff --git a/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/PassthroughAuthorizeSection.test.tsx b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/PassthroughAuthorizeSection.test.tsx
index 0a09ef3f856..a7577ccb781 100644
--- a/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/PassthroughAuthorizeSection.test.tsx
+++ b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/PassthroughAuthorizeSection.test.tsx
@@ -1,13 +1,10 @@
 import React from "react";
 import { describe, it, expect } from "vitest";
 import { render, screen } from "@testing-library/react";
-import { Form } from "antd";
 import PassthroughAuthorizeSection from "./PassthroughAuthorizeSection";
+import { McpFormHarness } from "./McpFormTestHarness";
 
-const WithForm: React.FC<{ children: React.ReactNode }> = ({ children }) => {
-  const [form] = Form.useForm();
-  return <Form form={form}>{children}</Form>;
-};
+const WithForm = McpFormHarness;
 
 const noopFlow = { startOAuthFlow: () => {}, status: "idle", error: null, tokenResponse: null };
 
diff --git a/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/PassthroughAuthorizeSection.tsx b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/PassthroughAuthorizeSection.tsx
index dc10f0f1392..375e1dfe515 100644
--- a/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/PassthroughAuthorizeSection.tsx
+++ b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/PassthroughAuthorizeSection.tsx
@@ -1,6 +1,8 @@
 import React from "react";
-import { Button, Checkbox, Form, Input } from "antd";
+import { Button, Checkbox, Input } from "antd";
 import DcrBridgeToggle from "./DcrBridgeToggle";
+import { MountedFormField } from "@/components/common_components/MountedFormField";
+import { textControl } from "./mcpFieldRules";
 import { credentialAuthClass, isClientForwardedTokenMode } from "@/components/mcp_tools/types";
 
 interface PassthroughOAuthFlow {
@@ -81,27 +83,33 @@ export default function PassthroughAuthorizeSection({
           and may not be valid. Update the client ID, or clear it to use dynamic client registration.
         </p>
       )}
-      <Form.Item
+      <MountedFormField
         label={<span className="text-sm font-medium text-gray-700">OAuth Client ID (optional)</span>}
         name={["credentials", "client_id"]}
-        extra={clientIdExtra}
+        help={clientIdExtra}
       >
-        <Input.Password
-          placeholder={clientIdPlaceholder}
-          disabled={removeStoredApp}
-          className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500"
-        />
-      </Form.Item>
-      <Form.Item
+        {(control) => (
+          <Input.Password
+            {...textControl(control)}
+            placeholder={clientIdPlaceholder}
+            disabled={removeStoredApp}
+            className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500"
+          />
+        )}
+      </MountedFormField>
+      <MountedFormField
         label={<span className="text-sm font-medium text-gray-700">OAuth Client Secret (optional)</span>}
         name={["credentials", "client_secret"]}
       >
-        <Input.Password
-          placeholder={clientSecretPlaceholder}
-          disabled={removeStoredApp}
-          className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500"
-        />
-      </Form.Item>
+        {(control) => (
+          <Input.Password
+            {...textControl(control)}
+            placeholder={clientSecretPlaceholder}
+            disabled={removeStoredApp}
+            className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500"
+          />
+        )}
+      </MountedFormField>
       <DcrBridgeToggle authType={authType} initialChecked={dcrBridgeInitialChecked} />
       {isEditing && onRemoveStoredAppChange && (
         <Checkbox checked={removeStoredApp} onChange={(e) => onRemoveStoredAppChange(e.target.checked)}>
diff --git a/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/StdioConfiguration.tsx b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/StdioConfiguration.tsx
index 476a5b61683..bb410aa19dc 100644
--- a/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/StdioConfiguration.tsx
+++ b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/StdioConfiguration.tsx
@@ -1,7 +1,11 @@
 import React from "react";
-import { Form, Input, Tooltip } from "antd";
+import { Input, Tooltip } from "antd";
 import { InfoCircleOutlined } from "@ant-design/icons";
 
+import { MountedFormField } from "@/components/common_components/MountedFormField";
+import { antdRequired } from "@/components/common_components/antdFormRules";
+import { parsesAsJson, textControl } from "./mcpFieldRules";
+
 interface StdioConfigurationProps {
   isVisible: boolean;
   /**
@@ -11,37 +15,7 @@ interface StdioConfigurationProps {
   required?: boolean;
 }
 
-const StdioConfiguration: React.FC<StdioConfigurationProps> = ({ isVisible, required = true }) => {
-  if (!isVisible) return null;
-
-  return (
-    <Form.Item
-      label={
-        <span className="text-sm font-medium text-gray-700 flex items-center">
-          Stdio Configuration (JSON)
-          <Tooltip title="Paste your stdio MCP server configuration in JSON format. You can use the full mcpServers structure from config.yaml or just the inner server configuration.">
-            <InfoCircleOutlined className="ml-2 text-blue-400 hover:text-blue-600 cursor-help" />
-          </Tooltip>
-        </span>
-      }
-      name="stdio_config"
-      rules={[
-        ...(required ? [{ required: true, message: "Please enter stdio configuration" }] : []),
-        {
-          validator: (_, value) => {
-            if (!value) return Promise.resolve();
-            try {
-              JSON.parse(value);
-              return Promise.resolve();
-            } catch {
-              return Promise.reject("Please enter valid JSON");
-            }
-          },
-        },
-      ]}
-    >
-      <Input.TextArea
-        placeholder={`{
+const PLACEHOLDER = `{
   "mcpServers": {
     "circleci-mcp-server": {
       "command": "npx",
@@ -52,11 +26,39 @@ const StdioConfiguration: React.FC<StdioConfigurationProps> = ({ isVisible, requ
       }
     }
   }
-}`}
-        rows={12}
-        className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500 font-mono text-sm"
-      />
-    </Form.Item>
+}`;
+
+const StdioConfiguration: React.FC<StdioConfigurationProps> = ({ isVisible, required = true }) => {
+  if (!isVisible) return null;
+
+  return (
+    <MountedFormField
+      label={
+        <span className="text-sm font-medium text-gray-700 flex items-center">
+          Stdio Configuration (JSON)
+          <Tooltip title="Paste your stdio MCP server configuration in JSON format. You can use the full mcpServers structure from config.yaml or just the inner server configuration.">
+            <InfoCircleOutlined className="ml-2 text-blue-400 hover:text-blue-600 cursor-help" />
+          </Tooltip>
+        </span>
+      }
+      name="stdio_config"
+      required={required}
+      rules={{
+        validate: {
+          ...(required ? { required: antdRequired("Please enter stdio configuration") } : {}),
+          json: parsesAsJson("Please enter valid JSON"),
+        },
+      }}
+    >
+      {(control) => (
+        <Input.TextArea
+          {...textControl(control)}
+          placeholder={PLACEHOLDER}
+          rows={12}
+          className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500 font-mono text-sm"
+        />
+      )}
+    </MountedFormField>
   );
 };
 
diff --git a/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/TokenEndpointAuthMethodField.tsx b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/TokenEndpointAuthMethodField.tsx
index c97ce96bfb1..38fa3573079 100644
--- a/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/TokenEndpointAuthMethodField.tsx
+++ b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/TokenEndpointAuthMethodField.tsx
@@ -1,7 +1,10 @@
 import React from "react";
-import { Form, Select, Tooltip } from "antd";
+import { Select, Tooltip } from "antd";
 import { InfoCircleOutlined } from "@ant-design/icons";
 
+import { MountedFormField } from "@/components/common_components/MountedFormField";
+import { selectControl } from "./mcpFieldRules";
+
 const TOKEN_ENDPOINT_AUTH_METHOD_OPTIONS = [
   { value: "client_secret_basic", label: "Client Secret Basic" },
   { value: "client_secret_post", label: "Client Secret Post" },
@@ -12,7 +15,7 @@ interface TokenEndpointAuthMethodFieldProps {
 }
 
 const TokenEndpointAuthMethodField: React.FC<TokenEndpointAuthMethodFieldProps> = ({ isEditing = false }) => (
-  <Form.Item
+  <MountedFormField
     label={
       <span className="text-sm font-medium text-gray-700 flex items-center">
         Token Endpoint Auth Method (optional)
@@ -23,16 +26,19 @@ const TokenEndpointAuthMethodField: React.FC<TokenEndpointAuthMethodFieldProps>
     }
     name={["credentials", "token_endpoint_auth_method"]}
   >
-    <Select
-      allowClear
-      placeholder={
-        isEditing ? "Leave blank to keep existing (default Client Secret Post)" : "Default (Client Secret Post)"
-      }
-      className="rounded-lg"
-      size="large"
-      options={TOKEN_ENDPOINT_AUTH_METHOD_OPTIONS}
-    />
-  </Form.Item>
+    {(control) => (
+      <Select
+        {...selectControl(control)}
+        allowClear
+        placeholder={
+          isEditing ? "Leave blank to keep existing (default Client Secret Post)" : "Default (Client Secret Post)"
+        }
+        className="rounded-lg"
+        size="large"
+        options={TOKEN_ENDPOINT_AUTH_METHOD_OPTIONS}
+      />
+    )}
+  </MountedFormField>
 );
 
 export default TokenEndpointAuthMethodField;
diff --git a/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/TokenExchangeFormFields.tsx b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/TokenExchangeFormFields.tsx
index 9e1e1a85743..ba213b20655 100644
--- a/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/TokenExchangeFormFields.tsx
+++ b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/TokenExchangeFormFields.tsx
@@ -1,6 +1,11 @@
 import React from "react";
-import { Form, Input, Select, Tooltip } from "antd";
+import { Input, Select, Tooltip } from "antd";
 import { InfoCircleOutlined } from "@ant-design/icons";
+import { useWatch } from "react-hook-form";
+
+import { MountedFormField } from "@/components/common_components/MountedFormField";
+import { antdRequired } from "@/components/common_components/antdFormRules";
+import { selectControl, textControl } from "./mcpFieldRules";
 
 interface TokenExchangeFormFieldsProps {
   isEditing?: boolean;
@@ -19,10 +24,13 @@ const FieldLabel: React.FC<{ label: string; tooltip: string }> = ({ label, toolt
 
 const TokenExchangeFormFields: React.FC<TokenExchangeFormFieldsProps> = ({ isEditing = false }) => {
   const placeholderSuffix = isEditing ? " (leave blank to keep existing)" : "";
+  const isEntraObo = useWatch({ name: "token_exchange_profile" }) === "entra_obo";
+  const requiredWhenCreating = (message: string) =>
+    isEditing ? undefined : { validate: { required: antdRequired(message) } };
 
   return (
     <>
-      <Form.Item
+      <MountedFormField
         label={
           <FieldLabel
             label="Profile"
@@ -30,18 +38,20 @@ const TokenExchangeFormFields: React.FC<TokenExchangeFormFieldsProps> = ({ isEdi
           />
         }
         name="token_exchange_profile"
-        {...(isEditing ? {} : { initialValue: "rfc8693" })}
+        {...(isEditing ? {} : { defaultValue: "rfc8693" })}
       >
-        <Select className="rounded-lg" size="large">
-          <Select.Option value="rfc8693">
-            <span className="font-medium">RFC 8693 (standard)</span>
-          </Select.Option>
-          <Select.Option value="entra_obo">
-            <span className="font-medium">Microsoft Entra OBO</span>
-          </Select.Option>
-        </Select>
-      </Form.Item>
-      <Form.Item
+        {(control) => (
+          <Select {...selectControl(control)} className="rounded-lg" size="large">
+            <Select.Option value="rfc8693">
+              <span className="font-medium">RFC 8693 (standard)</span>
+            </Select.Option>
+            <Select.Option value="entra_obo">
+              <span className="font-medium">Microsoft Entra OBO</span>
+            </Select.Option>
+          </Select>
+        )}
+      </MountedFormField>
+      <MountedFormField
         label={
           <FieldLabel
             label="Token Exchange Endpoint (optional)"
@@ -50,9 +60,15 @@ const TokenExchangeFormFields: React.FC<TokenExchangeFormFieldsProps> = ({ isEdi
         }
         name="token_exchange_endpoint"
       >
-        <Input placeholder="https://idp.example.com/oauth2/token" className={fieldClassName} />
-      </Form.Item>
-      <Form.Item
+        {(control) => (
+          <Input
+            {...textControl(control)}
+            placeholder="https://idp.example.com/oauth2/token"
+            className={fieldClassName}
+          />
+        )}
+      </MountedFormField>
+      <MountedFormField
         label={
           <FieldLabel
             label="Client ID"
@@ -60,11 +76,18 @@ const TokenExchangeFormFields: React.FC<TokenExchangeFormFieldsProps> = ({ isEdi
           />
         }
         name={["credentials", "client_id"]}
-        rules={[{ required: !isEditing, message: "Client ID is required for token exchange" }]}
+        required={!isEditing}
+        rules={requiredWhenCreating("Client ID is required for token exchange")}
       >
-        <Input.Password placeholder={`Enter OAuth client ID${placeholderSuffix}`} className={fieldClassName} />
-      </Form.Item>
-      <Form.Item
+        {(control) => (
+          <Input.Password
+            {...textControl(control)}
+            placeholder={`Enter OAuth client ID${placeholderSuffix}`}
+            className={fieldClassName}
+          />
+        )}
+      </MountedFormField>
+      <MountedFormField
         label={
           <FieldLabel
             label="Client Secret"
@@ -72,76 +95,85 @@ const TokenExchangeFormFields: React.FC<TokenExchangeFormFieldsProps> = ({ isEdi
           />
         }
         name={["credentials", "client_secret"]}
-        rules={[{ required: !isEditing, message: "Client Secret is required for token exchange" }]}
+        required={!isEditing}
+        rules={requiredWhenCreating("Client Secret is required for token exchange")}
       >
-        <Input.Password placeholder={`Enter OAuth client secret${placeholderSuffix}`} className={fieldClassName} />
-      </Form.Item>
-      <Form.Item noStyle shouldUpdate={(prev, cur) => prev.token_exchange_profile !== cur.token_exchange_profile}>
-        {({ getFieldValue }) => {
-          const isEntraObo = getFieldValue("token_exchange_profile") === "entra_obo";
-          return (
-            <>
-              {!isEntraObo && (
-                <>
-                  <Form.Item
-                    label={
-                      <FieldLabel
-                        label="Audience (optional)"
-                        tooltip="Target audience for the exchanged token (RFC 8693 audience). Identifies the upstream MCP server the token is for."
-                      />
-                    }
-                    name="audience"
-                  >
-                    <Input placeholder="https://upstream.example.com" className={fieldClassName} />
-                  </Form.Item>
-                  <Form.Item
-                    label={
-                      <FieldLabel
-                        label="Subject Token Type (optional)"
-                        tooltip="Type of the user's incoming token (RFC 8693 subject_token_type). Defaults to urn:ietf:params:oauth:token-type:access_token."
-                      />
-                    }
-                    name="subject_token_type"
-                  >
-                    <Input placeholder="urn:ietf:params:oauth:token-type:access_token" className={fieldClassName} />
-                  </Form.Item>
-                </>
-              )}
-              <Form.Item
-                label={
-                  <FieldLabel
-                    label={isEntraObo ? "Scopes" : "Scopes (optional)"}
-                    tooltip={
-                      isEntraObo
-                        ? "Microsoft Entra OBO carries the target resource in the scope, so at least one is required (e.g. api://<app-id>/.default)."
-                        : "Optional scopes to request during the token exchange."
-                    }
-                  />
-                }
-                name={["credentials", "scopes"]}
-                rules={
-                  isEntraObo
-                    ? [
-                        {
-                          required: true,
-                          message: "Microsoft Entra OBO requires a scope, e.g. api://<app-id>/.default",
-                        },
-                      ]
-                    : []
-                }
-              >
-                <Select
-                  mode="tags"
-                  tokenSeparators={[","]}
-                  placeholder={isEntraObo ? "api://<app-id>/.default" : "Add scopes"}
-                  className="rounded-lg"
-                  size="large"
-                />
-              </Form.Item>
-            </>
-          );
-        }}
-      </Form.Item>
+        {(control) => (
+          <Input.Password
+            {...textControl(control)}
+            placeholder={`Enter OAuth client secret${placeholderSuffix}`}
+            className={fieldClassName}
+          />
+        )}
+      </MountedFormField>
+      {!isEntraObo && (
+        <>
+          <MountedFormField
+            label={
+              <FieldLabel
+                label="Audience (optional)"
+                tooltip="Target audience for the exchanged token (RFC 8693 audience). Identifies the upstream MCP server the token is for."
+              />
+            }
+            name="audience"
+          >
+            {(control) => (
+              <Input {...textControl(control)} placeholder="https://upstream.example.com" className={fieldClassName} />
+            )}
+          </MountedFormField>
+          <MountedFormField
+            label={
+              <FieldLabel
+                label="Subject Token Type (optional)"
+                tooltip="Type of the user's incoming token (RFC 8693 subject_token_type). Defaults to urn:ietf:params:oauth:token-type:access_token."
+              />
+            }
+            name="subject_token_type"
+          >
+            {(control) => (
+              <Input
+                {...textControl(control)}
+                placeholder="urn:ietf:params:oauth:token-type:access_token"
+                className={fieldClassName}
+              />
+            )}
+          </MountedFormField>
+        </>
+      )}
+      <MountedFormField
+        label={
+          <FieldLabel
+            label={isEntraObo ? "Scopes" : "Scopes (optional)"}
+            tooltip={
+              isEntraObo
+                ? "Microsoft Entra OBO carries the target resource in the scope, so at least one is required (e.g. api://<app-id>/.default)."
+                : "Optional scopes to request during the token exchange."
+            }
+          />
+        }
+        name={["credentials", "scopes"]}
+        required={isEntraObo}
+        rules={
+          isEntraObo
+            ? {
+                validate: {
+                  required: antdRequired("Microsoft Entra OBO requires a scope, e.g. api://<app-id>/.default"),
+                },
+              }
+            : undefined
+        }
+      >
+        {(control) => (
+          <Select
+            {...selectControl(control)}
+            mode="tags"
+            tokenSeparators={[","]}
+            placeholder={isEntraObo ? "api://<app-id>/.default" : "Add scopes"}
+            className="rounded-lg"
+            size="large"
+          />
+        )}
+      </MountedFormField>
     </>
   );
 };
diff --git a/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/editServerPayload.differential.cases.ts b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/editServerPayload.differential.cases.ts
new file mode 100644
index 00000000000..c350ac085b6
--- /dev/null
+++ b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/editServerPayload.differential.cases.ts
@@ -0,0 +1,391 @@
+import { MCPServer } from "@/components/mcp_tools/types";
+import type { EditServerUiState } from "./editServerPayload";
+
+const SERVER: MCPServer = {
+  server_id: "srv_1",
+  server_name: "srv",
+  alias: "srv_alias",
+  description: "a server",
+  transport: "http",
+  url: "https://example.com/mcp",
+  auth_type: "none",
+  created_at: "2024-01-01T00:00:00Z",
+  created_by: "user-1",
+  updated_at: "2024-01-01T00:00:00Z",
+  updated_by: "user-1",
+  mcp_access_groups: [],
+};
+
+export const baseUi: EditServerUiState = {
+  mcpServer: SERVER,
+  logoUrl: undefined,
+  costConfig: {},
+  allowedTools: [],
+  hasExistingToolAllowlist: false,
+  hasToolAllowlistInteraction: false,
+  toolNameToDisplayName: {},
+  toolNameToDescription: {},
+  removeStoredApp: false,
+};
+
+export interface DifferentialCase {
+  readonly label: string;
+  readonly values: Record<string, any>;
+  readonly ui: Partial<EditServerUiState>;
+}
+
+// Always-mounted root fields. A "collapsed" section is modelled as its keys being
+// ABSENT, which is what antd's mounted-only onFinish produces, and an expanded but
+// untouched one as the key present holding `undefined`.
+const ROOT = {
+  server_name: "srv",
+  alias: "srv_alias",
+  description: "a server",
+  transport: "http",
+  url: "https://example.com/mcp",
+  auth_type: "none",
+  max_concurrent_requests: undefined,
+  mcp_access_groups: [],
+  extra_headers: [],
+  static_headers: [],
+  env_vars: [],
+  allow_all_keys: false,
+  available_on_public_internet: true,
+};
+
+const CREDS = {
+  auth_value: "secret-value",
+  client_id: "cid",
+  client_secret: "csec",
+  scopes: ["read", "write"],
+  aws_region_name: "us-east-1",
+  aws_service_name: "bedrock",
+  aws_access_key_id: "AKIA",
+  aws_secret_access_key: "shh",
+  aws_session_token: "tok",
+  aws_role_name: "role",
+  aws_session_name: "sess",
+  id_jag_resource: "api://res",
+  id_jag_resource_token_endpoint: "https://idp/jag",
+  client_private_key: "-----KEY-----",
+  client_private_key_id: "kid",
+  client_assertion_signing_alg: "RS256",
+  token_endpoint_auth_method: "client_secret_basic",
+  upstream_resource: "api://up",
+};
+
+const AUTH_TYPES = [
+  "none",
+  "api_key",
+  "bearer_token",
+  "token",
+  "basic",
+  "oauth2",
+  "oauth2_token_exchange",
+  "oauth2_id_jag",
+  "aws_sigv4",
+  "true_passthrough",
+  "oauth_delegate",
+] as const;
+
+export const CASES: readonly DifferentialCase[] = [
+  // --- mount-state axis: everything collapsed / expanded-undefined / expanded-valued ---
+  { label: "everything collapsed, only the always-mounted root", values: { ...ROOT }, ui: {} },
+  {
+    label: "everything expanded, all optional keys present as undefined",
+    values: {
+      ...ROOT,
+      credentials: {},
+      stdio_config: undefined,
+      env_json: undefined,
+      command: undefined,
+      args: undefined,
+      delegate_auth_to_upstream: undefined,
+      oauth_passthrough: undefined,
+      dcr_bridge: undefined,
+      token_validation_json: undefined,
+      spec_path: undefined,
+      oauth_flow_type: undefined,
+      issuer: undefined,
+      authorization_url: undefined,
+      token_url: undefined,
+      registration_url: undefined,
+      token_storage_ttl_seconds: undefined,
+      token_exchange_endpoint: undefined,
+      token_exchange_profile: undefined,
+      audience: undefined,
+      subject_token_type: undefined,
+      disallowed_tools: undefined,
+    },
+    ui: {},
+  },
+  {
+    label: "expand then collapse: the key is absent again even though a value was typed",
+    values: { ...ROOT },
+    ui: {},
+  },
+
+  // --- transport axis ---
+  {
+    label: "stdio via the JSON config path",
+    values: {
+      ...ROOT,
+      transport: "stdio",
+      url: undefined,
+      stdio_config: JSON.stringify({ command: "npx", args: ["-y", "pkg"], env: { A: "1" } }),
+    },
+    ui: {},
+  },
+  {
+    label: "stdio via a wrapped mcpServers config",
+    values: {
+      ...ROOT,
+      transport: "stdio",
+      url: undefined,
+      stdio_config: JSON.stringify({ mcpServers: { first: { command: "uvx", args: [1, "  ", "b"] } } }),
+    },
+    ui: {},
+  },
+  {
+    label: "stdio via the dedicated command/args/env fields",
+    values: {
+      ...ROOT,
+      transport: "stdio",
+      url: undefined,
+      command: "  npx  ",
+      args: ["-y", "  ", "pkg"],
+      env_json: JSON.stringify({ A: 1, "": "skipped", B: null }),
+    },
+    ui: {},
+  },
+  {
+    label: "openapi swaps url for spec_path",
+    values: { ...ROOT, transport: "openapi", url: undefined, spec_path: "https://x/openapi.json" },
+    ui: {},
+  },
+
+  // --- auth-type axis, one case per type, credentials mounted ---
+  ...AUTH_TYPES.map((auth) => ({
+    label: `auth_type ${auth} with the full credential bag mounted`,
+    values: { ...ROOT, auth_type: auth, credentials: { ...CREDS } },
+    ui: {},
+  })),
+
+  // --- oauth2 flow sub-branches ---
+  {
+    label: "oauth2 m2m flow",
+    values: {
+      ...ROOT,
+      auth_type: "oauth2",
+      oauth_flow_type: "m2m",
+      token_url: "https://idp/token",
+      credentials: { ...CREDS },
+    },
+    ui: {},
+  },
+  {
+    label: "oauth2 interactive flow",
+    values: {
+      ...ROOT,
+      auth_type: "oauth2",
+      oauth_flow_type: "interactive",
+      issuer: "https://idp",
+      credentials: { ...CREDS },
+    },
+    ui: {},
+  },
+  {
+    label: "oauth2 with delegate_auth_to_upstream on",
+    values: { ...ROOT, auth_type: "oauth2", delegate_auth_to_upstream: true, credentials: { ...CREDS } },
+    ui: {},
+  },
+
+  // --- the five coalesced keys: unbound raw against each server-side fallback ---
+  {
+    label: "coalesced booleans unbound, server has them all true",
+    values: { ...ROOT, auth_type: "oauth2", allow_all_keys: undefined, available_on_public_internet: undefined },
+    ui: {
+      mcpServer: {
+        ...SERVER,
+        auth_type: "oauth2",
+        allow_all_keys: true,
+        available_on_public_internet: true,
+        delegate_auth_to_upstream: true,
+        oauth_passthrough: true,
+        dcr_bridge: true,
+      },
+    },
+  },
+  {
+    label: "coalesced booleans unbound, server has them all false",
+    values: { ...ROOT, allow_all_keys: undefined, available_on_public_internet: undefined },
+    ui: { mcpServer: { ...SERVER, allow_all_keys: false, available_on_public_internet: false } },
+  },
+  {
+    label: "dcr_bridge bound true on a client-forwarded mode",
+    values: { ...ROOT, auth_type: "true_passthrough", dcr_bridge: true },
+    ui: { mcpServer: { ...SERVER, auth_type: "true_passthrough" } },
+  },
+  {
+    label: "dcr_bridge bound true but auth switched away, forced false",
+    values: { ...ROOT, auth_type: "api_key", dcr_bridge: true },
+    ui: {},
+  },
+  {
+    label: "oauth_passthrough with an Authorization extra header",
+    values: { ...ROOT, auth_type: "none", extra_headers: ["Authorization"], oauth_passthrough: true },
+    ui: {},
+  },
+  {
+    label: "oauth_passthrough without the Authorization header, forced false",
+    values: { ...ROOT, auth_type: "none", extra_headers: ["X-Other"], oauth_passthrough: true },
+    ui: {},
+  },
+
+  // --- auth-type transitions that null out the previous subtree ---
+  {
+    label: "was oauth2, now api_key: nulls the four oauth endpoints",
+    values: { ...ROOT, auth_type: "api_key", credentials: { auth_value: "v" } },
+    ui: { mcpServer: { ...SERVER, auth_type: "oauth2" } },
+  },
+  {
+    label: "was token_exchange, now none: nulls the four exchange fields",
+    values: { ...ROOT, auth_type: "none" },
+    ui: { mcpServer: { ...SERVER, auth_type: "oauth2_token_exchange" } },
+  },
+
+  // --- credentials filtering ---
+  // ADMIN_CONFIG_CREDENTIAL_KEYS is exactly ["upstream_resource"], so only that key
+  // takes the blank-to-explicit-null branch. A blank client_id is dropped instead.
+  {
+    label: "blank upstream_resource becomes an explicit null",
+    values: { ...ROOT, auth_type: "oauth2", credentials: { upstream_resource: "", client_secret: "keep" } },
+    ui: {},
+  },
+  {
+    label: "blank non-admin credential is dropped, not nulled",
+    values: { ...ROOT, auth_type: "oauth2", credentials: { client_id: "", client_secret: "keep", scopes: [] } },
+    ui: {},
+  },
+  {
+    label: "scopes array filters empties and drops when nothing survives",
+    values: { ...ROOT, auth_type: "oauth2", credentials: { scopes: ["", null, "read"] } },
+    ui: {},
+  },
+  {
+    label: "scopes entirely empty drops the key",
+    values: { ...ROOT, auth_type: "oauth2", credentials: { scopes: ["", null] } },
+    ui: {},
+  },
+  { label: "credentials absent entirely", values: { ...ROOT, auth_type: "oauth2" }, ui: {} },
+  {
+    label: "removeStoredApp forces an explicit-null app write",
+    values: { ...ROOT, auth_type: "true_passthrough", credentials: { ...CREDS } },
+    ui: { removeStoredApp: true, mcpServer: { ...SERVER, auth_type: "true_passthrough" } },
+  },
+  {
+    label: "removeStoredApp ignored outside a client-forwarded mode",
+    values: { ...ROOT, auth_type: "api_key", credentials: { ...CREDS } },
+    ui: { removeStoredApp: true },
+  },
+
+  // --- headers, env vars, access groups ---
+  {
+    label: "static headers trim and drop blank names",
+    values: {
+      ...ROOT,
+      static_headers: [
+        { header: "  X-A  ", value: "  v  " },
+        { header: "   ", value: "x" },
+      ],
+    },
+    ui: {},
+  },
+  {
+    label: "env vars normalize",
+    values: { ...ROOT, env_vars: [{ name: "A", value: "1", scope: "server", description: "d" }] },
+    ui: {},
+  },
+  { label: "access groups given as objects", values: { ...ROOT, mcp_access_groups: [{ name: "g1" }, "g2"] }, ui: {} },
+  { label: "extra_headers absent falls back to an empty array", values: { ...ROOT, extra_headers: undefined }, ui: {} },
+
+  // --- tool allowlist and overrides ---
+  {
+    label: "existing allowlist enforces and emits allowed_tools",
+    values: { ...ROOT },
+    ui: { hasExistingToolAllowlist: true, allowedTools: ["alpha"] },
+  },
+  {
+    label: "allowlist interaction with an empty list still enforces",
+    values: { ...ROOT },
+    ui: { hasToolAllowlistInteraction: true },
+  },
+  {
+    label: "tool display name and description maps present",
+    values: { ...ROOT },
+    ui: { toolNameToDisplayName: { a: "Alpha" }, toolNameToDescription: { a: "desc" } },
+  },
+
+  // --- cost config, logo, token validation ---
+  // mcp_info.server_name walks a six-step fallback chain. Every step needs a case whose
+  // earlier terms are falsy, or the chain is unreachable and a mutation deleting it survives.
+  { label: "mcp_info server name falls back to the form url", values: { ...ROOT, server_name: "" }, ui: {} },
+  {
+    label: "mcp_info server name falls back to the stored server_name",
+    values: { ...ROOT, server_name: "", url: "" },
+    ui: {},
+  },
+  {
+    label: "mcp_info server name falls back to the stored url",
+    values: { ...ROOT, server_name: "", url: "" },
+    ui: { mcpServer: { ...SERVER, server_name: "" } },
+  },
+  {
+    label: "mcp_info server name falls back to the form alias",
+    values: { ...ROOT, server_name: "", url: "" },
+    ui: { mcpServer: { ...SERVER, server_name: "", url: "" } },
+  },
+  {
+    label: "mcp_info server name falls back to unknown",
+    values: { ...ROOT, server_name: "", url: "", alias: "" },
+    ui: { mcpServer: { ...SERVER, server_name: "", url: "", alias: "" } },
+  },
+
+  { label: "cost config present", values: { ...ROOT }, ui: { costConfig: { default_cost_per_query: 0.01 } as never } },
+  { label: "logo url present", values: { ...ROOT }, ui: { logoUrl: "https://cdn/logo.png" } },
+  { label: "token validation JSON parses", values: { ...ROOT, token_validation_json: '{"aud":"x"}' }, ui: {} },
+  {
+    label: "token validation blank clears an existing value",
+    values: { ...ROOT, token_validation_json: "   " },
+    ui: { mcpServer: { ...SERVER, token_validation: { aud: "old" } } },
+  },
+  {
+    label: "token validation blank with no existing value omits the key",
+    values: { ...ROOT, token_validation_json: "" },
+    ui: {},
+  },
+
+  // --- the six failure branches ---
+  { label: "ERR invalid tool display name", values: { ...ROOT }, ui: { toolNameToDisplayName: { a: "has spaces" } } },
+  {
+    label: "ERR stdio config missing a command",
+    values: { ...ROOT, transport: "stdio", stdio_config: JSON.stringify({ args: [] }) },
+    ui: {},
+  },
+  {
+    label: "ERR stdio config invalid JSON",
+    values: { ...ROOT, transport: "stdio", stdio_config: "{not json" },
+    ui: {},
+  },
+  {
+    label: "ERR stdio env invalid JSON",
+    values: { ...ROOT, transport: "stdio", command: "npx", env_json: "{not json" },
+    ui: {},
+  },
+  {
+    label: "ERR stdio dedicated path with a blank command",
+    values: { ...ROOT, transport: "stdio", command: "   " },
+    ui: {},
+  },
+  { label: "ERR token validation invalid JSON", values: { ...ROOT, token_validation_json: "{not json" }, ui: {} },
+];
diff --git a/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/editServerPayload.differential.test.ts b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/editServerPayload.differential.test.ts
new file mode 100644
index 00000000000..f9cab181e71
--- /dev/null
+++ b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/editServerPayload.differential.test.ts
@@ -0,0 +1,331 @@
+import { describe, expect, it } from "vitest";
+import {
+  ADMIN_CONFIG_CREDENTIAL_KEYS,
+  AUTH_TYPE,
+  MCPServer,
+  MCP_OAUTH2_FLOW_INTERACTIVE,
+  MCP_OAUTH2_FLOW_M2M,
+  OAUTH_FLOW,
+  TRANSPORT,
+  isClientForwardedTokenMode,
+  preservedAdminCredentials,
+} from "@/components/mcp_tools/types";
+import { AUTH_TYPES_REQUIRING_CREDENTIALS } from "./createServerPayload";
+import { TOOL_DISPLAY_NAME_PATTERN, normalizeEnvVars } from "./utils";
+import { buildEditServerPayload, type EditServerUiState } from "./editServerPayload";
+import { CASES, baseUi } from "./editServerPayload.differential.cases";
+
+// GENERATED by scratchpad/emit_test.py. The body below is machine-extracted from
+// mcp_server_edit.tsx lines 675-950 and converted by exact string replacement; do
+// not hand-edit it. Regenerate instead, so the baseline can never drift toward
+// the implementation it is supposed to check.
+const legacyBuild = (values: Record<string, any>, ui: EditServerUiState) => {
+  const {
+    mcpServer,
+    logoUrl,
+    costConfig,
+    allowedTools,
+    hasExistingToolAllowlist,
+    hasToolAllowlistInteraction,
+    toolNameToDisplayName,
+    toolNameToDescription,
+    removeStoredApp,
+  } = ui;
+  const invalidDisplayName = Object.entries(toolNameToDisplayName).find(
+    ([, displayName]) => displayName && !TOOL_DISPLAY_NAME_PATTERN.test(displayName),
+  );
+  if (invalidDisplayName) {
+    return { kind: "invalid_tool_display_name" as const, displayName: String(invalidDisplayName[1]) };
+  }
+  // Ensure access groups is always a string array
+  const {
+    static_headers: staticHeadersList,
+    env_vars: envVarsList,
+    credentials: credentialValues,
+    stdio_config: rawStdioConfig,
+    env_json: rawEnvJson,
+    command: rawCommand,
+    args: rawArgs,
+    allow_all_keys: allowAllKeysRaw,
+    available_on_public_internet: availableOnPublicInternetRaw,
+    delegate_auth_to_upstream: delegateAuthToUpstreamRaw,
+    oauth_passthrough: oauthPassthroughRaw,
+    dcr_bridge: dcrBridgeRaw,
+    token_validation_json: rawTokenValidationJson,
+    ...restValues
+  } = values;
+
+  const accessGroups = (restValues.mcp_access_groups || []).map((g: any) =>
+    typeof g === "string" ? g : g.name || String(g),
+  );
+
+  const staticHeaders = Array.isArray(staticHeadersList)
+    ? staticHeadersList.reduce((acc: Record<string, string>, entry: Record<string, string>) => {
+        const header = entry?.header?.trim();
+        if (!header) {
+          return acc;
+        }
+        acc[header] = (entry?.value ?? "").trim();
+        return acc;
+      }, {})
+    : ({} as Record<string, string>);
+
+  const envVars = normalizeEnvVars(envVarsList);
+
+  const credentialsPayload =
+    credentialValues && typeof credentialValues === "object"
+      ? Object.entries(credentialValues).reduce((acc: Record<string, any>, [key, value]) => {
+          if (value === undefined || value === null || value === "") {
+            if (value === "" && (ADMIN_CONFIG_CREDENTIAL_KEYS as readonly string[]).includes(key)) {
+              acc[key] = null;
+            }
+            return acc;
+          }
+          if (key === "scopes") {
+            if (Array.isArray(value)) {
+              const filteredScopes = value.filter((scope) => scope != null && scope !== "");
+              if (filteredScopes.length > 0) {
+                acc[key] = filteredScopes;
+              }
+            }
+          } else {
+            acc[key] = value;
+          }
+          return acc;
+        }, {})
+      : undefined;
+
+  let stdioFields: Record<string, any> = {};
+
+  if (restValues.transport === "stdio") {
+    // Prefer JSON config if provided (matches Create screen behavior)
+    if (rawStdioConfig) {
+      try {
+        const stdioConfig = JSON.parse(rawStdioConfig);
+
+        let actualConfig = stdioConfig;
+        if (stdioConfig?.mcpServers && typeof stdioConfig.mcpServers === "object") {
+          const serverNames = Object.keys(stdioConfig.mcpServers);
+          if (serverNames.length > 0) {
+            actualConfig = stdioConfig.mcpServers[serverNames[0]];
+          }
+        }
+
+        const parsedArgs = Array.isArray(actualConfig?.args)
+          ? actualConfig.args.map((v: any) => String(v)).filter((v: string) => v.trim() !== "")
+          : [];
+
+        const parsedEnv =
+          actualConfig?.env && typeof actualConfig.env === "object" && !Array.isArray(actualConfig.env)
+            ? Object.entries(actualConfig.env).reduce((acc: Record<string, string>, [k, v]) => {
+                if (k == null || String(k).trim() === "") return acc;
+                acc[String(k)] = v == null ? "" : String(v);
+                return acc;
+              }, {})
+            : {};
+
+        stdioFields = {
+          command: actualConfig?.command ? String(actualConfig.command) : undefined,
+          args: parsedArgs,
+          env: parsedEnv,
+        };
+
+        if (!stdioFields.command) {
+          return { kind: "stdio_config_missing_command" as const };
+        }
+      } catch {
+        return { kind: "invalid_stdio_json" as const };
+      }
+    } else {
+      // Dedicated fields path (command/args + env JSON)
+      let parsedEnv: Record<string, string> = {};
+      if (rawEnvJson) {
+        try {
+          const env = JSON.parse(rawEnvJson);
+          if (env && typeof env === "object" && !Array.isArray(env)) {
+            parsedEnv = Object.entries(env).reduce((acc: Record<string, string>, [k, v]) => {
+              if (k == null || String(k).trim() === "") return acc;
+              acc[String(k)] = v == null ? "" : String(v);
+              return acc;
+            }, {});
+          }
+        } catch {
+          return { kind: "invalid_stdio_env_json" as const };
+        }
+      }
+      const parsedArgs = Array.isArray(rawArgs)
+        ? rawArgs.map((v: any) => String(v)).filter((v: string) => v.trim() !== "")
+        : [];
+
+      const parsedCommand = rawCommand ? String(rawCommand).trim() : "";
+      if (!parsedCommand) {
+        return { kind: "stdio_command_required" as const };
+      }
+
+      stdioFields = {
+        command: parsedCommand,
+        args: parsedArgs,
+        env: parsedEnv,
+      };
+    }
+  }
+
+  // Map "openapi" transport to "http" for the backend
+  if (restValues.transport === TRANSPORT.OPENAPI) {
+    restValues.transport = "http";
+  }
+
+  // Parse token_validation JSON if provided
+  let tokenValidation: Record<string, any> | null = null;
+  if (rawTokenValidationJson && rawTokenValidationJson.trim() !== "") {
+    try {
+      tokenValidation = JSON.parse(rawTokenValidationJson);
+    } catch {
+      return { kind: "invalid_token_validation_json" as const };
+    }
+  }
+
+  // Prepare the payload with cost configuration and permission fields
+  const mcpInfoServerName =
+    restValues.server_name ||
+    restValues.url ||
+    mcpServer.server_name ||
+    mcpServer.url ||
+    restValues.alias ||
+    mcpServer.alias ||
+    "unknown";
+
+  const toolAllowlistEnforced = hasExistingToolAllowlist || hasToolAllowlistInteraction || allowedTools.length > 0;
+
+  const payload: Record<string, any> = {
+    ...restValues,
+    ...stdioFields,
+    // Remove UI-only fields
+    stdio_config: undefined,
+    env_json: undefined,
+    ...(mcpServer.auth_type === AUTH_TYPE.OAUTH2 && restValues.auth_type !== AUTH_TYPE.OAUTH2
+      ? { issuer: null, authorization_url: null, token_url: null, registration_url: null }
+      : {}),
+    ...(mcpServer.auth_type === AUTH_TYPE.OAUTH2_TOKEN_EXCHANGE &&
+    restValues.auth_type !== AUTH_TYPE.OAUTH2_TOKEN_EXCHANGE
+      ? { token_exchange_endpoint: null, audience: null, subject_token_type: null, token_exchange_profile: null }
+      : {}),
+    server_id: mcpServer.server_id,
+    mcp_info: {
+      ...(mcpServer.mcp_info ?? {}),
+      server_name: mcpInfoServerName,
+      description: restValues.description,
+      logo_url: logoUrl || undefined,
+      mcp_server_cost_info: Object.keys(costConfig).length > 0 ? costConfig : null,
+      tool_allowlist_enforced: toolAllowlistEnforced,
+    },
+    mcp_access_groups: accessGroups,
+    alias: restValues.alias,
+    // Include permission management fields
+    extra_headers: restValues.extra_headers || [],
+    ...(toolAllowlistEnforced
+      ? {
+          allowed_tools: allowedTools,
+        }
+      : {}),
+    tool_name_to_display_name: Object.keys(toolNameToDisplayName).length > 0 ? toolNameToDisplayName : null,
+    tool_name_to_description: Object.keys(toolNameToDescription).length > 0 ? toolNameToDescription : null,
+    disallowed_tools: restValues.disallowed_tools || [],
+    static_headers: staticHeaders,
+    env_vars: envVars,
+    allow_all_keys: Boolean(allowAllKeysRaw ?? mcpServer.allow_all_keys),
+    available_on_public_internet: Boolean(availableOnPublicInternetRaw ?? mcpServer.available_on_public_internet),
+    // ``delegate_auth_to_upstream`` is only honored server-side for
+    // ``auth_type=oauth2`` (PKCE passthrough). The field is
+    // conditionally rendered so the value drops out of the form on
+    // auth_type change; force false for any other configuration to avoid
+    // persisting a stale ``true`` that would silently re-activate if the
+    // configuration is later switched back.
+    delegate_auth_to_upstream: (() => {
+      const isOauth2 = restValues.auth_type === AUTH_TYPE.OAUTH2;
+      return isOauth2 ? Boolean(delegateAuthToUpstreamRaw ?? mcpServer.delegate_auth_to_upstream) : false;
+    })(),
+    // ``oauth_passthrough`` is the dedicated, non-oauth2 opt-in. It is only
+    // honored for ``auth_type=none`` servers that forward ``Authorization``
+    // upstream. Kept separate from ``delegate_auth_to_upstream`` so enabling
+    // pass-through never regresses oauth2 servers. Force false otherwise.
+    oauth_passthrough: (() => {
+      const isNoneAuth = restValues.auth_type === AUTH_TYPE.NONE || restValues.auth_type == null;
+      const extraHeaders = Array.isArray(restValues.extra_headers) ? restValues.extra_headers : [];
+      const hasAuthorizationHeader = extraHeaders.some(
+        (h: unknown) => typeof h === "string" && h.toLowerCase() === "authorization",
+      );
+      return isNoneAuth && hasAuthorizationHeader ? Boolean(oauthPassthroughRaw ?? mcpServer.oauth_passthrough) : false;
+    })(),
+    // ``dcr_bridge`` is only meaningful for the client-forwarded token
+    // modes (true_passthrough / oauth_delegate). The field is
+    // conditionally rendered so the value drops out of the form on
+    // auth_type change; force false for any other configuration to avoid
+    // persisting a stale ``true`` that would silently re-activate if the
+    // mode is later switched back.
+    dcr_bridge: isClientForwardedTokenMode(restValues.auth_type)
+      ? Boolean(dcrBridgeRaw ?? mcpServer.dcr_bridge)
+      : false,
+    ...(restValues.auth_type === AUTH_TYPE.OAUTH2 && restValues.oauth_flow_type
+      ? {
+          oauth2_flow:
+            restValues.oauth_flow_type === OAUTH_FLOW.M2M ? MCP_OAUTH2_FLOW_M2M : MCP_OAUTH2_FLOW_INTERACTIVE,
+        }
+      : {}),
+    // Include token_validation when it is set (non-null) or when clearing an existing value
+    ...(tokenValidation !== null || mcpServer.token_validation ? { token_validation: tokenValidation } : {}),
+  };
+
+  const includeCredentials = restValues.auth_type && AUTH_TYPES_REQUIRING_CREDENTIALS.includes(restValues.auth_type);
+
+  // Client-forwarded rows persist ONLY the declared app; strip any token material lingering in the
+  // form (e.g. from a prior oauth2 authorize this session) so it can never reach the row.
+  const submitCredentials = isClientForwardedTokenMode(restValues.auth_type)
+    ? preservedAdminCredentials(credentialsPayload)
+    : credentialsPayload;
+
+  if (includeCredentials && submitCredentials && Object.keys(submitCredentials).length > 0) {
+    payload.credentials = submitCredentials;
+  }
+
+  // Explicit removal of a saved app for the client-forwarded modes, applied AFTER the filter so it
+  // always wins. Blank fields are the keep-existing convention (the backend merges partial
+  // credential updates), so removal must be an explicit-null write: encrypt skips nulls and the
+  // merge overrides the stored keys, returning the server to dynamic client registration.
+  if (removeStoredApp && isClientForwardedTokenMode(restValues.auth_type)) {
+    payload.credentials = { client_id: null, client_secret: null };
+  }
+  return { kind: "ok" as const, payload };
+};
+
+const clone = <T>(v: T): T => structuredClone(v);
+
+describe("buildEditServerPayload matches the pre-extraction handleSave body", () => {
+  it.each(CASES.map((c) => [c.label, c] as const))("%s", (_label, testCase) => {
+    const ui: EditServerUiState = { ...baseUi, ...testCase.ui } as EditServerUiState;
+    const legacy = legacyBuild(clone(testCase.values), clone(ui) as EditServerUiState);
+    const next = buildEditServerPayload(clone(testCase.values), clone(ui) as EditServerUiState);
+
+    expect(next.kind).toBe(legacy.kind);
+    if (legacy.kind !== "ok" || next.kind !== "ok") {
+      expect(next).toStrictEqual(legacy);
+      return;
+    }
+    expect(next.payload).toStrictEqual(legacy.payload);
+    expect(Object.keys(next.payload)).toStrictEqual(Object.keys(legacy.payload));
+    expect(JSON.stringify(next.payload)).toBe(JSON.stringify(legacy.payload));
+  });
+});
+
+void ADMIN_CONFIG_CREDENTIAL_KEYS;
+void AUTH_TYPE;
+void AUTH_TYPES_REQUIRING_CREDENTIALS;
+void MCP_OAUTH2_FLOW_INTERACTIVE;
+void MCP_OAUTH2_FLOW_M2M;
+void OAUTH_FLOW;
+void TOOL_DISPLAY_NAME_PATTERN;
+void TRANSPORT;
+void isClientForwardedTokenMode;
+void normalizeEnvVars;
+void preservedAdminCredentials;
+export type { MCPServer };
diff --git a/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/editServerPayload.ts b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/editServerPayload.ts
new file mode 100644
index 00000000000..3930f1edb9b
--- /dev/null
+++ b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/editServerPayload.ts
@@ -0,0 +1,405 @@
+import {
+  ADMIN_CONFIG_CREDENTIAL_KEYS,
+  AUTH_TYPE,
+  MCPEnvVar,
+  MCPInfo,
+  MCPServer,
+  MCPServerCostInfo,
+  MCP_OAUTH2_FLOW_INTERACTIVE,
+  MCP_OAUTH2_FLOW_M2M,
+  OAUTH_FLOW,
+  TRANSPORT,
+  isClientForwardedTokenMode,
+  preservedAdminCredentials,
+} from "@/components/mcp_tools/types";
+import { AUTH_TYPES_REQUIRING_CREDENTIALS, reduceStaticHeaders } from "./createServerPayload";
+import { TOOL_DISPLAY_NAME_PATTERN, normalizeEnvVars } from "./utils";
+
+export type MCPAccessGroupValue = string | { readonly name?: string };
+
+export interface EditServerFormValues {
+  readonly static_headers?: unknown;
+  readonly env_vars?: unknown;
+  readonly credentials?: unknown;
+  readonly stdio_config?: string;
+  readonly env_json?: string;
+  readonly command?: string;
+  readonly args?: readonly string[];
+  readonly allow_all_keys?: boolean;
+  readonly available_on_public_internet?: boolean;
+  readonly delegate_auth_to_upstream?: boolean;
+  readonly oauth_passthrough?: boolean;
+  readonly dcr_bridge?: boolean;
+  readonly token_validation_json?: string;
+  readonly mcp_access_groups?: readonly MCPAccessGroupValue[];
+  readonly transport?: string;
+  readonly server_name?: string;
+  readonly url?: string;
+  readonly alias?: string;
+  readonly description?: string;
+  readonly auth_type?: string;
+  readonly extra_headers?: readonly string[];
+  readonly disallowed_tools?: readonly string[];
+  readonly oauth_flow_type?: string;
+  readonly [key: string]: unknown;
+}
+
+export interface EditServerPayload {
+  readonly server_id: string;
+  readonly mcp_info: MCPInfo;
+  readonly mcp_access_groups: readonly string[];
+  readonly alias: string | undefined;
+  readonly extra_headers: readonly string[];
+  readonly disallowed_tools: readonly string[];
+  readonly static_headers: Readonly<Record<string, string>>;
+  readonly env_vars: readonly MCPEnvVar[];
+  readonly allow_all_keys: boolean;
+  readonly available_on_public_internet: boolean;
+  readonly delegate_auth_to_upstream: boolean;
+  readonly oauth_passthrough: boolean;
+  readonly dcr_bridge: boolean;
+  readonly stdio_config: undefined;
+  readonly env_json: undefined;
+  readonly command?: string;
+  readonly args?: readonly string[];
+  readonly env?: Readonly<Record<string, string>>;
+  readonly allowed_tools?: readonly string[];
+  readonly tool_name_to_display_name: Readonly<Record<string, string>> | null;
+  readonly tool_name_to_description: Readonly<Record<string, string>> | null;
+  readonly oauth2_flow?: string;
+  readonly token_validation?: unknown;
+  readonly credentials?: Readonly<Record<string, unknown>>;
+  readonly [key: string]: unknown;
+}
+
+export interface EditServerUiState {
+  readonly mcpServer: MCPServer;
+  readonly logoUrl: string | undefined;
+  readonly costConfig: MCPServerCostInfo;
+  readonly allowedTools: readonly string[];
+  readonly hasExistingToolAllowlist: boolean;
+  readonly hasToolAllowlistInteraction: boolean;
+  readonly toolNameToDisplayName: Readonly<Record<string, string>>;
+  readonly toolNameToDescription: Readonly<Record<string, string>>;
+  readonly removeStoredApp: boolean;
+}
+
+export type BuildEditPayloadResult =
+  | { readonly kind: "ok"; readonly payload: EditServerPayload }
+  | { readonly kind: "invalid_tool_display_name"; readonly displayName: string }
+  | { readonly kind: "stdio_config_missing_command" }
+  | { readonly kind: "invalid_stdio_json" }
+  | { readonly kind: "invalid_stdio_env_json" }
+  | { readonly kind: "stdio_command_required" }
+  | { readonly kind: "invalid_token_validation_json" };
+
+interface StdioFields {
+  readonly command: string;
+  readonly args: readonly string[];
+  readonly env: Readonly<Record<string, string>>;
+}
+
+type StdioFieldsResult =
+  | { readonly kind: "ok"; readonly fields: StdioFields | Record<string, never> }
+  | { readonly kind: "stdio_config_missing_command" }
+  | { readonly kind: "invalid_stdio_json" }
+  | { readonly kind: "invalid_stdio_env_json" }
+  | { readonly kind: "stdio_command_required" };
+
+type TokenValidationResult = { readonly kind: "ok"; readonly value: unknown } | { readonly kind: "invalid" };
+
+const assertNever = (value: never): never => {
+  throw new Error(`unhandled edit payload result: ${JSON.stringify(value)}`);
+};
+
+export const editPayloadErrorMessage = (result: Exclude<BuildEditPayloadResult, { kind: "ok" }>): string => {
+  switch (result.kind) {
+    case "invalid_tool_display_name":
+      return `Tool display name "${result.displayName}" is invalid. Only letters, digits, underscores, and hyphens are allowed (no spaces).`;
+    case "stdio_config_missing_command":
+      return "Stdio configuration must include a command";
+    case "invalid_stdio_json":
+      return "Invalid JSON in stdio configuration";
+    case "invalid_stdio_env_json":
+      return "Invalid JSON in stdio env configuration";
+    case "stdio_command_required":
+      return "Stdio transport requires a command";
+    case "invalid_token_validation_json":
+      return "Invalid JSON in Token Validation Rules";
+    default:
+      return assertNever(result);
+  }
+};
+
+const toStringArgs = (raw: unknown): readonly string[] =>
+  Array.isArray(raw) ? raw.map((v: unknown) => String(v)).filter((v: string) => v.trim() !== "") : [];
+
+const toEnvRecord = (raw: unknown): Readonly<Record<string, string>> =>
+  raw && typeof raw === "object" && !Array.isArray(raw)
+    ? Object.fromEntries(
+        Object.entries(raw)
+          .filter(([k]) => k != null && String(k).trim() !== "")
+          .map(([k, v]) => [String(k), v == null ? "" : String(v)]),
+      )
+    : {};
+
+const buildStdioFields = (
+  rawStdioConfig: string | undefined,
+  rawEnvJson: string | undefined,
+  rawCommand: string | undefined,
+  rawArgs: readonly string[] | undefined,
+): StdioFieldsResult => {
+  if (rawStdioConfig) {
+    try {
+      const stdioConfig: unknown = JSON.parse(rawStdioConfig);
+      const configRecord = stdioConfig && typeof stdioConfig === "object" ? (stdioConfig as StdioConfigShape) : null;
+      const namedServers =
+        configRecord?.mcpServers && typeof configRecord.mcpServers === "object" ? configRecord.mcpServers : null;
+      const named = namedServers ? Object.keys(namedServers) : [];
+      const actualConfig = named.length > 0 && namedServers ? namedServers[named[0]] : configRecord;
+      const command = actualConfig?.command ? String(actualConfig.command) : undefined;
+      if (!command) {
+        return { kind: "stdio_config_missing_command" };
+      }
+      return {
+        kind: "ok",
+        fields: { command, args: toStringArgs(actualConfig?.args), env: toEnvRecord(actualConfig?.env) },
+      };
+    } catch {
+      return { kind: "invalid_stdio_json" };
+    }
+  }
+
+  const envResult = ((): Readonly<Record<string, string>> | "invalid" => {
+    if (!rawEnvJson) return {};
+    try {
+      return toEnvRecord(JSON.parse(rawEnvJson));
+    } catch {
+      return "invalid";
+    }
+  })();
+  if (envResult === "invalid") {
+    return { kind: "invalid_stdio_env_json" };
+  }
+
+  const parsedCommand = rawCommand ? String(rawCommand).trim() : "";
+  if (!parsedCommand) {
+    return { kind: "stdio_command_required" };
+  }
+  return { kind: "ok", fields: { command: parsedCommand, args: toStringArgs(rawArgs), env: envResult } };
+};
+
+interface StdioConfigShape {
+  readonly mcpServers?: Readonly<Record<string, StdioConfigShape>>;
+  readonly command?: unknown;
+  readonly args?: unknown;
+  readonly env?: unknown;
+}
+
+const buildCredentials = (credentialValues: unknown): Readonly<Record<string, unknown>> | undefined => {
+  if (!credentialValues || typeof credentialValues !== "object") return undefined;
+  const kept = Object.entries(credentialValues).flatMap(([key, value]): readonly (readonly [string, unknown])[] => {
+    if (value === undefined || value === null || value === "") {
+      return value === "" && (ADMIN_CONFIG_CREDENTIAL_KEYS as readonly string[]).includes(key)
+        ? [[key, null] as const]
+        : [];
+    }
+    if (key !== "scopes") return [[key, value] as const];
+    if (!Array.isArray(value)) return [];
+    const filteredScopes = value.filter((scope: unknown) => scope != null && scope !== "");
+    return filteredScopes.length > 0 ? [[key, filteredScopes] as const] : [];
+  });
+  return Object.fromEntries(kept);
+};
+
+interface CredentialsEntryInput {
+  readonly authType: string | undefined;
+  readonly credentials: Readonly<Record<string, unknown>> | undefined;
+  readonly includeCredentials: boolean;
+  readonly removeStoredApp: boolean;
+}
+
+// Explicit removal of a saved app for the client-forwarded modes, applied AFTER the filter so it
+// always wins. Blank fields are the keep-existing convention (the backend merges partial credential
+// updates), so removal must be an explicit-null write: encrypt skips nulls and the merge overrides
+// the stored keys, returning the server to dynamic client registration.
+const resolveCredentialsEntry = ({
+  authType,
+  credentials,
+  includeCredentials,
+  removeStoredApp,
+}: CredentialsEntryInput): { readonly credentials?: Readonly<Record<string, unknown>> } => {
+  if (removeStoredApp && isClientForwardedTokenMode(authType)) {
+    return { credentials: { client_id: null, client_secret: null } };
+  }
+  if (includeCredentials && credentials && Object.keys(credentials).length > 0) {
+    return { credentials };
+  }
+  return {};
+};
+
+export const buildEditServerPayload = (values: EditServerFormValues, ui: EditServerUiState): BuildEditPayloadResult => {
+  const {
+    mcpServer,
+    logoUrl,
+    costConfig,
+    allowedTools,
+    hasExistingToolAllowlist,
+    hasToolAllowlistInteraction,
+    toolNameToDisplayName,
+    toolNameToDescription,
+    removeStoredApp,
+  } = ui;
+
+  const invalidDisplayName = Object.entries(toolNameToDisplayName).find(
+    ([, displayName]) => displayName && !TOOL_DISPLAY_NAME_PATTERN.test(displayName),
+  );
+  if (invalidDisplayName) {
+    return { kind: "invalid_tool_display_name", displayName: String(invalidDisplayName[1]) };
+  }
+
+  const {
+    static_headers: staticHeadersList,
+    env_vars: envVarsList,
+    credentials: credentialValues,
+    stdio_config: rawStdioConfig,
+    env_json: rawEnvJson,
+    command: rawCommand,
+    args: rawArgs,
+    allow_all_keys: allowAllKeysRaw,
+    available_on_public_internet: availableOnPublicInternetRaw,
+    delegate_auth_to_upstream: delegateAuthToUpstreamRaw,
+    oauth_passthrough: oauthPassthroughRaw,
+    dcr_bridge: dcrBridgeRaw,
+    token_validation_json: rawTokenValidationJson,
+    ...rawRestValues
+  } = values;
+
+  const accessGroups = (rawRestValues.mcp_access_groups || []).map((g) =>
+    typeof g === "string" ? g : g.name || String(g),
+  );
+  const staticHeaders = reduceStaticHeaders(staticHeadersList);
+  const envVars = normalizeEnvVars(envVarsList);
+  const credentialsPayload = buildCredentials(credentialValues);
+
+  const stdio =
+    rawRestValues.transport === "stdio"
+      ? buildStdioFields(rawStdioConfig, rawEnvJson, rawCommand, rawArgs)
+      : ({ kind: "ok", fields: {} } as StdioFieldsResult);
+  if (stdio.kind !== "ok") {
+    return stdio;
+  }
+
+  // Map "openapi" transport to "http" for the backend. Rewriting the existing key keeps its
+  // position, which the payload's serialised key order depends on.
+  const restValues =
+    rawRestValues.transport === TRANSPORT.OPENAPI ? { ...rawRestValues, transport: "http" } : rawRestValues;
+
+  const tokenValidation = ((): TokenValidationResult => {
+    if (!rawTokenValidationJson || rawTokenValidationJson.trim() === "") return { kind: "ok", value: null };
+    try {
+      return { kind: "ok", value: JSON.parse(rawTokenValidationJson) };
+    } catch {
+      return { kind: "invalid" };
+    }
+  })();
+  if (tokenValidation.kind === "invalid") {
+    return { kind: "invalid_token_validation_json" };
+  }
+
+  const mcpInfoServerName =
+    restValues.server_name ||
+    restValues.url ||
+    mcpServer.server_name ||
+    mcpServer.url ||
+    restValues.alias ||
+    mcpServer.alias ||
+    "unknown";
+
+  const toolAllowlistEnforced = hasExistingToolAllowlist || hasToolAllowlistInteraction || allowedTools.length > 0;
+
+  const extraHeaders = restValues.extra_headers || [];
+  const hasAuthorizationHeader = extraHeaders.some((h) => typeof h === "string" && h.toLowerCase() === "authorization");
+  const isNoneAuth = restValues.auth_type === AUTH_TYPE.NONE || restValues.auth_type == null;
+
+  // Client-forwarded rows persist ONLY the declared app; strip any token material lingering in the
+  // form (e.g. from a prior oauth2 authorize this session) so it can never reach the row.
+  const submitCredentials = isClientForwardedTokenMode(restValues.auth_type)
+    ? preservedAdminCredentials(credentialsPayload)
+    : credentialsPayload;
+  const includeCredentials = restValues.auth_type && AUTH_TYPES_REQUIRING_CREDENTIALS.includes(restValues.auth_type);
+
+  const credentialsEntryInput: CredentialsEntryInput = {
+    authType: restValues.auth_type,
+    credentials: submitCredentials,
+    includeCredentials: Boolean(includeCredentials),
+    removeStoredApp,
+  };
+  const credentialsEntry = resolveCredentialsEntry(credentialsEntryInput);
+
+  const payload: EditServerPayload = {
+    ...restValues,
+    ...stdio.fields,
+    // Remove UI-only fields
+    stdio_config: undefined,
+    env_json: undefined,
+    ...(mcpServer.auth_type === AUTH_TYPE.OAUTH2 && restValues.auth_type !== AUTH_TYPE.OAUTH2
+      ? { issuer: null, authorization_url: null, token_url: null, registration_url: null }
+      : {}),
+    ...(mcpServer.auth_type === AUTH_TYPE.OAUTH2_TOKEN_EXCHANGE &&
+    restValues.auth_type !== AUTH_TYPE.OAUTH2_TOKEN_EXCHANGE
+      ? { token_exchange_endpoint: null, audience: null, subject_token_type: null, token_exchange_profile: null }
+      : {}),
+    server_id: mcpServer.server_id,
+    mcp_info: {
+      ...(mcpServer.mcp_info ?? {}),
+      server_name: mcpInfoServerName,
+      description: restValues.description,
+      logo_url: logoUrl || undefined,
+      mcp_server_cost_info: Object.keys(costConfig).length > 0 ? costConfig : null,
+      tool_allowlist_enforced: toolAllowlistEnforced,
+    },
+    mcp_access_groups: accessGroups,
+    alias: restValues.alias,
+    // Include permission management fields
+    extra_headers: extraHeaders,
+    ...(toolAllowlistEnforced ? { allowed_tools: allowedTools } : {}),
+    tool_name_to_display_name: Object.keys(toolNameToDisplayName).length > 0 ? toolNameToDisplayName : null,
+    tool_name_to_description: Object.keys(toolNameToDescription).length > 0 ? toolNameToDescription : null,
+    disallowed_tools: restValues.disallowed_tools || [],
+    static_headers: staticHeaders,
+    env_vars: envVars,
+    allow_all_keys: Boolean(allowAllKeysRaw ?? mcpServer.allow_all_keys),
+    available_on_public_internet: Boolean(availableOnPublicInternetRaw ?? mcpServer.available_on_public_internet),
+    // ``delegate_auth_to_upstream`` is only honored server-side for ``auth_type=oauth2`` (PKCE
+    // passthrough). The field unmounts on auth_type change, so force false for any other
+    // configuration to avoid persisting a stale ``true`` that would silently re-activate.
+    delegate_auth_to_upstream:
+      restValues.auth_type === AUTH_TYPE.OAUTH2
+        ? Boolean(delegateAuthToUpstreamRaw ?? mcpServer.delegate_auth_to_upstream)
+        : false,
+    // ``oauth_passthrough`` is the dedicated, non-oauth2 opt-in, honored only for ``auth_type=none``
+    // servers that forward ``Authorization`` upstream. Kept separate from
+    // ``delegate_auth_to_upstream`` so enabling pass-through never regresses oauth2 servers.
+    oauth_passthrough:
+      isNoneAuth && hasAuthorizationHeader ? Boolean(oauthPassthroughRaw ?? mcpServer.oauth_passthrough) : false,
+    // ``dcr_bridge`` is only meaningful for the client-forwarded token modes. The field unmounts on
+    // auth_type change, so force false otherwise rather than persisting a stale ``true``.
+    dcr_bridge: isClientForwardedTokenMode(restValues.auth_type)
+      ? Boolean(dcrBridgeRaw ?? mcpServer.dcr_bridge)
+      : false,
+    ...(restValues.auth_type === AUTH_TYPE.OAUTH2 && restValues.oauth_flow_type
+      ? {
+          oauth2_flow:
+            restValues.oauth_flow_type === OAUTH_FLOW.M2M ? MCP_OAUTH2_FLOW_M2M : MCP_OAUTH2_FLOW_INTERACTIVE,
+        }
+      : {}),
+    // Include token_validation when it is set (non-null) or when clearing an existing value
+    ...(tokenValidation.value !== null || mcpServer.token_validation
+      ? { token_validation: tokenValidation.value }
+      : {}),
+    ...credentialsEntry,
+  };
+
+  return { kind: "ok", payload };
+};
diff --git a/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/mcpFieldRules.ts b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/mcpFieldRules.ts
new file mode 100644
index 00000000000..76ff74eac52
--- /dev/null
+++ b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/mcpFieldRules.ts
@@ -0,0 +1,98 @@
+import type { Validate } from "react-hook-form";
+
+import type { MountedFieldControlProps, MountedFormValues } from "@/components/common_components/MountedFormField";
+
+type McpValidate = Validate<unknown, MountedFormValues>;
+
+const ariaOf = (control: MountedFieldControlProps) => ({
+  id: control.id,
+  onBlur: control.onBlur,
+  "aria-required": control["aria-required"],
+  "aria-invalid": control["aria-invalid"],
+  "aria-describedby": control["aria-describedby"],
+});
+
+export const textControl = (control: MountedFieldControlProps) => ({
+  ...ariaOf(control),
+  name: control.name,
+  value: control.value === null || control.value === undefined ? "" : String(control.value),
+  onChange: control.onChange,
+});
+
+export const selectControl = <TValue = unknown>(control: MountedFieldControlProps) => ({
+  ...ariaOf(control),
+  value: control.value as TValue,
+  onChange: control.onChange,
+});
+
+export const numberControl = (control: MountedFieldControlProps) => ({
+  ...ariaOf(control),
+  value: control.value as number | null | undefined,
+  onChange: control.onChange,
+});
+
+export const switchControl = (control: MountedFieldControlProps) => ({
+  ...ariaOf(control),
+  checked: control.value === true,
+  onChange: control.onChange,
+});
+
+export const invertedSwitchControl = (control: MountedFieldControlProps) => ({
+  ...ariaOf(control),
+  checked: control.value !== true,
+  onChange: (checked: boolean) => control.onChange(!checked),
+});
+
+export const valueAt = (values: MountedFormValues, path: readonly string[]): unknown =>
+  path.reduce<unknown>(
+    (node, segment) => (node === null || node === undefined ? undefined : (node as Record<string, unknown>)[segment]),
+    values,
+  );
+
+export const parsesAsJson =
+  (message: string): McpValidate =>
+  (value) => {
+    if (typeof value !== "string" || value.trim() === "") {
+      return true;
+    }
+    try {
+      JSON.parse(value);
+      return true;
+    } catch {
+      return message;
+    }
+  };
+
+export const parsesAsJsonObject =
+  (message: string, notObjectMessage: string): McpValidate =>
+  (value) => {
+    if (typeof value !== "string" || value === "") {
+      return true;
+    }
+    try {
+      const parsed: unknown = JSON.parse(value);
+      return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? true : notObjectMessage;
+    } catch {
+      return message;
+    }
+  };
+
+export const matchesPattern =
+  (pattern: RegExp, message: string): McpValidate =>
+  (value) =>
+    typeof value === "string" && value !== "" && !pattern.test(value) ? message : true;
+
+export const notOnlyWhitespace =
+  (message: string): McpValidate =>
+  (value) =>
+    typeof value === "string" && value !== "" && value.trim() === "" ? message : true;
+
+export const requiredWhenSiblingSet =
+  (siblingPath: readonly string[], message: string): McpValidate =>
+  (value, values) =>
+    valueAt(values, siblingPath) && !value ? message : true;
+
+export const requiredUnlessSiblingSet =
+  (siblingPath: readonly string[], message: string): McpValidate =>
+  (value, values) =>
+    value || valueAt(values, siblingPath) ? true : message;
diff --git a/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/mcpFormStore.test.tsx b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/mcpFormStore.test.tsx
new file mode 100644
index 00000000000..25eba43335e
--- /dev/null
+++ b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/mcpFormStore.test.tsx
@@ -0,0 +1,132 @@
+import React from "react";
+import { describe, expect, it } from "vitest";
+import { render } from "@testing-library/react";
+import { useForm } from "react-hook-form";
+
+import type { MountedFormValues } from "@/components/common_components/MountedFormField";
+import { allFieldsValue, deepMergedFieldsValue, resetFields, setFieldsValue, singleBranchChange } from "./mcpFormStore";
+
+const withForm = (
+  defaultValues: MountedFormValues,
+  act: (form: ReturnType<typeof useForm<MountedFormValues>>) => void,
+) => {
+  let store: MountedFormValues = {};
+  const Probe: React.FC = () => {
+    const form = useForm<MountedFormValues>({ defaultValues });
+    React.useEffect(() => {
+      act(form);
+      store = allFieldsValue(form);
+    }, [form]);
+    return null;
+  };
+  render(<Probe />);
+  return store;
+};
+
+describe("deepMergedFieldsValue", () => {
+  it("keeps a sibling key when a nested object is written, which is what preserves a declared app", () => {
+    expect(
+      deepMergedFieldsValue(
+        { credentials: { client_id: "kept", access_token: "tok" } },
+        { credentials: { client_id: "typed" } },
+      ),
+    ).toStrictEqual({ credentials: { client_id: "typed", access_token: "tok" } });
+  });
+
+  it("replaces an array rather than merging it index by index", () => {
+    expect(deepMergedFieldsValue({ extra_headers: ["a", "b", "c"] }, { extra_headers: ["z"] })).toStrictEqual({
+      extra_headers: ["z"],
+    });
+  });
+
+  it("writes an explicit undefined instead of skipping the key, which is how a transport switch clears a field", () => {
+    const merged = deepMergedFieldsValue({ url: "https://old", auth_type: "api_key" }, { url: undefined });
+    expect(merged).toStrictEqual({ url: undefined, auth_type: "api_key" });
+    expect("url" in merged).toBe(true);
+  });
+
+  it("writes an explicit null rather than treating it as a merge target", () => {
+    expect(deepMergedFieldsValue({ credentials: { client_id: "x" } }, { credentials: null })).toStrictEqual({
+      credentials: null,
+    });
+  });
+
+  it("replaces a primitive with an object when the incoming value is an object", () => {
+    expect(deepMergedFieldsValue({ credentials: "not-an-object" }, { credentials: { client_id: "x" } })).toStrictEqual({
+      credentials: { client_id: "x" },
+    });
+  });
+
+  it("does not mutate the store it was handed", () => {
+    const store = { credentials: { client_id: "kept" } };
+    deepMergedFieldsValue(store, { credentials: { client_secret: "added" } });
+    expect(store).toStrictEqual({ credentials: { client_id: "kept" } });
+  });
+
+  it("treats a missing store as empty rather than throwing", () => {
+    expect(deepMergedFieldsValue(undefined, { alias: "a" })).toStrictEqual({ alias: "a" });
+  });
+});
+
+describe("singleBranchChange", () => {
+  it("carries only the changed leaf, so re-applying it cannot resurrect a sibling token key", () => {
+    expect(
+      singleBranchChange("credentials.client_id", { credentials: { client_id: "typed", access_token: "stale" } }),
+    ).toStrictEqual({ credentials: { client_id: "typed" } });
+  });
+
+  it("exposes the changed top-level key so an upstream-field check can test membership", () => {
+    const changed = singleBranchChange("url", { url: "https://new", alias: "a" });
+    expect("url" in changed).toBe(true);
+    expect("alias" in changed).toBe(false);
+  });
+
+  it("builds an array for a numeric segment so a list row does not become an object keyed by index", () => {
+    expect(
+      singleBranchChange("static_headers.1.value", { static_headers: [{ value: "a" }, { value: "b" }] }),
+    ).toStrictEqual({ static_headers: [undefined, { value: "b" }] });
+  });
+
+  it("yields an undefined leaf rather than throwing when the path is not in the store", () => {
+    expect(singleBranchChange("credentials.client_secret", {})).toStrictEqual({
+      credentials: { client_secret: undefined },
+    });
+  });
+});
+
+describe("resetFields", () => {
+  it("restores the seeded value rather than clearing the key, so an edit reset keeps the saved server's credentials", () => {
+    const store = withForm({ credentials: { client_id: "saved", access_token: "tok" } }, (form) => {
+      form.setValue("credentials", { client_id: "typed" });
+      resetFields(form, ["credentials"], { credentials: { client_id: "saved", access_token: "tok" } });
+    });
+
+    expect(store.credentials).toStrictEqual({ client_id: "saved", access_token: "tok" });
+  });
+
+  it("clears the key when no seed is supplied, which is what the create form's blank store means", () => {
+    const store = withForm({ credentials: { client_id: "typed" } }, (form) => {
+      resetFields(form, ["credentials"]);
+    });
+
+    expect(store).toHaveProperty("credentials", undefined);
+  });
+});
+
+describe("setFieldsValue", () => {
+  it("writes an undefined leaf into the live store, so a transport switch really clears the field", () => {
+    const store = withForm({ url: "https://example.com", command: "npx" }, (form) => {
+      setFieldsValue(form, { url: undefined });
+    });
+
+    expect(store).toStrictEqual({ url: undefined, command: "npx" });
+  });
+
+  it("merges a nested write into the live store instead of replacing the whole object", () => {
+    const store = withForm({ credentials: { client_id: "kept", scopes: ["a"] } }, (form) => {
+      setFieldsValue(form, { credentials: { client_secret: "new" } });
+    });
+
+    expect(store.credentials).toStrictEqual({ client_id: "kept", scopes: ["a"], client_secret: "new" });
+  });
+});
diff --git a/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/mcpFormStore.ts b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/mcpFormStore.ts
new file mode 100644
index 00000000000..20df3e32273
--- /dev/null
+++ b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/mcpFormStore.ts
@@ -0,0 +1,107 @@
+import { useWatch } from "react-hook-form";
+import type { Control, UseFormReturn } from "react-hook-form";
+
+import {
+  projectMountedValues,
+  type MountRegistry,
+  type MountedFormValues,
+} from "@/components/common_components/MountedFormField";
+
+export type McpForm = UseFormReturn<MountedFormValues>;
+
+const isPlainObject = (value: unknown): value is Record<string, unknown> =>
+  typeof value === "object" && value !== null && Object.getPrototypeOf(value) === Object.prototype;
+
+export const deepMergedFieldsValue = (store: unknown, values: Record<string, unknown>): Record<string, unknown> =>
+  Object.entries(values).reduce<Record<string, unknown>>(
+    (merged, [key, value]) => ({
+      ...merged,
+      [key]: isPlainObject(value) ? deepMergedFieldsValue(merged[key], value) : value,
+    }),
+    isPlainObject(store) ? { ...store } : {},
+  );
+
+export const setFieldsValue = (form: McpForm, values: Record<string, unknown>): void => {
+  const merged = deepMergedFieldsValue(form.getValues(), values);
+  Object.keys(values).forEach((key) => form.setValue(key, merged[key]));
+};
+
+export const resetFields = (form: McpForm, names: readonly string[], defaults: MountedFormValues = {}): void => {
+  names.forEach((name) => {
+    form.setValue(name, defaults[name]);
+    form.clearErrors(name);
+  });
+};
+
+const branchAt = (segments: readonly string[], leaf: unknown): unknown => {
+  const [head, ...rest] = segments;
+  if (head === undefined) {
+    return leaf;
+  }
+  const child = branchAt(rest, leaf);
+  if (!/^\d+$/.test(head)) {
+    return { [head]: child };
+  }
+  const index = Number(head);
+  return Array.from({ length: index + 1 }, (_, position) => (position === index ? child : undefined));
+};
+
+export const singleBranchChange = (path: string, values: MountedFormValues): Record<string, unknown> => {
+  const segments = path.split(".");
+  const leaf = segments.reduce<unknown>(
+    (node, segment) => (node === null || node === undefined ? undefined : (node as Record<string, unknown>)[segment]),
+    values,
+  );
+  return branchAt(segments, leaf) as Record<string, unknown>;
+};
+
+export interface McpStaticHeaderRow {
+  header?: string;
+  value?: string;
+}
+
+export interface McpEnvVarRow {
+  name?: string;
+  value?: string;
+  scope?: string;
+  description?: string;
+}
+
+export interface McpListValues {
+  static_headers: McpStaticHeaderRow[];
+  env_vars: McpEnvVarRow[];
+}
+
+export interface McpFormSnapshot extends MountedFormValues {
+  readonly server_name?: string;
+  readonly alias?: string;
+  readonly description?: string;
+  readonly url?: string;
+  readonly spec_path?: string;
+  readonly transport?: string;
+  readonly auth_type?: string;
+  readonly oauth_flow_type?: string;
+  readonly credentials?: Record<string, unknown>;
+  readonly issuer?: string;
+  readonly authorization_url?: string;
+  readonly token_url?: string;
+  readonly registration_url?: string;
+  readonly mcp_access_groups?: string[];
+  readonly static_headers?: readonly McpStaticHeaderRow[];
+  readonly command?: string;
+  readonly args?: string[];
+  readonly env?: Record<string, string>;
+}
+
+export const allFieldsValue = (form: McpForm): McpFormSnapshot => form.getValues() as McpFormSnapshot;
+
+export const listControl = (control: Control<MountedFormValues>): Control<McpListValues> =>
+  control as unknown as Control<McpListValues>;
+
+export const mountedPaths = (registry: MountRegistry): readonly string[] =>
+  registry.mountedNames().map((name) => (Array.isArray(name) ? name.join(".") : (name as string)));
+
+export const useMountedValues = (form: McpForm, registry: MountRegistry): MountedFormValues => {
+  useWatch({ control: form.control });
+  return projectMountedValues(registry, form.getValues);
+};
diff --git a/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/mcp_server_edit.integration.test.tsx b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/mcp_server_edit.integration.test.tsx
new file mode 100644
index 00000000000..a9664191f3f
--- /dev/null
+++ b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/mcp_server_edit.integration.test.tsx
@@ -0,0 +1,371 @@
+import React from "react";
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { render, screen, waitFor, act } from "@testing-library/react";
+
+import MCPServerEdit from "./mcp_server_edit";
+import * as networking from "@/components/networking";
+import { MCPServer } from "@/components/mcp_tools/types";
+
+vi.mock("@/components/networking", () => ({
+  updateMCPServer: vi.fn(),
+  listMCPTools: vi.fn().mockResolvedValue({ tools: [], error: null }),
+  storeMCPOAuthUserCredential: vi.fn().mockResolvedValue({}),
+  testMCPToolsListRequest: vi.fn().mockResolvedValue({ tools: [], error: null }),
+}));
+
+vi.mock("@/hooks/useMcpOAuthFlow", () => ({
+  useMcpOAuthFlow: () => ({
+    startOAuthFlow: vi.fn(),
+    status: "idle",
+    error: null,
+    tokenResponse: null,
+    reset: vi.fn(),
+  }),
+}));
+
+vi.mock("./mcp_server_cost_config", () => ({
+  default: () => <div data-testid="mcp-cost-config" />,
+}));
+
+vi.mock("./mcp_tool_configuration", () => ({
+  default: () => <div data-testid="mcp-tool-config" />,
+}));
+
+const BASE: MCPServer = {
+  server_id: "srv_1",
+  server_name: "srv",
+  alias: "srv_alias",
+  description: "a server",
+  transport: "http",
+  url: "https://example.com/mcp",
+  auth_type: "none",
+  created_at: "2024-01-01T00:00:00Z",
+  created_by: "user-1",
+  updated_at: "2024-01-01T00:00:00Z",
+  updated_by: "user-1",
+  mcp_access_groups: [],
+};
+
+const CREDS = {
+  auth_value: "secret-value",
+  client_id: "cid",
+  client_secret: "csec",
+  scopes: "read write",
+  aws_region_name: "us-east-1",
+  aws_service_name: "bedrock",
+  aws_access_key_id: "AKIA",
+  aws_secret_access_key: "shh",
+  aws_session_token: "tok",
+  aws_role_name: "role",
+  aws_session_name: "sess",
+  id_jag_resource: "api://res",
+  id_jag_resource_token_endpoint: "https://idp/jag",
+  client_private_key: "-----KEY-----",
+  client_private_key_id: "kid",
+  client_assertion_signing_alg: "RS256",
+  token_endpoint_auth_method: "client_secret_basic",
+  upstream_resource: "api://up",
+};
+
+const EXPECTED_BASE: Readonly<Record<string, unknown>> = {
+  alias: "srv_alias",
+  allow_all_keys: false,
+  auth_type: "none",
+  available_on_public_internet: true,
+  dcr_bridge: false,
+  delegate_auth_to_upstream: false,
+  description: "a server",
+  disallowed_tools: [],
+  env_json: undefined,
+  env_vars: [],
+  extra_headers: [],
+  max_concurrent_requests: undefined,
+  mcp_access_groups: [],
+  mcp_info: {
+    description: "a server",
+    logo_url: undefined,
+    mcp_server_cost_info: null,
+    server_name: "srv",
+    tool_allowlist_enforced: false,
+  },
+  oauth_passthrough: false,
+  server_id: "srv_1",
+  server_name: "srv",
+  static_headers: {},
+  stdio_config: undefined,
+  tool_name_to_description: null,
+  tool_name_to_display_name: null,
+  transport: "http",
+  url: "https://example.com/mcp",
+};
+
+const without = (keys: readonly string[]): Record<string, unknown> =>
+  Object.fromEntries(Object.entries(EXPECTED_BASE).filter(([k]) => !keys.includes(k)));
+
+interface Case {
+  readonly label: string;
+  readonly server: MCPServer;
+  readonly expected: Record<string, unknown>;
+}
+
+const CASES: readonly Case[] = [
+  { label: "http + none", server: BASE, expected: { ...EXPECTED_BASE } },
+  {
+    label: "stdio drops auth_type and url and adds the stdio trio",
+    server: { ...BASE, transport: "stdio", url: null, command: "npx", args: ["-y", "pkg"], env: { A: "1" } },
+    expected: { ...without(["auth_type", "url"]), args: ["-y", "pkg"], command: "npx", env: {}, transport: "stdio" },
+  },
+  {
+    label: "openapi swaps url for spec_path",
+    server: { ...BASE, transport: "openapi", url: null, spec_path: "https://example.com/openapi.json" },
+    expected: { ...without(["url"]), spec_path: "https://example.com/openapi.json" },
+  },
+  {
+    label: "api_key sends only auth_value under credentials",
+    server: { ...BASE, auth_type: "api_key", credentials: CREDS },
+    expected: { ...EXPECTED_BASE, auth_type: "api_key", credentials: { auth_value: "secret-value" } },
+  },
+  {
+    label: "bearer_token sends only auth_value under credentials",
+    server: { ...BASE, auth_type: "bearer_token", credentials: CREDS },
+    expected: { ...EXPECTED_BASE, auth_type: "bearer_token", credentials: { auth_value: "secret-value" } },
+  },
+  {
+    label: "basic sends only auth_value under credentials",
+    server: { ...BASE, auth_type: "basic", credentials: CREDS },
+    expected: { ...EXPECTED_BASE, auth_type: "basic", credentials: { auth_value: "secret-value" } },
+  },
+  {
+    label: "oauth2 m2m mounts token_url and omits the interactive endpoints entirely",
+    server: {
+      ...BASE,
+      auth_type: "oauth2",
+      oauth2_flow: "client_credentials",
+      token_url: "https://idp/token",
+      credentials: CREDS,
+    },
+    expected: {
+      ...EXPECTED_BASE,
+      auth_type: "oauth2",
+      credentials: {
+        client_id: "cid",
+        client_secret: "csec",
+        token_endpoint_auth_method: "client_secret_basic",
+        upstream_resource: "api://up",
+      },
+      oauth2_flow: "client_credentials",
+      oauth_flow_type: "m2m",
+      token_url: "https://idp/token",
+    },
+  },
+  {
+    label: "oauth2 interactive mounts the full endpoint set, empty ones present as undefined",
+    server: {
+      ...BASE,
+      auth_type: "oauth2",
+      oauth2_flow: "authorization_code",
+      issuer: "https://idp",
+      credentials: CREDS,
+    },
+    expected: {
+      ...EXPECTED_BASE,
+      auth_type: "oauth2",
+      authorization_url: undefined,
+      credentials: {
+        client_id: "cid",
+        client_secret: "csec",
+        token_endpoint_auth_method: "client_secret_basic",
+        upstream_resource: "api://up",
+      },
+      issuer: "https://idp",
+      oauth2_flow: "authorization_code",
+      oauth_flow_type: "interactive",
+      registration_url: undefined,
+      token_storage_ttl_seconds: undefined,
+      token_url: undefined,
+    },
+  },
+  {
+    label: "token_exchange mounts audience and subject_token_type as undefined",
+    server: {
+      ...BASE,
+      auth_type: "oauth2_token_exchange",
+      token_exchange_endpoint: "https://idp/x",
+      credentials: CREDS,
+    },
+    expected: {
+      ...EXPECTED_BASE,
+      audience: undefined,
+      auth_type: "oauth2_token_exchange",
+      credentials: { client_id: "cid", client_secret: "csec" },
+      subject_token_type: undefined,
+      token_exchange_endpoint: "https://idp/x",
+      token_exchange_profile: undefined,
+    },
+  },
+  {
+    label: "token_exchange entra_obo omits audience and subject_token_type as keys",
+    server: {
+      ...BASE,
+      auth_type: "oauth2_token_exchange",
+      token_exchange_profile: "entra_obo",
+      token_exchange_endpoint: "https://idp/x",
+      credentials: CREDS,
+    },
+    expected: {
+      ...EXPECTED_BASE,
+      auth_type: "oauth2_token_exchange",
+      credentials: { client_id: "cid", client_secret: "csec" },
+      token_exchange_endpoint: "https://idp/x",
+      token_exchange_profile: "entra_obo",
+    },
+  },
+  {
+    label: "id_jag sends its seven credential fields",
+    server: { ...BASE, auth_type: "oauth2_id_jag", credentials: CREDS },
+    expected: {
+      ...EXPECTED_BASE,
+      audience: undefined,
+      auth_type: "oauth2_id_jag",
+      credentials: {
+        client_assertion_signing_alg: "RS256",
+        client_id: "cid",
+        client_private_key: "-----KEY-----",
+        client_private_key_id: "kid",
+        client_secret: "csec",
+        id_jag_resource: "api://res",
+        id_jag_resource_token_endpoint: "https://idp/jag",
+      },
+      subject_token_type: undefined,
+      token_exchange_endpoint: undefined,
+    },
+  },
+  {
+    label: "aws_sigv4 sends its seven credential fields",
+    server: { ...BASE, auth_type: "aws_sigv4", credentials: CREDS },
+    expected: {
+      ...EXPECTED_BASE,
+      auth_type: "aws_sigv4",
+      credentials: {
+        aws_access_key_id: "AKIA",
+        aws_region_name: "us-east-1",
+        aws_role_name: "role",
+        aws_secret_access_key: "shh",
+        aws_service_name: "bedrock",
+        aws_session_name: "sess",
+        aws_session_token: "tok",
+      },
+    },
+  },
+  {
+    label: "true_passthrough sends only the passthrough app credentials",
+    server: { ...BASE, auth_type: "true_passthrough", credentials: CREDS },
+    expected: {
+      ...EXPECTED_BASE,
+      auth_type: "true_passthrough",
+      credentials: { client_id: "cid", client_secret: "csec" },
+    },
+  },
+  {
+    label: "oauth_delegate sends only the passthrough app credentials",
+    server: { ...BASE, auth_type: "oauth_delegate", credentials: CREDS },
+    expected: {
+      ...EXPECTED_BASE,
+      auth_type: "oauth_delegate",
+      credentials: { client_id: "cid", client_secret: "csec" },
+    },
+  },
+  {
+    label: "an Authorization entry survives in extra_headers without enabling passthrough",
+    server: { ...BASE, auth_type: "none", extra_headers: ["Authorization"] },
+    expected: { ...EXPECTED_BASE, extra_headers: ["Authorization"] },
+  },
+  {
+    label: "dcr_bridge stays true for a client-forwarded mode",
+    server: { ...BASE, auth_type: "true_passthrough", dcr_bridge: true },
+    expected: { ...EXPECTED_BASE, auth_type: "true_passthrough", dcr_bridge: true },
+  },
+  {
+    label: "an existing allowed_tools list enforces the allowlist and round-trips",
+    server: { ...BASE, allowed_tools: ["alpha"] },
+    expected: {
+      ...EXPECTED_BASE,
+      allowed_tools: ["alpha"],
+      mcp_info: { ...(EXPECTED_BASE.mcp_info as object), tool_allowlist_enforced: true },
+    },
+  },
+  {
+    label: "no allowed_tools key when the allowlist is not enforced",
+    server: { ...BASE, allowed_tools: [] },
+    expected: { ...EXPECTED_BASE },
+  },
+];
+
+const saveAndCapture = async (server: MCPServer): Promise<Record<string, unknown>> => {
+  vi.mocked(networking.updateMCPServer).mockResolvedValue(server as never);
+  render(
+    <MCPServerEdit
+      mcpServer={server}
+      accessToken="access-token"
+      userID="user-1"
+      onCancel={vi.fn()}
+      onSuccess={vi.fn()}
+      availableAccessGroups={[]}
+    />,
+  );
+  await act(async () => {
+    screen.getAllByRole("button", { name: "Save Changes" })[0].click();
+  });
+  await waitFor(() => {
+    expect(networking.updateMCPServer).toHaveBeenCalled();
+  });
+  const [, payload] = vi.mocked(networking.updateMCPServer).mock.calls[0];
+  return payload as Record<string, unknown>;
+};
+
+describe("mcp_server_edit save payload contract", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it.each(CASES.map((c) => [c.label, c] as const))("%s", async (_label, testCase) => {
+    const payload = await saveAndCapture(testCase.server);
+    expect(payload).toStrictEqual(testCase.expected);
+  });
+
+  it("never sends a server-owned field the form does not bind", async () => {
+    const payload = await saveAndCapture({
+      ...BASE,
+      status: "healthy",
+      last_health_check: "2024-01-02T00:00:00Z",
+      health_check_error: null,
+      teams: [{ team_id: "t1" }],
+      allowed_tools: ["a"],
+      has_user_credential: true,
+      approval_status: "approved",
+      submitted_by: "someone",
+      submitted_at: "2024-01-01T00:00:00Z",
+      reviewed_at: "2024-01-02T00:00:00Z",
+      review_notes: "looks fine",
+    } as MCPServer);
+
+    for (const leaked of [
+      "created_at",
+      "created_by",
+      "updated_at",
+      "updated_by",
+      "status",
+      "last_health_check",
+      "health_check_error",
+      "teams",
+      "has_user_credential",
+      "approval_status",
+      "submitted_by",
+      "submitted_at",
+      "reviewed_at",
+      "review_notes",
+    ]) {
+      expect(payload).not.toHaveProperty(leaked);
+    }
+  });
+});
diff --git a/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/mcp_server_edit.test.tsx b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/mcp_server_edit.test.tsx
index 4e85aa41cfc..14e26fa5393 100644
--- a/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/mcp_server_edit.test.tsx
+++ b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/mcp_server_edit.test.tsx
@@ -781,7 +781,7 @@ describe("MCPServerEdit (interactive OAuth)", () => {
   });
 
   // Note: The M2M flow hiding logic is tested via OAuthFormFields.test.tsx (isM2M prop directly),
-  // since Form.useWatch doesn't synchronously reflect initialValues in jsdom.
+  // since a mounted-values read doesn't synchronously reflect the seeded defaults in jsdom.
 
   it("pre-populates token_validation_json from existing server token_validation", async () => {
     const tokenValidation = { organization: "my-org", "team.id": "123" };
@@ -1003,7 +1003,7 @@ describe("MCPServerEdit (interactive OAuth)", () => {
       fireEvent.click(saveButtons[0]);
     });
 
-    // The Form.Item inline validator intercepts invalid JSON before handleSave runs,
+    // The field's inline validator intercepts invalid JSON before handleSave runs,
     // so the inline error message appears and updateMCPServer is never called.
     await waitFor(() => {
       expect(screen.getByText("Must be valid JSON")).toBeInTheDocument();
@@ -2190,7 +2190,7 @@ describe("MCPServerEdit (dcr_bridge toggle)", () => {
     });
     expect(getDcrToggle()).toHaveAttribute("aria-checked", "true");
 
-    // The Form.Item stays mounted across the two client-forwarded modes, so the live toggle value is
+    // The field stays mounted across the two client-forwarded modes, so the live toggle value is
     // preserved rather than forced false by the switch.
     await selectAntOption("Authentication", "OAuth Delegate (client-supplied upstream token)");
     await waitFor(() => {
diff --git a/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/mcp_server_edit.tsx b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/mcp_server_edit.tsx
index 5c3fe6d8cda..3892b9d37b7 100644
--- a/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/mcp_server_edit.tsx
+++ b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/mcp_server_edit.tsx
@@ -1,5 +1,6 @@
 import React, { useState, useEffect } from "react";
-import { Form, Select, Button as AntdButton, Tooltip, Input, InputNumber, Alert } from "antd";
+import { Select, Button as AntdButton, Tooltip, Input, InputNumber, Alert } from "antd";
+import { FormProvider, useForm } from "react-hook-form";
 import { InfoCircleOutlined } from "@ant-design/icons";
 import { Button } from "@/components/ui/button";
 import { Tabs, TabsContent, TabsList, TabsTrigger } from "@/components/ui/tabs";
@@ -11,7 +12,6 @@ import {
   isHeldOAuthTokenStale,
   preservedAdminCredentials,
   preservedDeclaredAppCredentials,
-  ADMIN_CONFIG_CREDENTIAL_KEYS,
   withoutMintedTokenCredentials,
   OAUTH_FLOW,
   MCP_OAUTH2_FLOW_M2M,
@@ -41,15 +41,27 @@ import IdJagFormFields from "./IdJagFormFields";
 import OAuthFormFields from "./OAuthFormFields";
 import MCPLogoSelector from "./MCPLogoSelector";
 import EnvVarsSection from "./EnvVarsSection";
-import {
-  validateMCPServerUrl,
-  validateMCPServerName,
-  normalizeEnvVars,
-  normalizeToolOverrideMap,
-  TOOL_DISPLAY_NAME_PATTERN,
-} from "./utils";
+import { validateMCPServerUrl, validateMCPServerName, normalizeToolOverrideMap } from "./utils";
+import { EditServerFormValues, buildEditServerPayload, editPayloadErrorMessage } from "./editServerPayload";
 import { toast } from "@/lib/toast";
 import { useMcpOAuthFlow } from "@/hooks/useMcpOAuthFlow";
+import {
+  MountedFormField,
+  MountedFormProvider,
+  projectMountedValues,
+  useMountRegistry,
+  type MountedFormValues,
+} from "@/components/common_components/MountedFormField";
+import { antdRequired, antdRules } from "@/components/common_components/antdFormRules";
+import {
+  allFieldsValue,
+  mountedPaths,
+  resetFields,
+  setFieldsValue,
+  singleBranchChange,
+  useMountedValues,
+} from "./mcpFormStore";
+import { numberControl, notOnlyWhitespace, parsesAsJsonObject, selectControl, textControl } from "./mcpFieldRules";
 import { getSecureItem, setSecureItem } from "@/utils/secureStorage";
 
 interface MCPServerEditProps {
@@ -62,15 +74,6 @@ interface MCPServerEditProps {
 }
 
 const AUTH_TYPES_REQUIRING_AUTH_VALUE = [AUTH_TYPE.API_KEY, AUTH_TYPE.BEARER_TOKEN, AUTH_TYPE.TOKEN, AUTH_TYPE.BASIC];
-const AUTH_TYPES_REQUIRING_CREDENTIALS = [
-  ...AUTH_TYPES_REQUIRING_AUTH_VALUE,
-  AUTH_TYPE.OAUTH2,
-  AUTH_TYPE.OAUTH2_TOKEN_EXCHANGE,
-  AUTH_TYPE.OAUTH2_ID_JAG,
-  AUTH_TYPE.AWS_SIGV4,
-  AUTH_TYPE.TRUE_PASSTHROUGH,
-  AUTH_TYPE.OAUTH_DELEGATE,
-];
 export const EDIT_OAUTH_UI_STATE_KEY = "litellm-mcp-oauth-edit-state";
 
 const MCPServerEdit: React.FC<MCPServerEditProps> = ({
@@ -81,174 +84,6 @@ const MCPServerEdit: React.FC<MCPServerEditProps> = ({
   onSuccess,
   availableAccessGroups,
 }) => {
-  const [form] = Form.useForm();
-  const [costConfig, setCostConfig] = useState<MCPServerCostInfo>({});
-  const [tools, setTools] = useState<any[]>([]);
-  const [isLoadingTools, setIsLoadingTools] = useState(false);
-  const [toolsError, setToolsError] = useState<string | null>(null);
-  const [searchValue, setSearchValue] = useState<string>("");
-  const [aliasManuallyEdited, setAliasManuallyEdited] = useState(false);
-  const [removeStoredApp, setRemoveStoredApp] = useState(false);
-  // Set when the upstream identity (url/endpoints) changed while a declared app is present, so the
-  // section warns that the saved app may not match the new upstream (the app is kept, not wiped).
-  const [appMayNotMatchUpstream, setAppMayNotMatchUpstream] = useState(false);
-  const [allowedTools, setAllowedTools] = useState<string[]>([]);
-  const [hasToolAllowlistInteraction, setHasToolAllowlistInteraction] = useState(false);
-  const [toolNameToDisplayName, setToolNameToDisplayName] = useState<Record<string, string>>({});
-  const [toolNameToDescription, setToolNameToDescription] = useState<Record<string, string>>({});
-  const [pendingRestoredValues, setPendingRestoredValues] = useState<Record<string, any> | null>(null);
-  const [logoUrl, setLogoUrl] = useState<string | undefined>(mcpServer.mcp_info?.logo_url || undefined);
-  const authType = Form.useWatch("auth_type", form) as string | undefined;
-  const transportType = Form.useWatch("transport", form) as string | undefined;
-  const isStdioTransport = transportType === "stdio";
-  const isOpenAPITransport = transportType === TRANSPORT.OPENAPI;
-  const isMCPTransport = !isStdioTransport && !isOpenAPITransport;
-  const shouldShowAuthValueField = authType ? AUTH_TYPES_REQUIRING_AUTH_VALUE.includes(authType) : false;
-  const isOAuthAuthType = authType === AUTH_TYPE.OAUTH2;
-  const isTokenExchangeAuthType = authType === AUTH_TYPE.OAUTH2_TOKEN_EXCHANGE;
-  const isIdJagAuthType = authType === AUTH_TYPE.OAUTH2_ID_JAG;
-  const isAwsSigV4AuthType = authType === AUTH_TYPE.AWS_SIGV4;
-  const oauthFlowTypeValue = Form.useWatch("oauth_flow_type", form) as string | undefined;
-  const isM2MFlow = isOAuthAuthType && oauthFlowTypeValue === OAUTH_FLOW.M2M;
-  // Watch reflects a live toggle when the delegate switch is mounted; fall back to
-  // the stored value otherwise (useWatch returns undefined for an unmounted field,
-  // the same trap the oauth_flow_type field originally hit).
-  const delegateAuthWatched = Form.useWatch("delegate_auth_to_upstream", form) as boolean | undefined;
-  const isDelegateAuth = delegateAuthWatched ?? Boolean(mcpServer.delegate_auth_to_upstream);
-
-  // Watch form fields that affect tool fetching
-  const currentUrl = Form.useWatch("url", form);
-  const currentSpecPath = Form.useWatch("spec_path", form);
-  const currentServerName = Form.useWatch("server_name", form);
-  const currentAuthType = Form.useWatch("auth_type", form);
-  const currentStaticHeaders = Form.useWatch("static_headers", form);
-  const currentCredentials = Form.useWatch("credentials", form);
-  const currentIssuer = Form.useWatch("issuer", form);
-  const currentAuthorizationUrl = Form.useWatch("authorization_url", form);
-  const currentTokenUrl = Form.useWatch("token_url", form);
-  const currentRegistrationUrl = Form.useWatch("registration_url", form);
-  const hasExistingToolAllowlist =
-    Boolean(mcpServer.mcp_info?.tool_allowlist_enforced) || (mcpServer.allowed_tools?.length ?? 0) > 0;
-  const existingAllowedTools = hasExistingToolAllowlist ? mcpServer.allowed_tools ?? [] : null;
-
-  const persistEditUiState = () => {
-    if (typeof window === "undefined") {
-      return;
-    }
-    try {
-      const values = form.getFieldsValue(true);
-      setSecureItem(
-        EDIT_OAUTH_UI_STATE_KEY,
-        JSON.stringify({
-          serverId: mcpServer.server_id,
-          formValues: values,
-          costConfig,
-          allowedTools,
-          hasToolAllowlistInteraction,
-          searchValue,
-          aliasManuallyEdited,
-        }),
-      );
-    } catch (err) {
-      console.warn("Failed to persist MCP edit state", err);
-    }
-  };
-
-  // The auth mode every decision must key off: the admin's in-flight form selection wins over the
-  // saved record, so authorizing, loading tools, and saving all agree with what the form shows. Paths
-  // that read only mcpServer.auth_type go stale the moment the admin switches modes in the form.
-  const getEffectiveAuthType = () => form.getFieldValue("auth_type") ?? mcpServer.auth_type;
-
-  // The OAuth authorization identity (see getOAuthAuthorizationIdentity) captured when a token is fetched
-  // in this edit session; undefined when none is held. If a mint-relevant field later diverges from it,
-  // the held token (hook response + sessionStorage) is discarded so the admin must re-authorize.
-  const authorizedIdentityRef = React.useRef<string | undefined>(undefined);
-
-  const {
-    startOAuthFlow,
-    status: oauthStatus,
-    error: oauthError,
-    tokenResponse: oauthTokenResponse,
-    reset: resetOAuthFlow,
-  } = useMcpOAuthFlow({
-    accessToken,
-    getCredentials: () => form.getFieldValue("credentials"),
-    getTemporaryPayload: () => {
-      const values = form.getFieldsValue(true);
-      const url = values.url || mcpServer.url;
-      const transport = values.transport || mcpServer.transport;
-      if (!url || !transport) {
-        return null;
-      }
-      const staticHeaders = Array.isArray(values.static_headers)
-        ? values.static_headers.reduce((acc: Record<string, string>, entry: Record<string, string>) => {
-            const header = entry?.header?.trim();
-            if (!header) {
-              return acc;
-            }
-            acc[header] = (entry?.value ?? "").trim();
-            return acc;
-          }, {})
-        : ({} as Record<string, string>);
-
-      return {
-        server_id: mcpServer.server_id,
-        server_name: values.server_name || mcpServer.server_name || mcpServer.alias,
-        alias: values.alias || mcpServer.alias,
-        description: values.description || mcpServer.description,
-        url,
-        transport,
-        auth_type: isClientForwardedTokenMode(values.auth_type) ? values.auth_type : AUTH_TYPE.OAUTH2,
-        credentials: isClientForwardedTokenMode(values.auth_type)
-          ? preservedAdminCredentials(values.credentials)
-          : values.credentials,
-        mcp_access_groups: values.mcp_access_groups || mcpServer.mcp_access_groups,
-        static_headers: staticHeaders,
-        command: values.command,
-        args: values.args,
-        env: values.env,
-      };
-    },
-    onTokenReceived: (token) => {
-      if (!token?.access_token) {
-        return;
-      }
-
-      authorizedIdentityRef.current = getOAuthAuthorizationIdentity(form.getFieldsValue(true));
-      if (isClientForwardedTokenMode(getEffectiveAuthType())) {
-        const browserHeldToken = {
-          access_token: token.access_token,
-          expires_in: token.expires_in,
-          token_type: token.token_type,
-        };
-        setToken(mcpServer.server_id, browserHeldToken, userID);
-        toast.success(
-          "Token held for this browser session. Tools can now be loaded and configured; the token is not saved to LiteLLM.",
-        );
-        return;
-      }
-
-      const current = (form.getFieldValue("credentials") as Record<string, unknown> | undefined) ?? {};
-      const nextCredentials = {
-        ...(preservedAdminCredentials(current) ?? {}),
-        ...(current.scopes !== undefined && { scopes: current.scopes }),
-        access_token: token.access_token,
-        ...(token.refresh_token && { refresh_token: token.refresh_token }),
-        ...(token.expires_in && { expires_in: token.expires_in }),
-        ...(token.scope && { scope: token.scope }),
-      };
-      // Path-replace (not deep-merge) so a re-authorize with fewer token fields does not leave stale
-      // siblings behind; the admin-typed client keys and scopes are carried explicitly above.
-      form.setFieldValue("credentials", nextCredentials);
-      // Re-capture after writing credentials so the token is not invalidated by its own credential write.
-      authorizedIdentityRef.current = getOAuthAuthorizationIdentity(form.getFieldsValue(true));
-
-      toast.success("OAuth authorization successful! Please click 'Update MCP Server' to save the credentials.");
-    },
-    onBeforeRedirect: persistEditUiState,
-    flowSource: "edit",
-  });
-
   const initialStaticHeaders = React.useMemo(() => {
     if (!mcpServer.static_headers) {
       return [];
@@ -307,6 +142,176 @@ const MCPServerEdit: React.FC<MCPServerEditProps> = ({
     [mcpServer, effectiveTransport, initialStaticHeaders, initialEnvVars, initialEnvJson],
   );
 
+  const form = useForm<MountedFormValues>({ mode: "onChange", defaultValues: initialValues });
+  const registry = useMountRegistry();
+  const mountedValues = useMountedValues(form, registry);
+  const [costConfig, setCostConfig] = useState<MCPServerCostInfo>({});
+  const [tools, setTools] = useState<any[]>([]);
+  const [isLoadingTools, setIsLoadingTools] = useState(false);
+  const [toolsError, setToolsError] = useState<string | null>(null);
+  const [searchValue, setSearchValue] = useState<string>("");
+  const [aliasManuallyEdited, setAliasManuallyEdited] = useState(false);
+  const [removeStoredApp, setRemoveStoredApp] = useState(false);
+  // Set when the upstream identity (url/endpoints) changed while a declared app is present, so the
+  // section warns that the saved app may not match the new upstream (the app is kept, not wiped).
+  const [appMayNotMatchUpstream, setAppMayNotMatchUpstream] = useState(false);
+  const [allowedTools, setAllowedTools] = useState<string[]>([]);
+  const [hasToolAllowlistInteraction, setHasToolAllowlistInteraction] = useState(false);
+  const [toolNameToDisplayName, setToolNameToDisplayName] = useState<Record<string, string>>({});
+  const [toolNameToDescription, setToolNameToDescription] = useState<Record<string, string>>({});
+  const [pendingRestoredValues, setPendingRestoredValues] = useState<Record<string, any> | null>(null);
+  const [logoUrl, setLogoUrl] = useState<string | undefined>(mcpServer.mcp_info?.logo_url || undefined);
+  const authType = mountedValues.auth_type as string | undefined;
+  const transportType = mountedValues.transport as string | undefined;
+  const isStdioTransport = transportType === "stdio";
+  const isOpenAPITransport = transportType === TRANSPORT.OPENAPI;
+  const isMCPTransport = !isStdioTransport && !isOpenAPITransport;
+  const shouldShowAuthValueField = authType ? AUTH_TYPES_REQUIRING_AUTH_VALUE.includes(authType) : false;
+  const isOAuthAuthType = authType === AUTH_TYPE.OAUTH2;
+  const isTokenExchangeAuthType = authType === AUTH_TYPE.OAUTH2_TOKEN_EXCHANGE;
+  const isIdJagAuthType = authType === AUTH_TYPE.OAUTH2_ID_JAG;
+  const isAwsSigV4AuthType = authType === AUTH_TYPE.AWS_SIGV4;
+  const oauthFlowTypeValue = mountedValues.oauth_flow_type as string | undefined;
+  const isM2MFlow = isOAuthAuthType && oauthFlowTypeValue === OAUTH_FLOW.M2M;
+  // Watch reflects a live toggle when the delegate switch is mounted; fall back to
+  // the stored value otherwise (useWatch returns undefined for an unmounted field,
+  // the same trap the oauth_flow_type field originally hit).
+  const delegateAuthWatched = mountedValues.delegate_auth_to_upstream as boolean | undefined;
+  const isDelegateAuth = delegateAuthWatched ?? Boolean(mcpServer.delegate_auth_to_upstream);
+
+  // Watch form fields that affect tool fetching
+  const currentUrl = mountedValues.url;
+  const currentSpecPath = mountedValues.spec_path;
+  const currentServerName = mountedValues.server_name;
+  const currentAuthType = mountedValues.auth_type;
+  const currentStaticHeaders = mountedValues.static_headers;
+  const currentCredentials = mountedValues.credentials;
+  const currentIssuer = mountedValues.issuer;
+  const currentAuthorizationUrl = mountedValues.authorization_url;
+  const currentTokenUrl = mountedValues.token_url;
+  const currentRegistrationUrl = mountedValues.registration_url;
+  const hasExistingToolAllowlist =
+    Boolean(mcpServer.mcp_info?.tool_allowlist_enforced) || (mcpServer.allowed_tools?.length ?? 0) > 0;
+  const existingAllowedTools = hasExistingToolAllowlist ? mcpServer.allowed_tools ?? [] : null;
+
+  const persistEditUiState = () => {
+    if (typeof window === "undefined") {
+      return;
+    }
+    try {
+      const values = allFieldsValue(form);
+      setSecureItem(
+        EDIT_OAUTH_UI_STATE_KEY,
+        JSON.stringify({
+          serverId: mcpServer.server_id,
+          formValues: values,
+          costConfig,
+          allowedTools,
+          hasToolAllowlistInteraction,
+          searchValue,
+          aliasManuallyEdited,
+        }),
+      );
+    } catch (err) {
+      console.warn("Failed to persist MCP edit state", err);
+    }
+  };
+
+  // The auth mode every decision must key off: the admin's in-flight form selection wins over the
+  // saved record, so authorizing, loading tools, and saving all agree with what the form shows. Paths
+  // that read only mcpServer.auth_type go stale the moment the admin switches modes in the form.
+  const getEffectiveAuthType = () => allFieldsValue(form).auth_type ?? mcpServer.auth_type;
+
+  // The OAuth authorization identity (see getOAuthAuthorizationIdentity) captured when a token is fetched
+  // in this edit session; undefined when none is held. If a mint-relevant field later diverges from it,
+  // the held token (hook response + sessionStorage) is discarded so the admin must re-authorize.
+  const authorizedIdentityRef = React.useRef<string | undefined>(undefined);
+
+  const {
+    startOAuthFlow,
+    status: oauthStatus,
+    error: oauthError,
+    tokenResponse: oauthTokenResponse,
+    reset: resetOAuthFlow,
+  } = useMcpOAuthFlow({
+    accessToken,
+    getCredentials: () => allFieldsValue(form).credentials,
+    getTemporaryPayload: () => {
+      const values = allFieldsValue(form);
+      const url = values.url || mcpServer.url;
+      const transport = values.transport || mcpServer.transport;
+      if (!url || !transport) {
+        return null;
+      }
+      const staticHeaders = Array.isArray(values.static_headers)
+        ? values.static_headers.reduce((acc: Record<string, string>, entry: Record<string, string>) => {
+            const header = entry?.header?.trim();
+            if (!header) {
+              return acc;
+            }
+            acc[header] = (entry?.value ?? "").trim();
+            return acc;
+          }, {})
+        : ({} as Record<string, string>);
+
+      return {
+        server_id: mcpServer.server_id,
+        server_name: values.server_name || mcpServer.server_name || mcpServer.alias,
+        alias: values.alias || mcpServer.alias,
+        description: values.description || mcpServer.description,
+        url,
+        transport,
+        auth_type: isClientForwardedTokenMode(values.auth_type) ? values.auth_type : AUTH_TYPE.OAUTH2,
+        credentials: isClientForwardedTokenMode(values.auth_type)
+          ? preservedAdminCredentials(values.credentials)
+          : values.credentials,
+        mcp_access_groups: values.mcp_access_groups || mcpServer.mcp_access_groups,
+        static_headers: staticHeaders,
+        command: values.command,
+        args: values.args,
+        env: values.env,
+      };
+    },
+    onTokenReceived: (token) => {
+      if (!token?.access_token) {
+        return;
+      }
+
+      authorizedIdentityRef.current = getOAuthAuthorizationIdentity(allFieldsValue(form));
+      if (isClientForwardedTokenMode(getEffectiveAuthType())) {
+        const browserHeldToken = {
+          access_token: token.access_token,
+          expires_in: token.expires_in,
+          token_type: token.token_type,
+        };
+        setToken(mcpServer.server_id, browserHeldToken, userID);
+        toast.success(
+          "Token held for this browser session. Tools can now be loaded and configured; the token is not saved to LiteLLM.",
+        );
+        return;
+      }
+
+      const current = (allFieldsValue(form).credentials as Record<string, unknown> | undefined) ?? {};
+      const nextCredentials = {
+        ...(preservedAdminCredentials(current) ?? {}),
+        ...(current.scopes !== undefined && { scopes: current.scopes }),
+        access_token: token.access_token,
+        ...(token.refresh_token && { refresh_token: token.refresh_token }),
+        ...(token.expires_in && { expires_in: token.expires_in }),
+        ...(token.scope && { scope: token.scope }),
+      };
+      // Path-replace (not deep-merge) so a re-authorize with fewer token fields does not leave stale
+      // siblings behind; the admin-typed client keys and scopes are carried explicitly above.
+      form.setValue("credentials", nextCredentials);
+      // Re-capture after writing credentials so the token is not invalidated by its own credential write.
+      authorizedIdentityRef.current = getOAuthAuthorizationIdentity(allFieldsValue(form));
+
+      toast.success("OAuth authorization successful! Please click 'Update MCP Server' to save the credentials.");
+    },
+    onBeforeRedirect: persistEditUiState,
+    flowSource: "edit",
+  });
+
   // antd applies `initialValues` only at first mount. When the server loads after
   // mount (e.g. returning from the OAuth redirect lands on Overview and the form
   // mounts before the server data is ready), the form would stay blank. Re-sync it
@@ -318,7 +323,7 @@ const MCPServerEdit: React.FC<MCPServerEditProps> = ({
       return;
     }
     syncedServerIdRef.current = mcpServer.server_id;
-    form.setFieldsValue(initialValues);
+    setFieldsValue(form, initialValues);
     // Reset per-server OAuth UI state so it never carries across a server switch without an unmount: a
     // stale removeStoredApp would send an explicit-null credential write that deletes the new server's
     // stored app, and a stale warning would show on a server whose upstream did not change.
@@ -409,11 +414,11 @@ const MCPServerEdit: React.FC<MCPServerEditProps> = ({
     // on the re-run triggered by the transportType watch (without it the effect's
     // deps never change and the second pass never runs, leaving fields blank).
     const transport = pendingRestoredValues.transport || mcpServer.transport;
-    if (transport && transport !== form.getFieldValue("transport")) {
-      form.setFieldsValue({ transport });
+    if (transport && transport !== allFieldsValue(form).transport) {
+      setFieldsValue(form, { transport });
       return;
     }
-    form.setFieldsValue(pendingRestoredValues);
+    setFieldsValue(form, pendingRestoredValues);
     setPendingRestoredValues(null);
   }, [pendingRestoredValues, form, mcpServer.transport, transportType]);
 
@@ -422,7 +427,7 @@ const MCPServerEdit: React.FC<MCPServerEditProps> = ({
     if (mcpServer.mcp_access_groups) {
       // If access groups are objects, extract the name property; if strings, use as is
       const groupNames = mcpServer.mcp_access_groups.map((g: any) => (typeof g === "string" ? g : g.name || String(g)));
-      form.setFieldValue("mcp_access_groups", groupNames);
+      form.setValue("mcp_access_groups", groupNames);
     }
   }, [mcpServer]);
 
@@ -454,16 +459,16 @@ const MCPServerEdit: React.FC<MCPServerEditProps> = ({
     resetOAuthFlow();
     // The admin-typed app is upstream-scoped config, not minted material, so it survives every
     // invalidation; only the held token is discarded. Token-shaped keys are excluded by the filter.
-    const keptAdminCredentials = preservedAdminCredentials(form.getFieldValue("credentials"));
-    form.resetFields([...CLEARED_ON_INVALIDATION]);
+    const keptAdminCredentials = preservedAdminCredentials(allFieldsValue(form).credentials);
+    resetFields(form, [...CLEARED_ON_INVALIDATION], initialValues as MountedFormValues);
     if (keptAdminCredentials) {
-      form.setFieldsValue({ credentials: keptAdminCredentials });
+      setFieldsValue(form, { credentials: keptAdminCredentials });
     }
     const preserved = Object.fromEntries(
       CLEARED_ON_INVALIDATION.filter((key) => key in changedValues).map((key) => [key, changedValues[key]]),
     );
     if (Object.keys(preserved).length > 0) {
-      form.setFieldsValue(preserved);
+      setFieldsValue(form, preserved);
     }
   };
 
@@ -478,12 +483,12 @@ const MCPServerEdit: React.FC<MCPServerEditProps> = ({
       const upstreamChanged = ["url", "spec_path", "issuer", "authorization_url", "token_url", "registration_url"].some(
         (key) => key in changedValues,
       );
-      const hasDeclaredApp = preservedDeclaredAppCredentials(form.getFieldValue("credentials")) !== undefined;
+      const hasDeclaredApp = preservedDeclaredAppCredentials(allFieldsValue(form).credentials) !== undefined;
       if (upstreamChanged && hasDeclaredApp) {
         setAppMayNotMatchUpstream(true);
       }
     }
-    if (isHeldOAuthTokenStale(form.getFieldsValue(true), authorizedIdentityRef.current)) {
+    if (isHeldOAuthTokenStale(allFieldsValue(form), authorizedIdentityRef.current)) {
       clearHeldOAuthToken(changedValues);
     }
   };
@@ -507,7 +512,7 @@ const MCPServerEdit: React.FC<MCPServerEditProps> = ({
     setIsLoadingTools(true);
     setToolsError(null);
     try {
-      const values = form.getFieldsValue(true);
+      const values = allFieldsValue(form);
       const rawTransport = values.transport || mcpServer.transport;
       // oauth2_flow must be explicit: the preview endpoint infers client_credentials from the
       // inherited client_id/client_secret/token_url (common once DCR or discovery filled them) and
@@ -646,7 +651,7 @@ const MCPServerEdit: React.FC<MCPServerEditProps> = ({
         token_url: undefined,
         registration_url: undefined,
       };
-      form.setFieldsValue(clearedForStdio);
+      setFieldsValue(form, clearedForStdio);
     } else if (value === TRANSPORT.OPENAPI) {
       const clearedForOpenapi = {
         url: undefined,
@@ -655,9 +660,9 @@ const MCPServerEdit: React.FC<MCPServerEditProps> = ({
         env_json: undefined,
         stdio_config: undefined,
       };
-      form.setFieldsValue(clearedForOpenapi);
+      setFieldsValue(form, clearedForOpenapi);
     } else {
-      form.setFieldsValue({
+      setFieldsValue(form, {
         spec_path: undefined,
         command: undefined,
         args: undefined,
@@ -665,289 +670,51 @@ const MCPServerEdit: React.FC<MCPServerEditProps> = ({
         stdio_config: undefined,
       });
     }
-    if (isHeldOAuthTokenStale(form.getFieldsValue(true), authorizedIdentityRef.current)) {
+    if (isHeldOAuthTokenStale(allFieldsValue(form), authorizedIdentityRef.current)) {
       clearHeldOAuthToken();
     }
   };
 
-  const handleSave = async (values: Record<string, any>) => {
-    if (!accessToken) return;
-    const invalidDisplayName = Object.entries(toolNameToDisplayName).find(
-      ([, displayName]) => displayName && !TOOL_DISPLAY_NAME_PATTERN.test(displayName),
-    );
-    if (invalidDisplayName) {
-      toast.fromError(
-        `Tool display name "${invalidDisplayName[1]}" is invalid. Only letters, digits, underscores, and hyphens are allowed (no spaces).`,
-      );
+  const valuesChangeRef = React.useRef(handleFormValuesChange);
+  valuesChangeRef.current = handleFormValuesChange;
+
+  React.useEffect(() => {
+    const subscription = form.watch((values, { name, type }) => {
+      if (type !== "change" || name === undefined) {
+        return;
+      }
+      valuesChangeRef.current(singleBranchChange(name, values as MountedFormValues));
+    });
+    return () => subscription.unsubscribe();
+  }, [form]);
+
+  const submitForm = async () => {
+    const isValid = await form.trigger(mountedPaths(registry) as string[]);
+    if (!isValid) {
       return;
     }
+    await handleSave(projectMountedValues(registry, form.getValues) as unknown as EditServerFormValues);
+  };
+
+  const handleSave = async (values: EditServerFormValues) => {
+    if (!accessToken) return;
     try {
-      // Ensure access groups is always a string array
-      const {
-        static_headers: staticHeadersList,
-        env_vars: envVarsList,
-        credentials: credentialValues,
-        stdio_config: rawStdioConfig,
-        env_json: rawEnvJson,
-        command: rawCommand,
-        args: rawArgs,
-        allow_all_keys: allowAllKeysRaw,
-        available_on_public_internet: availableOnPublicInternetRaw,
-        delegate_auth_to_upstream: delegateAuthToUpstreamRaw,
-        oauth_passthrough: oauthPassthroughRaw,
-        dcr_bridge: dcrBridgeRaw,
-        token_validation_json: rawTokenValidationJson,
-        ...restValues
-      } = values;
-
-      const accessGroups = (restValues.mcp_access_groups || []).map((g: any) =>
-        typeof g === "string" ? g : g.name || String(g),
-      );
-
-      const staticHeaders = Array.isArray(staticHeadersList)
-        ? staticHeadersList.reduce((acc: Record<string, string>, entry: Record<string, string>) => {
-            const header = entry?.header?.trim();
-            if (!header) {
-              return acc;
-            }
-            acc[header] = (entry?.value ?? "").trim();
-            return acc;
-          }, {})
-        : ({} as Record<string, string>);
-
-      const envVars = normalizeEnvVars(envVarsList);
-
-      const credentialsPayload =
-        credentialValues && typeof credentialValues === "object"
-          ? Object.entries(credentialValues).reduce((acc: Record<string, any>, [key, value]) => {
-              if (value === undefined || value === null || value === "") {
-                if (value === "" && (ADMIN_CONFIG_CREDENTIAL_KEYS as readonly string[]).includes(key)) {
-                  acc[key] = null;
-                }
-                return acc;
-              }
-              if (key === "scopes") {
-                if (Array.isArray(value)) {
-                  const filteredScopes = value.filter((scope) => scope != null && scope !== "");
-                  if (filteredScopes.length > 0) {
-                    acc[key] = filteredScopes;
-                  }
-                }
-              } else {
-                acc[key] = value;
-              }
-              return acc;
-            }, {})
-          : undefined;
-
-      let stdioFields: Record<string, any> = {};
-
-      if (restValues.transport === "stdio") {
-        // Prefer JSON config if provided (matches Create screen behavior)
-        if (rawStdioConfig) {
-          try {
-            const stdioConfig = JSON.parse(rawStdioConfig);
-
-            let actualConfig = stdioConfig;
-            if (stdioConfig?.mcpServers && typeof stdioConfig.mcpServers === "object") {
-              const serverNames = Object.keys(stdioConfig.mcpServers);
-              if (serverNames.length > 0) {
-                actualConfig = stdioConfig.mcpServers[serverNames[0]];
-              }
-            }
-
-            const parsedArgs = Array.isArray(actualConfig?.args)
-              ? actualConfig.args.map((v: any) => String(v)).filter((v: string) => v.trim() !== "")
-              : [];
-
-            const parsedEnv =
-              actualConfig?.env && typeof actualConfig.env === "object" && !Array.isArray(actualConfig.env)
-                ? Object.entries(actualConfig.env).reduce((acc: Record<string, string>, [k, v]) => {
-                    if (k == null || String(k).trim() === "") return acc;
-                    acc[String(k)] = v == null ? "" : String(v);
-                    return acc;
-                  }, {})
-                : {};
-
-            stdioFields = {
-              command: actualConfig?.command ? String(actualConfig.command) : undefined,
-              args: parsedArgs,
-              env: parsedEnv,
-            };
-
-            if (!stdioFields.command) {
-              toast.fromError("Stdio configuration must include a command");
-              return;
-            }
-          } catch {
-            toast.fromError("Invalid JSON in stdio configuration");
-            return;
-          }
-        } else {
-          // Dedicated fields path (command/args + env JSON)
-          let parsedEnv: Record<string, string> = {};
-          if (rawEnvJson) {
-            try {
-              const env = JSON.parse(rawEnvJson);
-              if (env && typeof env === "object" && !Array.isArray(env)) {
-                parsedEnv = Object.entries(env).reduce((acc: Record<string, string>, [k, v]) => {
-                  if (k == null || String(k).trim() === "") return acc;
-                  acc[String(k)] = v == null ? "" : String(v);
-                  return acc;
-                }, {});
-              }
-            } catch {
-              toast.fromError("Invalid JSON in stdio env configuration");
-              return;
-            }
-          }
-          const parsedArgs = Array.isArray(rawArgs)
-            ? rawArgs.map((v: any) => String(v)).filter((v: string) => v.trim() !== "")
-            : [];
-
-          const parsedCommand = rawCommand ? String(rawCommand).trim() : "";
-          if (!parsedCommand) {
-            toast.fromError("Stdio transport requires a command");
-            return;
-          }
-
-          stdioFields = {
-            command: parsedCommand,
-            args: parsedArgs,
-            env: parsedEnv,
-          };
-        }
-      }
-
-      // Map "openapi" transport to "http" for the backend
-      if (restValues.transport === TRANSPORT.OPENAPI) {
-        restValues.transport = "http";
-      }
-
-      // Parse token_validation JSON if provided
-      let tokenValidation: Record<string, any> | null = null;
-      if (rawTokenValidationJson && rawTokenValidationJson.trim() !== "") {
-        try {
-          tokenValidation = JSON.parse(rawTokenValidationJson);
-        } catch {
-          toast.fromError("Invalid JSON in Token Validation Rules");
-          return;
-        }
-      }
-
-      // Prepare the payload with cost configuration and permission fields
-      const mcpInfoServerName =
-        restValues.server_name ||
-        restValues.url ||
-        mcpServer.server_name ||
-        mcpServer.url ||
-        restValues.alias ||
-        mcpServer.alias ||
-        "unknown";
-
-      const toolAllowlistEnforced = hasExistingToolAllowlist || hasToolAllowlistInteraction || allowedTools.length > 0;
-
-      const payload: Record<string, any> = {
-        ...restValues,
-        ...stdioFields,
-        // Remove UI-only fields
-        stdio_config: undefined,
-        env_json: undefined,
-        ...(mcpServer.auth_type === AUTH_TYPE.OAUTH2 && restValues.auth_type !== AUTH_TYPE.OAUTH2
-          ? { issuer: null, authorization_url: null, token_url: null, registration_url: null }
-          : {}),
-        ...(mcpServer.auth_type === AUTH_TYPE.OAUTH2_TOKEN_EXCHANGE &&
-        restValues.auth_type !== AUTH_TYPE.OAUTH2_TOKEN_EXCHANGE
-          ? { token_exchange_endpoint: null, audience: null, subject_token_type: null, token_exchange_profile: null }
-          : {}),
-        server_id: mcpServer.server_id,
-        mcp_info: {
-          ...(mcpServer.mcp_info ?? {}),
-          server_name: mcpInfoServerName,
-          description: restValues.description,
-          logo_url: logoUrl || undefined,
-          mcp_server_cost_info: Object.keys(costConfig).length > 0 ? costConfig : null,
-          tool_allowlist_enforced: toolAllowlistEnforced,
-        },
-        mcp_access_groups: accessGroups,
-        alias: restValues.alias,
-        // Include permission management fields
-        extra_headers: restValues.extra_headers || [],
-        ...(toolAllowlistEnforced
-          ? {
-              allowed_tools: allowedTools,
-            }
-          : {}),
-        tool_name_to_display_name: Object.keys(toolNameToDisplayName).length > 0 ? toolNameToDisplayName : null,
-        tool_name_to_description: Object.keys(toolNameToDescription).length > 0 ? toolNameToDescription : null,
-        disallowed_tools: restValues.disallowed_tools || [],
-        static_headers: staticHeaders,
-        env_vars: envVars,
-        allow_all_keys: Boolean(allowAllKeysRaw ?? mcpServer.allow_all_keys),
-        available_on_public_internet: Boolean(availableOnPublicInternetRaw ?? mcpServer.available_on_public_internet),
-        // ``delegate_auth_to_upstream`` is only honored server-side for
-        // ``auth_type=oauth2`` (PKCE passthrough). The Form.Item is
-        // conditionally rendered so the value drops out of the form on
-        // auth_type change; force false for any other configuration to avoid
-        // persisting a stale ``true`` that would silently re-activate if the
-        // configuration is later switched back.
-        delegate_auth_to_upstream: (() => {
-          const isOauth2 = restValues.auth_type === AUTH_TYPE.OAUTH2;
-          return isOauth2 ? Boolean(delegateAuthToUpstreamRaw ?? mcpServer.delegate_auth_to_upstream) : false;
-        })(),
-        // ``oauth_passthrough`` is the dedicated, non-oauth2 opt-in. It is only
-        // honored for ``auth_type=none`` servers that forward ``Authorization``
-        // upstream. Kept separate from ``delegate_auth_to_upstream`` so enabling
-        // pass-through never regresses oauth2 servers. Force false otherwise.
-        oauth_passthrough: (() => {
-          const isNoneAuth = restValues.auth_type === AUTH_TYPE.NONE || restValues.auth_type == null;
-          const extraHeaders = Array.isArray(restValues.extra_headers) ? restValues.extra_headers : [];
-          const hasAuthorizationHeader = extraHeaders.some(
-            (h: unknown) => typeof h === "string" && h.toLowerCase() === "authorization",
-          );
-          return isNoneAuth && hasAuthorizationHeader
-            ? Boolean(oauthPassthroughRaw ?? mcpServer.oauth_passthrough)
-            : false;
-        })(),
-        // ``dcr_bridge`` is only meaningful for the client-forwarded token
-        // modes (true_passthrough / oauth_delegate). The Form.Item is
-        // conditionally rendered so the value drops out of the form on
-        // auth_type change; force false for any other configuration to avoid
-        // persisting a stale ``true`` that would silently re-activate if the
-        // mode is later switched back.
-        dcr_bridge: isClientForwardedTokenMode(restValues.auth_type)
-          ? Boolean(dcrBridgeRaw ?? mcpServer.dcr_bridge)
-          : false,
-        ...(restValues.auth_type === AUTH_TYPE.OAUTH2 && restValues.oauth_flow_type
-          ? {
-              oauth2_flow:
-                restValues.oauth_flow_type === OAUTH_FLOW.M2M ? MCP_OAUTH2_FLOW_M2M : MCP_OAUTH2_FLOW_INTERACTIVE,
-            }
-          : {}),
-        // Include token_validation when it is set (non-null) or when clearing an existing value
-        ...(tokenValidation !== null || mcpServer.token_validation ? { token_validation: tokenValidation } : {}),
-      };
-
-      const includeCredentials =
-        restValues.auth_type && AUTH_TYPES_REQUIRING_CREDENTIALS.includes(restValues.auth_type);
-
-      // Client-forwarded rows persist ONLY the declared app; strip any token material lingering in the
-      // form (e.g. from a prior oauth2 authorize this session) so it can never reach the row.
-      const submitCredentials = isClientForwardedTokenMode(restValues.auth_type)
-        ? preservedAdminCredentials(credentialsPayload)
-        : credentialsPayload;
-
-      if (includeCredentials && submitCredentials && Object.keys(submitCredentials).length > 0) {
-        payload.credentials = submitCredentials;
-      }
-
-      // Explicit removal of a saved app for the client-forwarded modes, applied AFTER the filter so it
-      // always wins. Blank fields are the keep-existing convention (the backend merges partial
-      // credential updates), so removal must be an explicit-null write: encrypt skips nulls and the
-      // merge overrides the stored keys, returning the server to dynamic client registration.
-      if (removeStoredApp && isClientForwardedTokenMode(restValues.auth_type)) {
-        payload.credentials = { client_id: null, client_secret: null };
+      const built = buildEditServerPayload(values, {
+        mcpServer,
+        logoUrl,
+        costConfig,
+        allowedTools,
+        hasExistingToolAllowlist,
+        hasToolAllowlistInteraction,
+        toolNameToDisplayName,
+        toolNameToDescription,
+        removeStoredApp,
+      });
+      if (built.kind !== "ok") {
+        toast.fromError(editPayloadErrorMessage(built));
+        return;
       }
+      const payload = built.payload;
 
       const updated = await updateMCPServer(accessToken, payload);
 
@@ -957,9 +724,9 @@ const MCPServerEdit: React.FC<MCPServerEditProps> = ({
       // never in the server row. M2M/static auth resolve server-side and need neither.
       if (oauthTokenResponse?.access_token) {
         const oauthMode = getMcpOAuthMode({
-          auth_type: restValues.auth_type,
+          auth_type: values.auth_type,
           oauth2_flow: isM2MFlow ? MCP_OAUTH2_FLOW_M2M : null,
-          delegate_auth_to_upstream: Boolean(delegateAuthToUpstreamRaw ?? mcpServer.delegate_auth_to_upstream),
+          delegate_auth_to_upstream: Boolean(values.delegate_auth_to_upstream ?? mcpServer.delegate_auth_to_upstream),
         });
         try {
           if (oauthMode === "authorization_code") {
@@ -971,7 +738,7 @@ const MCPServerEdit: React.FC<MCPServerEditProps> = ({
               scopes: typeof scope === "string" && scope ? scope.split(" ") : undefined,
             };
             await storeMCPOAuthUserCredential(accessToken, mcpServer.server_id, oauthCredentialPayload);
-          } else if (oauthMode === "passthrough" || isClientForwardedTokenMode(restValues.auth_type)) {
+          } else if (oauthMode === "passthrough" || isClientForwardedTokenMode(values.auth_type)) {
             const browserHeldToken = {
               access_token: oauthTokenResponse.access_token,
               expires_in: oauthTokenResponse.expires_in,
@@ -1006,452 +773,510 @@ const MCPServerEdit: React.FC<MCPServerEditProps> = ({
       </TabsList>
       <div className="mt-6">
         <TabsContent value="server" keepMounted>
-          <Form
-            form={form}
-            onFinish={handleSave}
-            onValuesChange={handleFormValuesChange}
-            initialValues={initialValues}
-            layout="vertical"
-          >
-            <Form.Item
-              label="MCP Server Name"
-              name="server_name"
-              rules={[
-                {
-                  validator: (_, value) => validateMCPServerName(value),
-                },
-              ]}
-            >
-              <Input className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500" />
-            </Form.Item>
-            <Form.Item
-              label="Alias"
-              name="alias"
-              rules={[
-                {
-                  validator: (_, value) => validateMCPServerName(value),
-                },
-              ]}
-            >
-              <Input
-                onChange={() => setAliasManuallyEdited(true)}
-                className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500"
-              />
-            </Form.Item>
-            <Form.Item label="Description" name="description">
-              <Input className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500" />
-            </Form.Item>
-            <MCPLogoSelector value={logoUrl} onChange={setLogoUrl} />
-            <Form.Item label="Transport Type" name="transport" rules={[{ required: true }]}>
-              <Select onChange={handleTransportChange}>
-                <Select.Option value="http">Streamable HTTP (Recommended)</Select.Option>
-                <Select.Option value="sse">Server-Sent Events (SSE)</Select.Option>
-                <Select.Option value="stdio">Standard Input/Output (stdio)</Select.Option>
-                <Select.Option value={TRANSPORT.OPENAPI}>OpenAPI Spec</Select.Option>
-              </Select>
-            </Form.Item>
-
-            {/* URL field - only for HTTP/SSE */}
-            {isMCPTransport && (
-              <Form.Item
-                label="MCP Server URL"
-                name="url"
-                rules={[
-                  { required: true, message: "Please enter a server URL" },
-                  { validator: (_, value) => validateMCPServerUrl(value) },
-                ]}
-              >
-                <Input
-                  placeholder="https://your-mcp-server.com"
-                  className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500"
-                />
-              </Form.Item>
-            )}
-
-            {/* OpenAPI Spec URL - only for OpenAPI transport */}
-            {isOpenAPITransport && (
-              <Form.Item
-                label={
-                  <span className="text-sm font-medium text-gray-700 flex items-center">
-                    OpenAPI Spec URL
-                    <Tooltip title="URL to an OpenAPI specification (JSON or YAML). MCP tools will be automatically generated from the API endpoints defined in the spec.">
-                      <InfoCircleOutlined className="ml-2 text-blue-400 hover:text-blue-600 cursor-help" />
-                    </Tooltip>
-                  </span>
-                }
-                name="spec_path"
-                rules={[{ required: true, message: "Please enter an OpenAPI spec URL" }]}
-              >
-                <Input
-                  placeholder="https://petstore3.swagger.io/api/v3/openapi.json"
-                  className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500"
-                />
-              </Form.Item>
-            )}
-
-            <Form.Item
-              label={
-                <span className="text-sm font-medium text-gray-700 flex items-center">
-                  Max Concurrent Requests (optional)
-                  <Tooltip title="Maximum number of tool calls LiteLLM will run against this server at the same time. Additional calls wait for a free slot. Leave blank for no limit.">
-                    <InfoCircleOutlined className="ml-2 text-blue-400 hover:text-blue-600 cursor-help" />
-                  </Tooltip>
-                </span>
-              }
-              name="max_concurrent_requests"
-            >
-              <InputNumber
-                min={1}
-                precision={0}
-                placeholder="e.g. 10"
-                style={{ width: "100%" }}
-                className="rounded-lg"
-              />
-            </Form.Item>
-
-            {/* Authentication - for HTTP, SSE, and OpenAPI */}
-            {!isStdioTransport && (
-              <>
-                <Form.Item label="Authentication" name="auth_type" rules={[{ required: true }]}>
-                  <Select virtual={false}>
-                    <Select.Option value="none">None</Select.Option>
-                    <Select.Option value="api_key">API Key</Select.Option>
-                    <Select.Option value="bearer_token">Bearer Token</Select.Option>
-                    <Select.Option value="token">Token</Select.Option>
-                    <Select.Option value="basic">Basic Auth</Select.Option>
-                    <Select.Option value="oauth2">OAuth</Select.Option>
-                    <Select.Option value="oauth2_token_exchange">OAuth Token Exchange (OBO)</Select.Option>
-                    <Select.Option value="oauth2_id_jag">ID-JAG (Okta Cross App Access)</Select.Option>
-                    <Select.Option value="aws_sigv4">AWS SigV4 (Bedrock AgentCore MCPs)</Select.Option>
-                    <Select.Option value="true_passthrough">True Passthrough (no LiteLLM auth)</Select.Option>
-                    <Select.Option value="oauth_delegate">
-                      OAuth Delegate (client-supplied upstream token)
-                    </Select.Option>
-                  </Select>
-                </Form.Item>
-                <TruePassthroughWarning authType={authType} />
-                <PassthroughAuthorizeSection
-                  authType={authType}
-                  oauthFlow={{
-                    startOAuthFlow,
-                    status: oauthStatus,
-                    error: oauthError,
-                    tokenResponse: oauthTokenResponse,
-                  }}
-                  isEditing
-                  savedAuthType={mcpServer.auth_type}
-                  removeStoredApp={removeStoredApp}
-                  onRemoveStoredAppChange={setRemoveStoredApp}
-                  appMayNotMatchUpstream={appMayNotMatchUpstream}
-                />
-              </>
-            )}
-
-            {isStdioTransport && (
-              <div className="rounded-lg border border-gray-200 p-4 space-y-4">
-                <p className="text-sm text-gray-600">
-                  Configure the stdio transport used to launch the MCP server process. You can either fill in the fields
-                  below or paste a JSON configuration.
-                </p>
-
-                <Form.Item
-                  label="Command"
-                  name="command"
-                  rules={[{ required: true, message: "Please enter a command for stdio transport" }]}
-                >
-                  <Input
-                    placeholder="e.g., npx"
-                    className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500"
-                  />
-                </Form.Item>
-
-                <Form.Item label="Args" name="args">
-                  <Select
-                    mode="tags"
-                    size="large"
-                    tokenSeparators={[","]}
-                    placeholder="Add args (press enter or comma)"
-                    className="rounded-lg"
-                  />
-                </Form.Item>
-
-                <Form.Item
-                  label="Environment (JSON object)"
-                  name="env_json"
-                  rules={[
-                    {
-                      validator: (_, value) => {
-                        if (!value) return Promise.resolve();
-                        try {
-                          const parsed = JSON.parse(value);
-                          if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
-                            return Promise.resolve();
-                          }
-                          return Promise.reject(new Error("Env must be a JSON object"));
-                        } catch {
-                          return Promise.reject(new Error("Please enter valid JSON"));
-                        }
-                      },
-                    },
-                  ]}
-                >
-                  <Input.TextArea
-                    rows={6}
-                    className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500 font-mono text-sm"
-                    placeholder={`{\n  \"KEY\": \"value\"\n}`}
-                  />
-                </Form.Item>
-
-                {/* Optional JSON config (if provided, it overrides command/args/env on save) */}
-                <StdioConfiguration isVisible={true} required={false} />
-              </div>
-            )}
-
-            {!isStdioTransport && shouldShowAuthValueField && (
-              <Form.Item
-                label={
-                  <span className="text-sm font-medium text-gray-700 flex items-center">
-                    Authentication Value
-                    <Tooltip title="Token, password, or header value to send with each request for the selected auth type.">
-                      <InfoCircleOutlined className="ml-2 text-blue-400 hover:text-blue-600 cursor-help" />
-                    </Tooltip>
-                  </span>
-                }
-                name={["credentials", "auth_value"]}
-                rules={[
-                  {
-                    validator: (_, value) =>
-                      value && typeof value === "string" && value.trim() === ""
-                        ? Promise.reject(new Error("Authentication value cannot be empty"))
-                        : Promise.resolve(),
-                  },
-                ]}
-              >
-                <Input.Password
-                  placeholder="Enter token or secret (leave blank to keep existing)"
-                  className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500"
-                />
-              </Form.Item>
-            )}
-
-            {!isStdioTransport && isOAuthAuthType && (
-              <>
-                {!oauthFlowTypeValue && !isDelegateAuth && (
-                  <Alert
-                    type="warning"
-                    showIcon
-                    className="mb-4 rounded-lg"
-                    message="This server has no OAuth flow set"
-                    description="Choose Machine-to-Machine (M2M) or Interactive (PKCE) so LiteLLM authenticates it the way you intend, then save. Until it is set, LiteLLM falls back to interactive per-user auth and treats a machine-to-machine credential shape conservatively."
-                  />
-                )}
-                <OAuthFormFields
-                  isM2M={isM2MFlow}
-                  isEditing
-                  oauthFlow={{
-                    startOAuthFlow,
-                    status: oauthStatus,
-                    error: oauthError,
-                    tokenResponse: oauthTokenResponse,
-                  }}
-                />
-              </>
-            )}
-
-            {!isStdioTransport && isTokenExchangeAuthType && <TokenExchangeFormFields isEditing />}
-
-            {!isStdioTransport && isIdJagAuthType && <IdJagFormFields isEditing />}
-
-            {!isStdioTransport && isAwsSigV4AuthType && (
-              <>
-                <p className="text-sm text-gray-500 mb-2">
-                  For MCP servers hosted on AWS Bedrock AgentCore.{" "}
-                  <a
-                    href="https://docs.litellm.ai/docs/mcp_aws_sigv4"
-                    target="_blank"
-                    rel="noopener noreferrer"
-                    className="text-blue-500 hover:text-blue-700"
-                  >
-                    View docs &rarr;
-                  </a>
-                </p>
-                <Form.Item
-                  label={
-                    <span className="text-sm font-medium text-gray-700 flex items-center">
-                      AWS Region
-                      <Tooltip title="AWS region for SigV4 signing (e.g., us-east-1)">
-                        <InfoCircleOutlined className="ml-2 text-blue-400 hover:text-blue-600 cursor-help" />
-                      </Tooltip>
-                    </span>
-                  }
-                  name={["credentials", "aws_region_name"]}
-                  rules={[]}
-                >
-                  <Input
-                    placeholder="us-east-1 (leave blank to keep existing)"
-                    className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500"
-                  />
-                </Form.Item>
-                <Form.Item
-                  label={
-                    <span className="text-sm font-medium text-gray-700 flex items-center">
-                      AWS Service Name
-                      <Tooltip title="AWS service name for SigV4 signing. Defaults to 'bedrock-agentcore'.">
-                        <InfoCircleOutlined className="ml-2 text-blue-400 hover:text-blue-600 cursor-help" />
-                      </Tooltip>
-                    </span>
-                  }
-                  name={["credentials", "aws_service_name"]}
-                >
-                  <Input
-                    placeholder="bedrock-agentcore (leave blank to keep existing)"
-                    className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500"
-                  />
-                </Form.Item>
-                <Form.Item
-                  label={
-                    <span className="text-sm font-medium text-gray-700 flex items-center">
-                      AWS Access Key ID
-                      <Tooltip title="Optional. If not provided, falls back to the boto3 credential chain (IAM role, env vars, etc.).">
-                        <InfoCircleOutlined className="ml-2 text-blue-400 hover:text-blue-600 cursor-help" />
-                      </Tooltip>
-                    </span>
-                  }
-                  name={["credentials", "aws_access_key_id"]}
-                  rules={[]}
-                >
-                  <Input.Password
-                    placeholder="Leave blank to keep existing"
-                    className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500"
-                  />
-                </Form.Item>
-                <Form.Item
-                  label={
-                    <span className="text-sm font-medium text-gray-700 flex items-center">
-                      AWS Secret Access Key
-                      <Tooltip title="Optional. Required if AWS Access Key ID is provided.">
-                        <InfoCircleOutlined className="ml-2 text-blue-400 hover:text-blue-600 cursor-help" />
-                      </Tooltip>
-                    </span>
-                  }
-                  name={["credentials", "aws_secret_access_key"]}
-                  rules={[]}
-                >
-                  <Input.Password
-                    placeholder="Leave blank to keep existing"
-                    className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500"
-                  />
-                </Form.Item>
-                <Form.Item
-                  label={
-                    <span className="text-sm font-medium text-gray-700 flex items-center">
-                      AWS Session Token
-                      <Tooltip title="Optional. Only needed for temporary STS credentials.">
-                        <InfoCircleOutlined className="ml-2 text-blue-400 hover:text-blue-600 cursor-help" />
-                      </Tooltip>
-                    </span>
-                  }
-                  name={["credentials", "aws_session_token"]}
-                >
-                  <Input.Password
-                    placeholder="Leave blank to keep existing"
-                    className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500"
-                  />
-                </Form.Item>
-                <Form.Item
-                  label={
-                    <span className="text-sm font-medium text-gray-700 flex items-center">
-                      AWS Role ARN
-                      <Tooltip title="Optional. IAM role ARN to assume via STS before signing. If set, LiteLLM calls sts:AssumeRole to get temporary credentials.">
-                        <InfoCircleOutlined className="ml-2 text-blue-400 hover:text-blue-600 cursor-help" />
-                      </Tooltip>
-                    </span>
-                  }
-                  name={["credentials", "aws_role_name"]}
-                >
-                  <Input
-                    placeholder="Leave blank to keep existing"
-                    className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500"
-                  />
-                </Form.Item>
-                <Form.Item
-                  label={
-                    <span className="text-sm font-medium text-gray-700 flex items-center">
-                      AWS Session Name
-                      <Tooltip title="Optional. Session name for the AssumeRole call — appears in CloudTrail logs. Auto-generated if omitted.">
-                        <InfoCircleOutlined className="ml-2 text-blue-400 hover:text-blue-600 cursor-help" />
-                      </Tooltip>
-                    </span>
-                  }
-                  name={["credentials", "aws_session_name"]}
-                >
-                  <Input
-                    placeholder="Leave blank to keep existing"
-                    className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500"
-                  />
-                </Form.Item>
-              </>
-            )}
-
-            {/* Environment Variables Section */}
-            <div className="mt-6">
-              <EnvVarsSection />
-            </div>
-
-            {/* Permission Management / Access Control Section */}
-            <div className="mt-6">
-              <MCPPermissionManagement
-                availableAccessGroups={availableAccessGroups}
-                mcpServer={mcpServer}
-                searchValue={searchValue}
-                setSearchValue={setSearchValue}
-                getAccessGroupOptions={getAccessGroupOptions}
-              />
-            </div>
-
-            {/* Tool Configuration Section */}
-            <div className="mt-6">
-              <MCPToolConfiguration
-                accessToken={accessToken}
-                formValues={{
-                  server_id: mcpServer.server_id,
-                  server_name: currentServerName ?? mcpServer.server_name,
-                  url: currentUrl ?? mcpServer.url,
-                  spec_path: currentSpecPath ?? mcpServer.spec_path,
-                  transport: transportType ?? mcpServer.transport,
-                  auth_type: currentAuthType ?? mcpServer.auth_type,
-                  mcp_info: mcpServer.mcp_info,
-                  oauth_flow_type:
-                    oauthFlowTypeValue ?? oauth2FlowToFormValue(mcpServer.oauth2_flow) ?? OAUTH_FLOW.INTERACTIVE,
-                  static_headers: currentStaticHeaders ?? mcpServer.static_headers,
-                  credentials: currentCredentials,
-                  issuer: currentIssuer ?? mcpServer.issuer,
-                  authorization_url: currentAuthorizationUrl ?? mcpServer.authorization_url,
-                  token_url: currentTokenUrl ?? mcpServer.token_url,
-                  registration_url: currentRegistrationUrl ?? mcpServer.registration_url,
+          <FormProvider {...form}>
+            <MountedFormProvider value={{ control: form.control, registry }}>
+              <form
+                onSubmit={(event) => {
+                  event.preventDefault();
+                  void submitForm();
                 }}
-                allowedTools={allowedTools}
-                existingAllowedTools={existingAllowedTools}
-                hasToolAllowlistInteraction={hasToolAllowlistInteraction}
-                isEditMode
-                onAllowedToolsChange={setAllowedTools}
-                onToolAllowlistInteraction={() => setHasToolAllowlistInteraction(true)}
-                toolNameToDisplayName={toolNameToDisplayName}
-                toolNameToDescription={toolNameToDescription}
-                onToolNameToDisplayNameChange={setToolNameToDisplayName}
-                onToolNameToDescriptionChange={setToolNameToDescription}
-                externalTools={tools}
-                externalIsLoading={isLoadingTools}
-                externalError={toolsError}
-                externalCanFetch={true}
-              />
-            </div>
+              >
+                <MountedFormField
+                  label="MCP Server Name"
+                  name="server_name"
+                  rules={{ validate: antdRules({ validator: (_, value) => validateMCPServerName(value) }) }}
+                >
+                  {(control) => (
+                    <Input
+                      {...textControl(control)}
+                      className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500"
+                    />
+                  )}
+                </MountedFormField>
+                <MountedFormField
+                  label="Alias"
+                  name="alias"
+                  rules={{ validate: antdRules({ validator: (_, value) => validateMCPServerName(value) }) }}
+                >
+                  {(control) => (
+                    <Input
+                      {...textControl(control)}
+                      onChange={(event) => {
+                        control.onChange(event);
+                        setAliasManuallyEdited(true);
+                      }}
+                      className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500"
+                    />
+                  )}
+                </MountedFormField>
+                <MountedFormField label="Description" name="description">
+                  {(control) => (
+                    <Input
+                      {...textControl(control)}
+                      className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500"
+                    />
+                  )}
+                </MountedFormField>
+                <MCPLogoSelector value={logoUrl} onChange={setLogoUrl} />
+                <MountedFormField
+                  label="Transport Type"
+                  name="transport"
+                  required
+                  rules={{ validate: { required: antdRequired("Transport Type is required") } }}
+                >
+                  {(control) => (
+                    <Select
+                      {...selectControl<string>(control)}
+                      onChange={(value: string) => {
+                        control.onChange(value);
+                        handleTransportChange(value);
+                      }}
+                    >
+                      <Select.Option value="http">Streamable HTTP (Recommended)</Select.Option>
+                      <Select.Option value="sse">Server-Sent Events (SSE)</Select.Option>
+                      <Select.Option value="stdio">Standard Input/Output (stdio)</Select.Option>
+                      <Select.Option value={TRANSPORT.OPENAPI}>OpenAPI Spec</Select.Option>
+                    </Select>
+                  )}
+                </MountedFormField>
 
-            <div className="flex justify-end gap-2">
-              <AntdButton onClick={onCancel}>Cancel</AntdButton>
-              <Button type="submit">Save Changes</Button>
-            </div>
-          </Form>
+                {/* URL field - only for HTTP/SSE */}
+                {isMCPTransport && (
+                  <MountedFormField
+                    label="MCP Server URL"
+                    name="url"
+                    required
+                    rules={{
+                      validate: {
+                        required: antdRequired("Please enter a server URL"),
+                        ...antdRules({ validator: (_, value) => validateMCPServerUrl(value) }),
+                      },
+                    }}
+                  >
+                    {(control) => (
+                      <Input
+                        {...textControl(control)}
+                        placeholder="https://your-mcp-server.com"
+                        className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500"
+                      />
+                    )}
+                  </MountedFormField>
+                )}
+
+                {/* OpenAPI Spec URL - only for OpenAPI transport */}
+                {isOpenAPITransport && (
+                  <MountedFormField
+                    label={
+                      <span className="text-sm font-medium text-gray-700 flex items-center">
+                        OpenAPI Spec URL
+                        <Tooltip title="URL to an OpenAPI specification (JSON or YAML). MCP tools will be automatically generated from the API endpoints defined in the spec.">
+                          <InfoCircleOutlined className="ml-2 text-blue-400 hover:text-blue-600 cursor-help" />
+                        </Tooltip>
+                      </span>
+                    }
+                    name="spec_path"
+                    required
+                    rules={{ validate: { required: antdRequired("Please enter an OpenAPI spec URL") } }}
+                  >
+                    {(control) => (
+                      <Input
+                        {...textControl(control)}
+                        placeholder="https://petstore3.swagger.io/api/v3/openapi.json"
+                        className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500"
+                      />
+                    )}
+                  </MountedFormField>
+                )}
+
+                <MountedFormField
+                  label={
+                    <span className="text-sm font-medium text-gray-700 flex items-center">
+                      Max Concurrent Requests (optional)
+                      <Tooltip title="Maximum number of tool calls LiteLLM will run against this server at the same time. Additional calls wait for a free slot. Leave blank for no limit.">
+                        <InfoCircleOutlined className="ml-2 text-blue-400 hover:text-blue-600 cursor-help" />
+                      </Tooltip>
+                    </span>
+                  }
+                  name="max_concurrent_requests"
+                >
+                  {(control) => (
+                    <InputNumber
+                      {...numberControl(control)}
+                      min={1}
+                      precision={0}
+                      placeholder="e.g. 10"
+                      style={{ width: "100%" }}
+                      className="rounded-lg"
+                    />
+                  )}
+                </MountedFormField>
+
+                {/* Authentication - for HTTP, SSE, and OpenAPI */}
+                {!isStdioTransport && (
+                  <>
+                    <MountedFormField
+                      label="Authentication"
+                      name="auth_type"
+                      required
+                      rules={{ validate: { required: antdRequired("Authentication is required") } }}
+                    >
+                      {(control) => (
+                        <Select {...selectControl<string>(control)} virtual={false}>
+                          <Select.Option value="none">None</Select.Option>
+                          <Select.Option value="api_key">API Key</Select.Option>
+                          <Select.Option value="bearer_token">Bearer Token</Select.Option>
+                          <Select.Option value="token">Token</Select.Option>
+                          <Select.Option value="basic">Basic Auth</Select.Option>
+                          <Select.Option value="oauth2">OAuth</Select.Option>
+                          <Select.Option value="oauth2_token_exchange">OAuth Token Exchange (OBO)</Select.Option>
+                          <Select.Option value="oauth2_id_jag">ID-JAG (Okta Cross App Access)</Select.Option>
+                          <Select.Option value="aws_sigv4">AWS SigV4 (Bedrock AgentCore MCPs)</Select.Option>
+                          <Select.Option value="true_passthrough">True Passthrough (no LiteLLM auth)</Select.Option>
+                          <Select.Option value="oauth_delegate">
+                            OAuth Delegate (client-supplied upstream token)
+                          </Select.Option>
+                        </Select>
+                      )}
+                    </MountedFormField>
+                    <TruePassthroughWarning authType={authType} />
+                    <PassthroughAuthorizeSection
+                      authType={authType}
+                      oauthFlow={{
+                        startOAuthFlow,
+                        status: oauthStatus,
+                        error: oauthError,
+                        tokenResponse: oauthTokenResponse,
+                      }}
+                      isEditing
+                      savedAuthType={mcpServer.auth_type}
+                      removeStoredApp={removeStoredApp}
+                      onRemoveStoredAppChange={setRemoveStoredApp}
+                      appMayNotMatchUpstream={appMayNotMatchUpstream}
+                    />
+                  </>
+                )}
+
+                {isStdioTransport && (
+                  <div className="rounded-lg border border-gray-200 p-4 space-y-4">
+                    <p className="text-sm text-gray-600">
+                      Configure the stdio transport used to launch the MCP server process. You can either fill in the
+                      fields below or paste a JSON configuration.
+                    </p>
+
+                    <MountedFormField
+                      label="Command"
+                      name="command"
+                      required
+                      rules={{ validate: { required: antdRequired("Please enter a command for stdio transport") } }}
+                    >
+                      {(control) => (
+                        <Input
+                          {...textControl(control)}
+                          placeholder="e.g., npx"
+                          className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500"
+                        />
+                      )}
+                    </MountedFormField>
+
+                    <MountedFormField label="Args" name="args">
+                      {(control) => (
+                        <Select
+                          {...selectControl<string[]>(control)}
+                          mode="tags"
+                          size="large"
+                          tokenSeparators={[","]}
+                          placeholder="Add args (press enter or comma)"
+                          className="rounded-lg"
+                        />
+                      )}
+                    </MountedFormField>
+
+                    <MountedFormField
+                      label="Environment (JSON object)"
+                      name="env_json"
+                      rules={{
+                        validate: {
+                          jsonObject: parsesAsJsonObject("Please enter valid JSON", "Env must be a JSON object"),
+                        },
+                      }}
+                    >
+                      {(control) => (
+                        <Input.TextArea
+                          {...textControl(control)}
+                          rows={6}
+                          className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500 font-mono text-sm"
+                          placeholder={`{\n  \"KEY\": \"value\"\n}`}
+                        />
+                      )}
+                    </MountedFormField>
+
+                    {/* Optional JSON config (if provided, it overrides command/args/env on save) */}
+                    <StdioConfiguration isVisible={true} required={false} />
+                  </div>
+                )}
+
+                {!isStdioTransport && shouldShowAuthValueField && (
+                  <MountedFormField
+                    label={
+                      <span className="text-sm font-medium text-gray-700 flex items-center">
+                        Authentication Value
+                        <Tooltip title="Token, password, or header value to send with each request for the selected auth type.">
+                          <InfoCircleOutlined className="ml-2 text-blue-400 hover:text-blue-600 cursor-help" />
+                        </Tooltip>
+                      </span>
+                    }
+                    name={["credentials", "auth_value"]}
+                    rules={{ validate: { notWhitespace: notOnlyWhitespace("Authentication value cannot be empty") } }}
+                  >
+                    {(control) => (
+                      <Input.Password
+                        {...textControl(control)}
+                        placeholder="Enter token or secret (leave blank to keep existing)"
+                        className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500"
+                      />
+                    )}
+                  </MountedFormField>
+                )}
+
+                {!isStdioTransport && isOAuthAuthType && (
+                  <>
+                    {!oauthFlowTypeValue && !isDelegateAuth && (
+                      <Alert
+                        type="warning"
+                        showIcon
+                        className="mb-4 rounded-lg"
+                        message="This server has no OAuth flow set"
+                        description="Choose Machine-to-Machine (M2M) or Interactive (PKCE) so LiteLLM authenticates it the way you intend, then save. Until it is set, LiteLLM falls back to interactive per-user auth and treats a machine-to-machine credential shape conservatively."
+                      />
+                    )}
+                    <OAuthFormFields
+                      isM2M={isM2MFlow}
+                      isEditing
+                      oauthFlow={{
+                        startOAuthFlow,
+                        status: oauthStatus,
+                        error: oauthError,
+                        tokenResponse: oauthTokenResponse,
+                      }}
+                    />
+                  </>
+                )}
+
+                {!isStdioTransport && isTokenExchangeAuthType && <TokenExchangeFormFields isEditing />}
+
+                {!isStdioTransport && isIdJagAuthType && <IdJagFormFields isEditing />}
+
+                {!isStdioTransport && isAwsSigV4AuthType && (
+                  <>
+                    <p className="text-sm text-gray-500 mb-2">
+                      For MCP servers hosted on AWS Bedrock AgentCore.{" "}
+                      <a
+                        href="https://docs.litellm.ai/docs/mcp_aws_sigv4"
+                        target="_blank"
+                        rel="noopener noreferrer"
+                        className="text-blue-500 hover:text-blue-700"
+                      >
+                        View docs &rarr;
+                      </a>
+                    </p>
+                    <MountedFormField
+                      label={
+                        <span className="text-sm font-medium text-gray-700 flex items-center">
+                          AWS Region
+                          <Tooltip title="AWS region for SigV4 signing (e.g., us-east-1)">
+                            <InfoCircleOutlined className="ml-2 text-blue-400 hover:text-blue-600 cursor-help" />
+                          </Tooltip>
+                        </span>
+                      }
+                      name={["credentials", "aws_region_name"]}
+                    >
+                      {(control) => (
+                        <Input
+                          {...textControl(control)}
+                          placeholder="us-east-1 (leave blank to keep existing)"
+                          className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500"
+                        />
+                      )}
+                    </MountedFormField>
+                    <MountedFormField
+                      label={
+                        <span className="text-sm font-medium text-gray-700 flex items-center">
+                          AWS Service Name
+                          <Tooltip title="AWS service name for SigV4 signing. Defaults to 'bedrock-agentcore'.">
+                            <InfoCircleOutlined className="ml-2 text-blue-400 hover:text-blue-600 cursor-help" />
+                          </Tooltip>
+                        </span>
+                      }
+                      name={["credentials", "aws_service_name"]}
+                    >
+                      {(control) => (
+                        <Input
+                          {...textControl(control)}
+                          placeholder="bedrock-agentcore (leave blank to keep existing)"
+                          className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500"
+                        />
+                      )}
+                    </MountedFormField>
+                    <MountedFormField
+                      label={
+                        <span className="text-sm font-medium text-gray-700 flex items-center">
+                          AWS Access Key ID
+                          <Tooltip title="Optional. If not provided, falls back to the boto3 credential chain (IAM role, env vars, etc.).">
+                            <InfoCircleOutlined className="ml-2 text-blue-400 hover:text-blue-600 cursor-help" />
+                          </Tooltip>
+                        </span>
+                      }
+                      name={["credentials", "aws_access_key_id"]}
+                    >
+                      {(control) => (
+                        <Input.Password
+                          {...textControl(control)}
+                          placeholder="Leave blank to keep existing"
+                          className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500"
+                        />
+                      )}
+                    </MountedFormField>
+                    <MountedFormField
+                      label={
+                        <span className="text-sm font-medium text-gray-700 flex items-center">
+                          AWS Secret Access Key
+                          <Tooltip title="Optional. Required if AWS Access Key ID is provided.">
+                            <InfoCircleOutlined className="ml-2 text-blue-400 hover:text-blue-600 cursor-help" />
+                          </Tooltip>
+                        </span>
+                      }
+                      name={["credentials", "aws_secret_access_key"]}
+                    >
+                      {(control) => (
+                        <Input.Password
+                          {...textControl(control)}
+                          placeholder="Leave blank to keep existing"
+                          className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500"
+                        />
+                      )}
+                    </MountedFormField>
+                    <MountedFormField
+                      label={
+                        <span className="text-sm font-medium text-gray-700 flex items-center">
+                          AWS Session Token
+                          <Tooltip title="Optional. Only needed for temporary STS credentials.">
+                            <InfoCircleOutlined className="ml-2 text-blue-400 hover:text-blue-600 cursor-help" />
+                          </Tooltip>
+                        </span>
+                      }
+                      name={["credentials", "aws_session_token"]}
+                    >
+                      {(control) => (
+                        <Input.Password
+                          {...textControl(control)}
+                          placeholder="Leave blank to keep existing"
+                          className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500"
+                        />
+                      )}
+                    </MountedFormField>
+                    <MountedFormField
+                      label={
+                        <span className="text-sm font-medium text-gray-700 flex items-center">
+                          AWS Role ARN
+                          <Tooltip title="Optional. IAM role ARN to assume via STS before signing. If set, LiteLLM calls sts:AssumeRole to get temporary credentials.">
+                            <InfoCircleOutlined className="ml-2 text-blue-400 hover:text-blue-600 cursor-help" />
+                          </Tooltip>
+                        </span>
+                      }
+                      name={["credentials", "aws_role_name"]}
+                    >
+                      {(control) => (
+                        <Input
+                          {...textControl(control)}
+                          placeholder="Leave blank to keep existing"
+                          className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500"
+                        />
+                      )}
+                    </MountedFormField>
+                    <MountedFormField
+                      label={
+                        <span className="text-sm font-medium text-gray-700 flex items-center">
+                          AWS Session Name
+                          <Tooltip title="Optional. Session name for the AssumeRole call — appears in CloudTrail logs. Auto-generated if omitted.">
+                            <InfoCircleOutlined className="ml-2 text-blue-400 hover:text-blue-600 cursor-help" />
+                          </Tooltip>
+                        </span>
+                      }
+                      name={["credentials", "aws_session_name"]}
+                    >
+                      {(control) => (
+                        <Input
+                          {...textControl(control)}
+                          placeholder="Leave blank to keep existing"
+                          className="rounded-lg border-gray-300 focus:border-blue-500 focus:ring-blue-500"
+                        />
+                      )}
+                    </MountedFormField>
+                  </>
+                )}
+
+                {/* Environment Variables Section */}
+                <div className="mt-6">
+                  <EnvVarsSection />
+                </div>
+
+                {/* Permission Management / Access Control Section */}
+                <div className="mt-6">
+                  <MCPPermissionManagement
+                    availableAccessGroups={availableAccessGroups}
+                    mcpServer={mcpServer}
+                    mountedAuthType={authType}
+                    searchValue={searchValue}
+                    setSearchValue={setSearchValue}
+                    getAccessGroupOptions={getAccessGroupOptions}
+                  />
+                </div>
+
+                {/* Tool Configuration Section */}
+                <div className="mt-6">
+                  <MCPToolConfiguration
+                    accessToken={accessToken}
+                    formValues={{
+                      server_id: mcpServer.server_id,
+                      server_name: currentServerName ?? mcpServer.server_name,
+                      url: currentUrl ?? mcpServer.url,
+                      spec_path: currentSpecPath ?? mcpServer.spec_path,
+                      transport: transportType ?? mcpServer.transport,
+                      auth_type: currentAuthType ?? mcpServer.auth_type,
+                      mcp_info: mcpServer.mcp_info,
+                      oauth_flow_type:
+                        oauthFlowTypeValue ?? oauth2FlowToFormValue(mcpServer.oauth2_flow) ?? OAUTH_FLOW.INTERACTIVE,
+                      static_headers: currentStaticHeaders ?? mcpServer.static_headers,
+                      credentials: currentCredentials,
+                      issuer: currentIssuer ?? mcpServer.issuer,
+                      authorization_url: currentAuthorizationUrl ?? mcpServer.authorization_url,
+                      token_url: currentTokenUrl ?? mcpServer.token_url,
+                      registration_url: currentRegistrationUrl ?? mcpServer.registration_url,
+                    }}
+                    allowedTools={allowedTools}
+                    existingAllowedTools={existingAllowedTools}
+                    hasToolAllowlistInteraction={hasToolAllowlistInteraction}
+                    isEditMode
+                    onAllowedToolsChange={setAllowedTools}
+                    onToolAllowlistInteraction={() => setHasToolAllowlistInteraction(true)}
+                    toolNameToDisplayName={toolNameToDisplayName}
+                    toolNameToDescription={toolNameToDescription}
+                    onToolNameToDisplayNameChange={setToolNameToDisplayName}
+                    onToolNameToDescriptionChange={setToolNameToDescription}
+                    externalTools={tools}
+                    externalIsLoading={isLoadingTools}
+                    externalError={toolsError}
+                    externalCanFetch={true}
+                  />
+                </div>
+
+                <div className="flex justify-end gap-2">
+                  <AntdButton onClick={onCancel}>Cancel</AntdButton>
+                  <Button type="submit">Save Changes</Button>
+                </div>
+              </form>
+            </MountedFormProvider>
+          </FormProvider>
         </TabsContent>
 
         <TabsContent value="cost" keepMounted>
@@ -1460,7 +1285,7 @@ const MCPServerEdit: React.FC<MCPServerEditProps> = ({
 
             <div className="flex justify-end gap-2">
               <AntdButton onClick={onCancel}>Cancel</AntdButton>
-              <Button onClick={() => form.submit()}>Save Changes</Button>
+              <Button onClick={() => void submitForm()}>Save Changes</Button>
             </div>
           </div>
         </TabsContent>
diff --git a/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/mountedServerFields.test.ts b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/mountedServerFields.test.ts
new file mode 100644
index 00000000000..dd9c8db6d30
--- /dev/null
+++ b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/mountedServerFields.test.ts
@@ -0,0 +1,497 @@
+import { describe, expect, it } from "vitest";
+import {
+  mountedCreateFieldNames,
+  mountedEditFieldNames,
+  projectMountedCreateValues,
+  projectMountedEditValues,
+} from "./mountedServerFields";
+
+const editRoot = (values: Record<string, unknown>) => mountedEditFieldNames(values).root;
+const editCreds = (values: Record<string, unknown>) => mountedEditFieldNames(values).credentials;
+const createRoot = (values: Record<string, unknown>) => mountedCreateFieldNames(values).root;
+const createCreds = (values: Record<string, unknown>) => mountedCreateFieldNames(values).credentials;
+
+const HTTP_NONE = { transport: "http", auth_type: "none" };
+
+describe("edit root: transport gates", () => {
+  it("mounts url for http but not spec_path or the stdio group", () => {
+    const root = editRoot(HTTP_NONE);
+    expect(root).toContain("url");
+    expect(root).not.toContain("spec_path");
+    expect(root).not.toContain("command");
+    expect(root).not.toContain("stdio_config");
+  });
+
+  it("mounts url for sse", () => {
+    expect(editRoot({ transport: "sse", auth_type: "none" })).toContain("url");
+  });
+
+  it("mounts spec_path and not url for openapi", () => {
+    const root = editRoot({ transport: "openapi", auth_type: "none" });
+    expect(root).toContain("spec_path");
+    expect(root).not.toContain("url");
+  });
+
+  it("swaps the whole auth subtree for the stdio group on stdio", () => {
+    const root = editRoot({ transport: "stdio", auth_type: "oauth2" });
+    expect(root).toStrictEqual([
+      "server_name",
+      "alias",
+      "description",
+      "transport",
+      "max_concurrent_requests",
+      "command",
+      "args",
+      "env_json",
+      "stdio_config",
+      "env_vars",
+      "allow_all_keys",
+      "available_on_public_internet",
+      "mcp_access_groups",
+      "extra_headers",
+      "static_headers",
+    ]);
+  });
+
+  it("drops every credential on stdio even when auth_type is stored as oauth2", () => {
+    expect(editCreds({ transport: "stdio", auth_type: "oauth2" })).toStrictEqual([]);
+  });
+});
+
+describe("edit root: auth_type gates", () => {
+  it("mounts credentials.auth_value only for the four value-bearing auth types", () => {
+    for (const authType of ["api_key", "bearer_token", "token", "basic"]) {
+      expect(editCreds({ transport: "http", auth_type: authType })).toStrictEqual(["auth_value"]);
+    }
+    expect(editCreds(HTTP_NONE)).toStrictEqual([]);
+  });
+
+  it("swaps the oauth2 endpoint set on the M2M flow", () => {
+    const m2m = editRoot({ transport: "http", auth_type: "oauth2", oauth_flow_type: "m2m" });
+    const interactive = editRoot({ transport: "http", auth_type: "oauth2", oauth_flow_type: "interactive" });
+    expect(m2m).toContain("token_url");
+    expect(m2m).not.toContain("issuer");
+    expect(m2m).not.toContain("registration_url");
+    expect(interactive).toContain("issuer");
+    expect(interactive).toContain("registration_url");
+  });
+
+  it("mounts token_validation_json ONLY on the interactive oauth2 branch", () => {
+    expect(editRoot({ transport: "http", auth_type: "oauth2", oauth_flow_type: "interactive" })).toContain(
+      "token_validation_json",
+    );
+    expect(editRoot({ transport: "http", auth_type: "oauth2", oauth_flow_type: "m2m" })).not.toContain(
+      "token_validation_json",
+    );
+    expect(editRoot({ transport: "http", auth_type: "oauth2_token_exchange" })).not.toContain("token_validation_json");
+    expect(editRoot(HTTP_NONE)).not.toContain("token_validation_json");
+  });
+
+  it("mounts token_storage_ttl_seconds only on the interactive oauth2 branch", () => {
+    expect(editRoot({ transport: "http", auth_type: "oauth2", oauth_flow_type: "interactive" })).toContain(
+      "token_storage_ttl_seconds",
+    );
+    expect(editRoot({ transport: "http", auth_type: "oauth2", oauth_flow_type: "m2m" })).not.toContain(
+      "token_storage_ttl_seconds",
+    );
+  });
+
+  it("gates audience and subject_token_type on the entra_obo token-exchange profile", () => {
+    const rfc = editRoot({ transport: "http", auth_type: "oauth2_token_exchange", token_exchange_profile: "rfc8693" });
+    const entra = editRoot({
+      transport: "http",
+      auth_type: "oauth2_token_exchange",
+      token_exchange_profile: "entra_obo",
+    });
+    expect(rfc).toContain("audience");
+    expect(rfc).toContain("subject_token_type");
+    expect(entra).not.toContain("audience");
+    expect(entra).not.toContain("subject_token_type");
+    expect(entra).toContain("token_exchange_profile");
+  });
+
+  it("mounts the seven aws credentials only for aws_sigv4", () => {
+    expect(sorted(editCreds({ transport: "http", auth_type: "aws_sigv4" }))).toStrictEqual(
+      sorted([
+        "aws_region_name",
+        "aws_service_name",
+        "aws_access_key_id",
+        "aws_secret_access_key",
+        "aws_session_token",
+        "aws_role_name",
+        "aws_session_name",
+      ]),
+    );
+    expect(editCreds(HTTP_NONE)).not.toContain("aws_region_name");
+  });
+
+  it("mounts the id-jag credential set only for oauth2_id_jag", () => {
+    const creds = editCreds({ transport: "http", auth_type: "oauth2_id_jag" });
+    expect(creds).toContain("id_jag_resource_token_endpoint");
+    expect(creds).toContain("client_private_key");
+    expect(creds).toContain("client_assertion_signing_alg");
+    expect(editCreds(HTTP_NONE)).not.toContain("id_jag_resource_token_endpoint");
+  });
+});
+
+describe("edit root: children that gate by early return null", () => {
+  it("mounts dcr_bridge and the declared-app credentials only for the client-forwarded modes", () => {
+    for (const authType of ["true_passthrough", "oauth_delegate"]) {
+      expect(editRoot({ transport: "http", auth_type: authType })).toContain("dcr_bridge");
+      expect(sorted(editCreds({ transport: "http", auth_type: authType }))).toStrictEqual(
+        sorted(["client_id", "client_secret"]),
+      );
+    }
+    expect(editRoot(HTTP_NONE)).not.toContain("dcr_bridge");
+    expect(editRoot({ transport: "http", auth_type: "oauth2" })).not.toContain("dcr_bridge");
+  });
+
+  it("unmounts dcr_bridge with its parent section on stdio", () => {
+    expect(editRoot({ transport: "stdio", auth_type: "true_passthrough" })).not.toContain("dcr_bridge");
+  });
+});
+
+describe("edit root: permission-section gates", () => {
+  it("mounts delegate_auth_to_upstream only for oauth2", () => {
+    expect(editRoot({ transport: "http", auth_type: "oauth2" })).toContain("delegate_auth_to_upstream");
+    expect(editRoot(HTTP_NONE)).not.toContain("delegate_auth_to_upstream");
+    expect(editRoot({ transport: "http", auth_type: "api_key" })).not.toContain("delegate_auth_to_upstream");
+  });
+
+  it("mounts oauth_passthrough only for none-auth WITH an Authorization extra header", () => {
+    expect(editRoot({ ...HTTP_NONE, extra_headers: ["Authorization"] })).toContain("oauth_passthrough");
+    expect(editRoot({ ...HTTP_NONE, extra_headers: ["authorization"] })).toContain("oauth_passthrough");
+    expect(editRoot({ ...HTTP_NONE, extra_headers: ["X-Other"] })).not.toContain("oauth_passthrough");
+    expect(editRoot(HTTP_NONE)).not.toContain("oauth_passthrough");
+    expect(editRoot({ transport: "http", auth_type: "oauth2", extra_headers: ["Authorization"] })).not.toContain(
+      "oauth_passthrough",
+    );
+  });
+
+  it("treats an absent auth_type as none-auth for the oauth_passthrough gate", () => {
+    expect(editRoot({ transport: "http", extra_headers: ["Authorization"] })).toContain("oauth_passthrough");
+  });
+});
+
+describe("create root: where it diverges from edit", () => {
+  it("mounts source_url, which the edit root has no binding for", () => {
+    expect(createRoot({ transport: "http", auth_type: "none" })).toContain("source_url");
+    expect(editRoot(HTTP_NONE)).not.toContain("source_url");
+  });
+
+  it("gates url on an allow-list, so a blank transport mounts NEITHER url nor auth_type", () => {
+    const blank = createRoot({ transport: "" });
+    expect(blank).not.toContain("url");
+    expect(blank).not.toContain("auth_type");
+    expect(editRoot({ transport: "" })).toContain("url");
+    expect(editRoot({ transport: "" })).toContain("auth_type");
+  });
+
+  it("mounts stdio_config on stdio but never the edit root's command/args/env_json", () => {
+    const root = createRoot({ transport: "stdio" });
+    expect(root).toContain("stdio_config");
+    expect(root).not.toContain("command");
+    expect(root).not.toContain("args");
+    expect(root).not.toContain("env_json");
+  });
+
+  it("mounts the byok fields only for openapi with is_byok on", () => {
+    expect(createRoot({ transport: "openapi", auth_type: "none" })).toContain("is_byok");
+    expect(createRoot({ transport: "openapi", auth_type: "none" })).not.toContain("byok_description");
+    const on = createRoot({ transport: "openapi", auth_type: "none", is_byok: true });
+    expect(on).toContain("byok_description");
+    expect(on).toContain("byok_api_key_help_url");
+    expect(createRoot({ transport: "http", auth_type: "none", is_byok: true })).not.toContain("byok_description");
+  });
+
+  it("drops every credential while the transport is unset", () => {
+    expect(createCreds({ transport: "", auth_type: "aws_sigv4" })).toStrictEqual([]);
+    expect(createCreds({ transport: "http", auth_type: "aws_sigv4" })).toContain("aws_region_name");
+  });
+});
+
+const ALWAYS = ["server_name", "alias", "description", "transport", "max_concurrent_requests"];
+const PERMS = [
+  "allow_all_keys",
+  "available_on_public_internet",
+  "mcp_access_groups",
+  "extra_headers",
+  "static_headers",
+];
+const sorted = (xs: readonly string[]) => [...xs].sort();
+
+const expectEditSets = (
+  values: Record<string, unknown>,
+  expected: { root: readonly string[]; credentials: readonly string[] },
+) => {
+  expect(sorted(editRoot(values))).toStrictEqual(sorted(expected.root));
+  expect(sorted(editCreds(values))).toStrictEqual(sorted(expected.credentials));
+};
+
+const expectCreateSets = (
+  values: Record<string, unknown>,
+  expected: { root: readonly string[]; credentials: readonly string[] },
+) => {
+  expect(sorted(createRoot(values))).toStrictEqual(sorted(expected.root));
+  expect(sorted(createCreds(values))).toStrictEqual(sorted(expected.credentials));
+};
+
+describe("edit root: exact mounted set per auth configuration", () => {
+  it("http + none", () => {
+    expectEditSets(HTTP_NONE, { root: [...ALWAYS, "url", "auth_type", "env_vars", ...PERMS], credentials: [] });
+  });
+
+  it("http + api_key", () => {
+    expectEditSets(
+      { transport: "http", auth_type: "api_key" },
+      { root: [...ALWAYS, "url", "auth_type", "env_vars", ...PERMS], credentials: ["auth_value"] },
+    );
+  });
+
+  it("http + oauth2 M2M", () => {
+    expectEditSets(
+      { transport: "http", auth_type: "oauth2", oauth_flow_type: "m2m" },
+      {
+        root: [
+          ...ALWAYS,
+          "url",
+          "auth_type",
+          "oauth_flow_type",
+          "token_url",
+          "env_vars",
+          ...PERMS,
+          "delegate_auth_to_upstream",
+        ],
+        credentials: ["client_id", "client_secret", "token_endpoint_auth_method", "scopes", "upstream_resource"],
+      },
+    );
+  });
+
+  it("http + oauth2 interactive", () => {
+    expectEditSets(
+      { transport: "http", auth_type: "oauth2", oauth_flow_type: "interactive" },
+      {
+        root: [
+          ...ALWAYS,
+          "url",
+          "auth_type",
+          "oauth_flow_type",
+          "issuer",
+          "authorization_url",
+          "token_url",
+          "registration_url",
+          "token_validation_json",
+          "token_storage_ttl_seconds",
+          "env_vars",
+          ...PERMS,
+          "delegate_auth_to_upstream",
+        ],
+        credentials: ["client_id", "client_secret", "scopes", "upstream_resource", "token_endpoint_auth_method"],
+      },
+    );
+  });
+
+  it("http + token exchange, rfc8693", () => {
+    expectEditSets(
+      { transport: "http", auth_type: "oauth2_token_exchange", token_exchange_profile: "rfc8693" },
+      {
+        root: [
+          ...ALWAYS,
+          "url",
+          "auth_type",
+          "token_exchange_profile",
+          "token_exchange_endpoint",
+          "audience",
+          "subject_token_type",
+          "env_vars",
+          ...PERMS,
+        ],
+        credentials: ["client_id", "client_secret", "scopes"],
+      },
+    );
+  });
+
+  it("http + token exchange, entra_obo keeps the endpoint while dropping audience and subject_token_type", () => {
+    expectEditSets(
+      { transport: "http", auth_type: "oauth2_token_exchange", token_exchange_profile: "entra_obo" },
+      {
+        root: [
+          ...ALWAYS,
+          "url",
+          "auth_type",
+          "token_exchange_profile",
+          "token_exchange_endpoint",
+          "env_vars",
+          ...PERMS,
+        ],
+        credentials: ["client_id", "client_secret", "scopes"],
+      },
+    );
+  });
+
+  it("http + id-jag", () => {
+    expectEditSets(
+      { transport: "http", auth_type: "oauth2_id_jag" },
+      {
+        root: [
+          ...ALWAYS,
+          "url",
+          "auth_type",
+          "token_exchange_endpoint",
+          "audience",
+          "subject_token_type",
+          "env_vars",
+          ...PERMS,
+        ],
+        credentials: [
+          "id_jag_resource_token_endpoint",
+          "client_id",
+          "client_secret",
+          "client_private_key",
+          "client_private_key_id",
+          "client_assertion_signing_alg",
+          "id_jag_resource",
+          "scopes",
+        ],
+      },
+    );
+  });
+
+  it("http + true_passthrough", () => {
+    expectEditSets(
+      { transport: "http", auth_type: "true_passthrough" },
+      {
+        root: [...ALWAYS, "url", "auth_type", "dcr_bridge", "env_vars", ...PERMS],
+        credentials: ["client_id", "client_secret"],
+      },
+    );
+  });
+
+  it("openapi + none", () => {
+    expectEditSets(
+      { transport: "openapi", auth_type: "none" },
+      { root: [...ALWAYS, "spec_path", "auth_type", "env_vars", ...PERMS], credentials: [] },
+    );
+  });
+});
+
+describe("create root: exact mounted set per configuration", () => {
+  it("http + none", () => {
+    expectCreateSets(
+      { transport: "http", auth_type: "none" },
+      { root: [...ALWAYS, "source_url", "url", "auth_type", "env_vars", ...PERMS], credentials: [] },
+    );
+  });
+
+  it("openapi with byok on", () => {
+    expectCreateSets(
+      { transport: "openapi", auth_type: "none", is_byok: true },
+      {
+        root: [
+          ...ALWAYS,
+          "source_url",
+          "spec_path",
+          "is_byok",
+          "byok_description",
+          "byok_api_key_help_url",
+          "auth_type",
+          "env_vars",
+          ...PERMS,
+        ],
+        credentials: [],
+      },
+    );
+  });
+
+  it("stdio", () => {
+    expectCreateSets(
+      { transport: "stdio" },
+      { root: [...ALWAYS, "source_url", "stdio_config", "env_vars", ...PERMS], credentials: [] },
+    );
+  });
+
+  it("transport still unset", () => {
+    expectCreateSets({ transport: "" }, { root: [...ALWAYS, "source_url", "env_vars", ...PERMS], credentials: [] });
+  });
+
+  it("http + oauth2 interactive", () => {
+    expectCreateSets(
+      { transport: "http", auth_type: "oauth2", oauth_flow_type: "interactive" },
+      {
+        root: [
+          ...ALWAYS,
+          "source_url",
+          "url",
+          "auth_type",
+          "oauth_flow_type",
+          "issuer",
+          "authorization_url",
+          "token_url",
+          "registration_url",
+          "token_validation_json",
+          "token_storage_ttl_seconds",
+          "env_vars",
+          ...PERMS,
+          "delegate_auth_to_upstream",
+        ],
+        credentials: ["client_id", "client_secret", "scopes", "upstream_resource", "token_endpoint_auth_method"],
+      },
+    );
+  });
+
+  it("http + oauth_delegate mounts dcr_bridge and the declared app", () => {
+    expectCreateSets(
+      { transport: "http", auth_type: "oauth_delegate" },
+      {
+        root: [...ALWAYS, "source_url", "url", "auth_type", "dcr_bridge", "env_vars", ...PERMS],
+        credentials: ["client_id", "client_secret"],
+      },
+    );
+  });
+});
+
+describe("projection shape", () => {
+  it("EMITS a mounted-but-unset field as a key holding undefined, matching antd onFinish", () => {
+    const projected = projectMountedEditValues({ transport: "http", auth_type: "none", server_name: "s" });
+    expect("description" in projected).toBe(true);
+    expect(projected.description).toBeUndefined();
+    expect(Object.keys(projected)).toContain("max_concurrent_requests");
+  });
+
+  it("emits mounted-but-unset CREDENTIAL keys as undefined rather than omitting them", () => {
+    const projected = projectMountedEditValues({ transport: "http", auth_type: "api_key" });
+    expect(Object.keys(projected.credentials as object)).toStrictEqual(["auth_value"]);
+    expect((projected.credentials as Record<string, unknown>).auth_value).toBeUndefined();
+  });
+
+  it("omits the credentials key entirely when no credential field is mounted", () => {
+    expect("credentials" in projectMountedEditValues(HTTP_NONE)).toBe(false);
+  });
+
+  it("drops an unmounted field even when the store still holds a value for it", () => {
+    const storeWithStaleHttpValues = {
+      transport: "stdio",
+      auth_type: "oauth2",
+      url: "https://kept-in-store.example",
+      issuer: "https://kept-in-store.example",
+      command: "npx",
+    };
+    const projected = projectMountedEditValues(storeWithStaleHttpValues);
+    expect("url" in projected).toBe(false);
+    expect("issuer" in projected).toBe(false);
+    expect(projected.command).toBe("npx");
+  });
+
+  it("passes list rows through whole, since a list field is projected as one key and not per mounted sub-field", () => {
+    const row = { name: "N", value: "V", scope: "user", description: "D" };
+    const projected = projectMountedEditValues({ ...HTTP_NONE, env_vars: [row] });
+    expect(projected.env_vars).toStrictEqual([row]);
+  });
+
+  it("keeps static_headers rows whole", () => {
+    const rows = [{ header: "X-A", value: "1" }];
+    expect(
+      projectMountedCreateValues({ transport: "http", auth_type: "none", static_headers: rows }).static_headers,
+    ).toStrictEqual(rows);
+  });
+});
diff --git a/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/mountedServerFields.ts b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/mountedServerFields.ts
new file mode 100644
index 00000000000..22f0146afc9
--- /dev/null
+++ b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/mountedServerFields.ts
@@ -0,0 +1,195 @@
+import { AUTH_TYPE, OAUTH_FLOW, TRANSPORT, isClientForwardedTokenMode } from "@/components/mcp_tools/types";
+import { AUTH_TYPES_REQUIRING_AUTH_VALUE } from "./createServerPayload";
+
+export interface MountedFieldNames {
+  readonly root: readonly string[];
+  readonly credentials: readonly string[];
+}
+
+const ENTRA_OBO_PROFILE = "entra_obo";
+
+const ALWAYS_MOUNTED_ROOT = ["server_name", "alias", "description", "transport", "max_concurrent_requests"] as const;
+
+const PERMISSION_SECTION_ROOT = [
+  "allow_all_keys",
+  "available_on_public_internet",
+  "mcp_access_groups",
+  "extra_headers",
+  "static_headers",
+] as const;
+
+const OAUTH_M2M_CREDENTIALS = [
+  "client_id",
+  "client_secret",
+  "token_endpoint_auth_method",
+  "scopes",
+  "upstream_resource",
+] as const;
+
+const OAUTH_INTERACTIVE_CREDENTIALS = [
+  "client_id",
+  "client_secret",
+  "scopes",
+  "upstream_resource",
+  "token_endpoint_auth_method",
+] as const;
+
+const OAUTH_INTERACTIVE_ROOT = [
+  "issuer",
+  "authorization_url",
+  "token_url",
+  "registration_url",
+  "token_validation_json",
+  "token_storage_ttl_seconds",
+] as const;
+
+const ID_JAG_CREDENTIALS = [
+  "id_jag_resource_token_endpoint",
+  "client_id",
+  "client_secret",
+  "client_private_key",
+  "client_private_key_id",
+  "client_assertion_signing_alg",
+  "id_jag_resource",
+  "scopes",
+] as const;
+
+const AWS_SIGV4_CREDENTIALS = [
+  "aws_region_name",
+  "aws_service_name",
+  "aws_access_key_id",
+  "aws_secret_access_key",
+  "aws_session_token",
+  "aws_role_name",
+  "aws_session_name",
+] as const;
+
+const hasAuthorizationExtraHeader = (extraHeaders: unknown): boolean =>
+  Array.isArray(extraHeaders) && extraHeaders.some((h) => typeof h === "string" && h.toLowerCase() === "authorization");
+
+interface AuthSubtreeGates {
+  readonly authType: string | undefined;
+  readonly oauthFlowType: string | undefined;
+  readonly tokenExchangeProfile: string | undefined;
+}
+
+const authSubtreeRoot = ({ authType, oauthFlowType, tokenExchangeProfile }: AuthSubtreeGates): readonly string[] => {
+  if (authType === AUTH_TYPE.OAUTH2) {
+    return oauthFlowType === OAUTH_FLOW.M2M
+      ? ["oauth_flow_type", "token_url"]
+      : ["oauth_flow_type", ...OAUTH_INTERACTIVE_ROOT];
+  }
+  if (authType === AUTH_TYPE.OAUTH2_TOKEN_EXCHANGE) {
+    return tokenExchangeProfile === ENTRA_OBO_PROFILE
+      ? ["token_exchange_profile", "token_exchange_endpoint"]
+      : ["token_exchange_profile", "token_exchange_endpoint", "audience", "subject_token_type"];
+  }
+  if (authType === AUTH_TYPE.OAUTH2_ID_JAG) {
+    return ["token_exchange_endpoint", "audience", "subject_token_type"];
+  }
+  return [];
+};
+
+const authSubtreeCredentials = ({ authType, oauthFlowType }: AuthSubtreeGates): readonly string[] => {
+  const authValue = AUTH_TYPES_REQUIRING_AUTH_VALUE.includes(authType as string) ? ["auth_value"] : [];
+  const clientForwarded = isClientForwardedTokenMode(authType) ? ["client_id", "client_secret"] : [];
+  if (authType === AUTH_TYPE.OAUTH2) {
+    return [
+      ...authValue,
+      ...(oauthFlowType === OAUTH_FLOW.M2M ? OAUTH_M2M_CREDENTIALS : OAUTH_INTERACTIVE_CREDENTIALS),
+    ];
+  }
+  if (authType === AUTH_TYPE.OAUTH2_TOKEN_EXCHANGE) {
+    return [...authValue, "client_id", "client_secret", "scopes"];
+  }
+  if (authType === AUTH_TYPE.OAUTH2_ID_JAG) {
+    return [...authValue, ...ID_JAG_CREDENTIALS];
+  }
+  if (authType === AUTH_TYPE.AWS_SIGV4) {
+    return [...authValue, ...AWS_SIGV4_CREDENTIALS];
+  }
+  return [...authValue, ...clientForwarded];
+};
+
+const permissionSectionRoot = (authType: string | undefined, extraHeaders: unknown): readonly string[] => {
+  const isNoneAuth = authType === AUTH_TYPE.NONE || authType == null;
+  return [
+    ...PERMISSION_SECTION_ROOT,
+    ...(authType === AUTH_TYPE.OAUTH2 ? ["delegate_auth_to_upstream"] : []),
+    ...(isNoneAuth && hasAuthorizationExtraHeader(extraHeaders) ? ["oauth_passthrough"] : []),
+  ];
+};
+
+const dedupe = (names: readonly string[]): readonly string[] => Array.from(new Set(names));
+
+export const mountedEditFieldNames = (values: Record<string, unknown>): MountedFieldNames => {
+  const transport = values.transport as string | undefined;
+  const isStdio = transport === "stdio";
+  const isOpenApi = transport === TRANSPORT.OPENAPI;
+  const isMcp = !isStdio && !isOpenApi;
+  const gates: AuthSubtreeGates = {
+    authType: isStdio ? undefined : (values.auth_type as string | undefined),
+    oauthFlowType: values.oauth_flow_type as string | undefined,
+    tokenExchangeProfile: values.token_exchange_profile as string | undefined,
+  };
+
+  return {
+    root: dedupe([
+      ...ALWAYS_MOUNTED_ROOT,
+      ...(isMcp ? ["url"] : []),
+      ...(isOpenApi ? ["spec_path"] : []),
+      ...(isStdio ? ["command", "args", "env_json", "stdio_config"] : ["auth_type"]),
+      ...(isStdio ? [] : authSubtreeRoot(gates)),
+      ...(!isStdio && isClientForwardedTokenMode(gates.authType) ? ["dcr_bridge"] : []),
+      "env_vars",
+      ...permissionSectionRoot(gates.authType, values.extra_headers),
+    ]),
+    credentials: isStdio ? [] : dedupe(authSubtreeCredentials(gates)),
+  };
+};
+
+export const mountedCreateFieldNames = (values: Record<string, unknown>): MountedFieldNames => {
+  const transport = values.transport as string | undefined;
+  const isStdio = transport === "stdio";
+  const isOpenApi = transport === TRANSPORT.OPENAPI;
+  const authSectionMounted = !isStdio && transport !== "" && transport !== undefined;
+  const gates: AuthSubtreeGates = {
+    authType: authSectionMounted ? (values.auth_type as string | undefined) : undefined,
+    oauthFlowType: values.oauth_flow_type as string | undefined,
+    tokenExchangeProfile: values.token_exchange_profile as string | undefined,
+  };
+
+  return {
+    root: dedupe([
+      ...ALWAYS_MOUNTED_ROOT,
+      "source_url",
+      ...(transport === "http" || transport === "sse" ? ["url"] : []),
+      ...(isOpenApi ? ["spec_path", "is_byok"] : []),
+      ...(isOpenApi && values.is_byok ? ["byok_description", "byok_api_key_help_url"] : []),
+      ...(authSectionMounted ? ["auth_type"] : []),
+      ...(authSectionMounted ? authSubtreeRoot(gates) : []),
+      ...(authSectionMounted && isClientForwardedTokenMode(gates.authType) ? ["dcr_bridge"] : []),
+      ...(isStdio ? ["stdio_config"] : []),
+      "env_vars",
+      ...permissionSectionRoot(gates.authType, values.extra_headers),
+    ]),
+    credentials: authSectionMounted ? dedupe(authSubtreeCredentials(gates)) : [],
+  };
+};
+
+const pickEmitting = (source: Record<string, unknown> | undefined, names: readonly string[]): Record<string, unknown> =>
+  Object.fromEntries(names.map((name) => [name, source?.[name]]));
+
+const projectWith =
+  (namesOf: (values: Record<string, unknown>) => MountedFieldNames) =>
+  (values: Record<string, unknown>): Record<string, unknown> => {
+    const names = namesOf(values);
+    const credentials = values.credentials as Record<string, unknown> | undefined;
+    return {
+      ...pickEmitting(values, names.root),
+      ...(names.credentials.length > 0 ? { credentials: pickEmitting(credentials, names.credentials) } : {}),
+    };
+  };
+
+export const projectMountedEditValues = projectWith(mountedEditFieldNames);
+export const projectMountedCreateValues = projectWith(mountedCreateFieldNames);
diff --git a/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/testUtils.ts b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/testUtils.ts
index 7911c3eb800..c1692f436d7 100644
--- a/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/testUtils.ts
+++ b/ui/litellm-dashboard/src/app/(dashboard)/mcp-servers/_components/testUtils.ts
@@ -4,6 +4,7 @@ import { expect } from "vitest";
 export async function selectAntOption(labelText: string, optionText: string) {
   const label = screen.getByText(labelText);
   const select =
+    label.closest("[data-slot='field']")?.querySelector(".ant-select") ??
     label.closest(".ant-form-item")?.querySelector(".ant-select") ??
     label.closest(".ant-collapse-item")?.querySelector(".ant-select") ??
     label.closest("div")?.querySelector(".ant-select") ??
diff --git a/ui/litellm-dashboard/src/app/(dashboard)/models-and-endpoints/components/PriceDataManagementTab.test.tsx b/ui/litellm-dashboard/src/app/(dashboard)/models-and-endpoints/components/PriceDataManagementTab.test.tsx
index 282cc2722db..8b34d61ebad 100644
--- a/ui/litellm-dashboard/src/app/(dashboard)/models-and-endpoints/components/PriceDataManagementTab.test.tsx
+++ b/ui/litellm-dashboard/src/app/(dashboard)/models-and-endpoints/components/PriceDataManagementTab.test.tsx
@@ -3,11 +3,6 @@ import { render } from "@testing-library/react";
 import { describe, expect, it, vi } from "vitest";
 import PriceDataManagementTab from "./PriceDataManagementTab";
 
-// Deliberately do NOT mock @tremor/react. These tab components render standalone
-// (inside antd Tabs / directly as a route page), no longer inside a Tremor
-// <TabGroup>. A Tremor <TabPanel> root renders nothing without that context, so
-// this asserts the component's content is visible on its own — reverting the root
-// back to <TabPanel> makes the title disappear and fails this test.
 vi.mock("@/components/price_data_reload", () => ({ default: () => <div>reload</div> }));
 vi.mock("@/app/(dashboard)/hooks/useAuthorized", () => ({ default: () => ({ accessToken: "sk-test" }) }));
 vi.mock("@/app/(dashboard)/hooks/models/useModelCostMap", () => ({
@@ -15,7 +10,7 @@ vi.mock("@/app/(dashboard)/hooks/models/useModelCostMap", () => ({
 }));
 
 describe("PriceDataManagementTab", () => {
-  it("renders its content standalone, without a Tremor TabGroup ancestor", () => {
+  it("renders its content standalone, without a tab-panel ancestor", () => {
     const { getByText } = render(<PriceDataManagementTab />);
     expect(getByText("Price Data Management")).toBeInTheDocument();
   });
diff --git a/ui/litellm-dashboard/src/app/(dashboard)/models-and-endpoints/panels/AddModelPanel.integration.test.tsx b/ui/litellm-dashboard/src/app/(dashboard)/models-and-endpoints/panels/AddModelPanel.integration.test.tsx
new file mode 100644
index 00000000000..b762f006261
--- /dev/null
+++ b/ui/litellm-dashboard/src/app/(dashboard)/models-and-endpoints/panels/AddModelPanel.integration.test.tsx
@@ -0,0 +1,424 @@
+import { renderWithProviders, screen, waitFor } from "../../../../../tests/test-utils";
+import userEvent, { PointerEventsCheckLevel } from "@testing-library/user-event";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import AddModelPanel from "./AddModelPanel";
+
+const modelCreateCall = vi.fn();
+const mockPtuEnabled = vi.fn();
+const mockAuthorized = vi.fn();
+
+vi.mock("@/components/networking", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("@/components/networking")>();
+  return {
+    ...actual,
+    modelCreateCall: (accessToken: string, model: unknown) => modelCreateCall(accessToken, model),
+    modelAvailableCall: vi.fn().mockResolvedValue({ data: [{ id: "group-a" }] }),
+  };
+});
+
+vi.mock("@/app/(dashboard)/hooks/useAuthorized", () => ({ default: () => mockAuthorized() }));
+
+vi.mock("@/app/(dashboard)/hooks/uiSettings/usePtuCostAttributionEnabled", () => ({
+  usePtuCostAttributionEnabled: () => mockPtuEnabled(),
+}));
+
+vi.mock("@/app/(dashboard)/hooks/models/useModelCostMap", () => ({ useModelCostMap: () => ({ data: {} }) }));
+
+vi.mock("@/app/(dashboard)/hooks/credentials/useCredentials", () => ({
+  useCredentials: () => ({ data: { credentials: [] } }),
+}));
+
+vi.mock("@/app/(dashboard)/hooks/teams/useTeams", () => ({
+  useTeams: () => ({ data: [] }),
+  useInfiniteTeams: () => ({
+    data: { pages: [{ teams: [], total: 0, page: 1, page_size: 20, total_pages: 1 }] },
+    fetchNextPage: vi.fn(),
+    hasNextPage: false,
+    isFetchingNextPage: false,
+    isLoading: false,
+  }),
+}));
+
+vi.mock("@/app/(dashboard)/hooks/guardrails/useGuardrails", () => ({
+  useGuardrails: () => ({ data: { guardrails: [{ guardrail_name: "g-1" }] }, isLoading: false, error: null }),
+}));
+
+vi.mock("@/app/(dashboard)/hooks/tags/useTags", () => ({
+  useTags: () => ({ data: {}, isLoading: false, error: null }),
+}));
+
+vi.mock("@/app/(dashboard)/hooks/providers/useProviderFields", () => ({
+  useProviderFields: () => ({
+    data: [
+      {
+        provider: "OpenAI",
+        provider_display_name: "OpenAI",
+        litellm_provider: "openai",
+        default_model_placeholder: "gpt-4o",
+        credential_fields: [
+          { key: "api_key", label: "API Key", field_type: "password", required: false },
+          { key: "api_base", label: "API Base", field_type: "text", required: false },
+        ],
+      },
+    ],
+    isLoading: false,
+    error: null,
+  }),
+}));
+
+vi.mock("@/components/vector_store_management/VectorStoreSelector", () => ({
+  default: () => <div data-testid="vector-store-selector" />,
+}));
+
+const lastCreatedModel = () => modelCreateCall.mock.calls.at(-1)?.[1];
+
+const PROXY_ADMIN = {
+  token: "t",
+  accessToken: "test-access-token",
+  userId: "user-1",
+  userEmail: "a@b.c",
+  userRole: "proxy_admin",
+  premiumUser: true,
+  disabledPersonalKeyCreation: false,
+  showSSOBanner: false,
+};
+
+const alwaysMounted = {
+  api_key: undefined,
+  api_base: undefined,
+  custom_llm_provider: "openai",
+  litellm_credential_name: null,
+  model: "gpt-4o",
+};
+
+const advancedOpenExtras = {
+  guardrails: undefined,
+  tags: undefined,
+  use_in_pass_through: undefined,
+  vector_store_ids: undefined,
+};
+
+const baseModelInfo = { access_groups: undefined, mode: undefined };
+
+const { api_base: _omitted, ...ALWAYS_MOUNTED_WITHOUT_API_BASE } = alwaysMounted;
+
+const setup = async () => {
+  const user = userEvent.setup({ pointerEventsCheck: PointerEventsCheckLevel.Never });
+  renderWithProviders(<AddModelPanel />);
+  await screen.findByText("Provider");
+
+  const openAdvanced = async () => {
+    await user.click(screen.getByText("Advanced Settings"));
+    await screen.findByText("Tags");
+  };
+
+  const closeAdvanced = async () => {
+    await user.click(screen.getByText("Advanced Settings"));
+    await waitFor(() => expect(screen.queryByText("Tags")).not.toBeInTheDocument());
+  };
+
+  const fillRequired = async (modelName = "gpt-4o") => {
+    await user.click(screen.getByRole("combobox", { name: /provider/i }));
+    await user.click(await screen.findByText("OpenAI"));
+    await user.type(await screen.findByPlaceholderText("gpt-3.5-turbo"), modelName);
+  };
+
+  const submit = async () => {
+    await user.click(screen.getByTestId("add-model-btn"));
+    await waitFor(() => expect(modelCreateCall).toHaveBeenCalled());
+  };
+
+  const submitExpectingRejection = async (message: string) => {
+    await user.click(screen.getByTestId("add-model-btn"));
+    await screen.findByText(message);
+  };
+
+  return { user, openAdvanced, closeAdvanced, fillRequired, submit, submitExpectingRejection };
+};
+
+describe("AddModelPanel submit payload contract", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mockPtuEnabled.mockReturnValue(false);
+    mockAuthorized.mockReturnValue(PROXY_ADMIN);
+  });
+
+  it("sends only the always-mounted fields while Advanced Settings stays closed", async () => {
+    const { fillRequired, submit } = await setup();
+    await fillRequired();
+    await submit();
+
+    expect(lastCreatedModel()).toStrictEqual({
+      model_name: "gpt-4o",
+      litellm_params: { ...alwaysMounted },
+      model_info: { ...baseModelInfo },
+    });
+  });
+
+  it("registers four more keys as undefined once Advanced Settings opens", async () => {
+    const { openAdvanced, fillRequired, submit } = await setup();
+    await fillRequired();
+    await openAdvanced();
+    await submit();
+
+    expect(lastCreatedModel()).toStrictEqual({
+      model_name: "gpt-4o",
+      litellm_params: { ...alwaysMounted, ...advancedOpenExtras },
+      model_info: { ...baseModelInfo },
+    });
+  });
+
+  it("merges typed LiteLLM Params into litellm_params", async () => {
+    const { user, openAdvanced, fillRequired, submit } = await setup();
+    await fillRequired();
+    await openAdvanced();
+    await user.type(screen.getByLabelText("LiteLLM Params"), '{{"rpm": 7}');
+    await submit();
+
+    expect(lastCreatedModel()).toStrictEqual({
+      model_name: "gpt-4o",
+      litellm_params: { ...alwaysMounted, ...advancedOpenExtras, rpm: 7 },
+      model_info: { ...baseModelInfo },
+    });
+  });
+
+  it("drops a collapsed section's keys and the value typed into it", async () => {
+    const { user, openAdvanced, closeAdvanced, fillRequired, submit } = await setup();
+    await fillRequired();
+    await openAdvanced();
+    await user.type(screen.getByLabelText("LiteLLM Params"), '{{"rpm": 7}');
+    await closeAdvanced();
+    await submit();
+
+    expect(lastCreatedModel()).toStrictEqual({
+      model_name: "gpt-4o",
+      litellm_params: { ...alwaysMounted },
+      model_info: { ...baseModelInfo },
+    });
+  });
+
+  it("restores the typed value when the section is expanded again", async () => {
+    const { user, openAdvanced, closeAdvanced, fillRequired, submit } = await setup();
+    await fillRequired();
+    await openAdvanced();
+    await user.type(screen.getByLabelText("LiteLLM Params"), '{{"rpm": 7}');
+    await closeAdvanced();
+    await openAdvanced();
+    expect(screen.getByLabelText("LiteLLM Params")).toHaveValue('{"rpm": 7}');
+
+    await submit();
+
+    expect(lastCreatedModel()).toStrictEqual({
+      model_name: "gpt-4o",
+      litellm_params: { ...alwaysMounted, ...advancedOpenExtras, rpm: 7 },
+      model_info: { ...baseModelInfo },
+    });
+  });
+
+  it("converts per-million pricing to per-token and falls back to input cost for cache reads", async () => {
+    const { user, openAdvanced, fillRequired, submit } = await setup();
+    await fillRequired();
+    await openAdvanced();
+    await user.click(screen.getByLabelText("Custom Pricing"));
+    await user.type(await screen.findByLabelText("Input Cost (per 1M tokens)"), "3");
+    await user.type(screen.getByLabelText("Output Cost (per 1M tokens)"), "9");
+    await submit();
+
+    expect(lastCreatedModel()).toStrictEqual({
+      model_name: "gpt-4o",
+      litellm_params: {
+        ...alwaysMounted,
+        ...advancedOpenExtras,
+        input_cost_per_token: 0.000003,
+        output_cost_per_token: 0.000009,
+        cache_read_input_token_cost: 0.000003,
+      },
+      model_info: { ...baseModelInfo },
+    });
+  });
+
+  it("sends the seeded injection point when cache control is switched on", async () => {
+    const { user, openAdvanced, fillRequired, submit } = await setup();
+    await fillRequired();
+    await openAdvanced();
+    await user.click(screen.getByLabelText("Cache Control Injection Points"));
+    await screen.findByText("Add Injection Point");
+    await submit();
+
+    expect(lastCreatedModel()).toStrictEqual({
+      model_name: "gpt-4o",
+      litellm_params: {
+        ...alwaysMounted,
+        ...advancedOpenExtras,
+        cache_control_injection_points: [{ location: "message" }],
+      },
+      model_info: { ...baseModelInfo },
+    });
+  });
+
+  it("carries a role picked inside the injection point editor, with the index kept a string", async () => {
+    const { user, openAdvanced, fillRequired, submit } = await setup();
+    await fillRequired();
+    await openAdvanced();
+    await user.click(screen.getByLabelText("Cache Control Injection Points"));
+    await screen.findByText("Add Injection Point");
+    await user.click(screen.getByText("Select a role"));
+    await user.click(await screen.findByText("System"));
+    await user.type(screen.getByPlaceholderText("Optional"), "3");
+    await submit();
+
+    expect(lastCreatedModel()).toStrictEqual({
+      model_name: "gpt-4o",
+      litellm_params: {
+        ...alwaysMounted,
+        ...advancedOpenExtras,
+        cache_control_injection_points: [{ location: "message", role: "system", index: "3" }],
+      },
+      model_info: { ...baseModelInfo },
+    });
+  });
+
+  it("mounts team_id only once the Team-BYOK switch is on", async () => {
+    const { user, fillRequired, submit } = await setup();
+    await fillRequired();
+    await user.click(screen.getByRole("switch", { name: "Team-BYOK Model" }));
+    await screen.findByText("Select Team");
+    await submit();
+
+    expect(lastCreatedModel()).toStrictEqual({
+      model_name: "gpt-4o",
+      litellm_params: { ...alwaysMounted },
+      model_info: { ...baseModelInfo, team_id: undefined },
+    });
+  });
+});
+
+describe("AddModelPanel empty-string skip", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mockPtuEnabled.mockReturnValue(false);
+    mockAuthorized.mockReturnValue(PROXY_ADMIN);
+  });
+
+  it("sends a typed api_base, so the binding behind the next case is known to be live", async () => {
+    const { user, fillRequired, submit } = await setup();
+    await fillRequired();
+    await user.type(screen.getByLabelText("API Base"), "https://example.test");
+    await submit();
+
+    expect(lastCreatedModel().litellm_params).toStrictEqual({
+      ...alwaysMounted,
+      api_base: "https://example.test",
+    });
+  });
+
+  it("omits api_base entirely once it is cleared, rather than sending an empty string", async () => {
+    const { user, fillRequired, submit } = await setup();
+    await fillRequired();
+    const apiBase = screen.getByLabelText("API Base");
+    await user.type(apiBase, "https://example.test");
+    await user.clear(apiBase);
+    await submit();
+
+    const params = lastCreatedModel().litellm_params;
+    expect(params).not.toHaveProperty("api_base");
+    expect(params).toStrictEqual(ALWAYS_MOUNTED_WITHOUT_API_BASE);
+  });
+});
+
+describe("AddModelPanel validation gates", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mockPtuEnabled.mockReturnValue(true);
+    mockAuthorized.mockReturnValue(PROXY_ADMIN);
+  });
+
+  it("blocks the submit when a PTU count carries no effective-from date", async () => {
+    const { user, openAdvanced, fillRequired, submitExpectingRejection } = await setup();
+    await fillRequired();
+    await openAdvanced();
+    await user.type(screen.getByLabelText("PTU Count"), "15");
+    await user.type(screen.getByLabelText("Calculated Cost per PTU / Hour (USD)"), "2");
+    await submitExpectingRejection("PTU Effective From is required when PTU Count is set");
+
+    expect(modelCreateCall).not.toHaveBeenCalled();
+  });
+
+  it("hides the PTU fields entirely when the capability is off", async () => {
+    mockPtuEnabled.mockReturnValue(false);
+    const { openAdvanced, fillRequired } = await setup();
+    await fillRequired();
+    await openAdvanced();
+
+    expect(screen.queryByLabelText("PTU Count")).not.toBeInTheDocument();
+  });
+
+  it("requires a model before anything is sent", async () => {
+    const { user, submitExpectingRejection } = await setup();
+    await user.click(screen.getByRole("combobox", { name: /provider/i }));
+    await user.click(await screen.findByText("OpenAI"));
+    await submitExpectingRejection("Please enter at least one model.");
+
+    expect(modelCreateCall).not.toHaveBeenCalled();
+  });
+
+  it("blocks the submit when LiteLLM Params is not valid JSON", async () => {
+    mockPtuEnabled.mockReturnValue(false);
+    const { user, openAdvanced, fillRequired, submitExpectingRejection } = await setup();
+    await fillRequired();
+    await openAdvanced();
+    await user.type(screen.getByLabelText("LiteLLM Params"), "rpm: 7");
+    await submitExpectingRejection("Please enter valid JSON");
+
+    expect(modelCreateCall).not.toHaveBeenCalled();
+  });
+});
+
+describe("AddModelPanel behaviours the removed Advanced Settings form instance never drove", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mockPtuEnabled.mockReturnValue(false);
+    mockAuthorized.mockReturnValue(PROXY_ADMIN);
+  });
+
+  it("leaves LiteLLM Params untouched when pass through routes is switched on", async () => {
+    const { user, openAdvanced, fillRequired, submit } = await setup();
+    await fillRequired();
+    await openAdvanced();
+    await user.click(screen.getByLabelText("Use in pass through routes"));
+    expect(screen.getByLabelText("LiteLLM Params")).toHaveValue("");
+
+    await submit();
+
+    expect(lastCreatedModel()).toStrictEqual({
+      model_name: "gpt-4o",
+      litellm_params: { ...alwaysMounted, ...advancedOpenExtras, use_in_pass_through: true },
+      model_info: { ...baseModelInfo },
+    });
+  });
+
+  it("keeps a typed cost when custom pricing is switched off and back on", async () => {
+    const { user, openAdvanced, fillRequired, submit } = await setup();
+    await fillRequired();
+    await openAdvanced();
+    await user.click(screen.getByLabelText("Custom Pricing"));
+    await user.type(await screen.findByLabelText("Input Cost (per 1M tokens)"), "3");
+    await user.click(screen.getByLabelText("Custom Pricing"));
+    await waitFor(() => expect(screen.queryByLabelText("Input Cost (per 1M tokens)")).not.toBeInTheDocument());
+    await user.click(screen.getByLabelText("Custom Pricing"));
+    expect(await screen.findByLabelText("Input Cost (per 1M tokens)")).toHaveValue("3");
+
+    await submit();
+
+    expect(lastCreatedModel()).toStrictEqual({
+      model_name: "gpt-4o",
+      litellm_params: {
+        ...alwaysMounted,
+        ...advancedOpenExtras,
+        input_cost_per_token: 0.000003,
+        cache_read_input_token_cost: 0.000003,
+      },
+      model_info: { ...baseModelInfo },
+    });
+  });
+});
diff --git a/ui/litellm-dashboard/src/app/(dashboard)/models-and-endpoints/panels/AddModelPanel.tsx b/ui/litellm-dashboard/src/app/(dashboard)/models-and-endpoints/panels/AddModelPanel.tsx
index 35be19531d5..59d4f95c038 100644
--- a/ui/litellm-dashboard/src/app/(dashboard)/models-and-endpoints/panels/AddModelPanel.tsx
+++ b/ui/litellm-dashboard/src/app/(dashboard)/models-and-endpoints/panels/AddModelPanel.tsx
@@ -1,21 +1,28 @@
 "use client";
 
-import { Form } from "antd";
 import { useState } from "react";
+import { useForm } from "react-hook-form";
 import { useQueryClient } from "@tanstack/react-query";
 import AddModelForm from "@/components/add_model/AddModelForm";
 import { handleAddModelSubmit } from "@/components/add_model/handle_add_model_submit";
+import {
+  projectMountedValues,
+  useMountRegistry,
+  type MountedFormValues,
+} from "@/components/common_components/MountedFormField";
 import { Providers, getPlaceholder, getProviderModels } from "@/components/provider_info_helpers";
-import { toast } from "@/lib/toast";
 import { useModelCostMap } from "@/app/(dashboard)/hooks/models/useModelCostMap";
 import { useCredentials } from "@/app/(dashboard)/hooks/credentials/useCredentials";
 import { useTeams } from "@/app/(dashboard)/hooks/teams/useTeams";
 import useAuthorized from "@/app/(dashboard)/hooks/useAuthorized";
 import { vertexCredentialsUploadProps } from "@/app/(dashboard)/models-and-endpoints/vertexCredentialsUpload";
 
+const INITIAL_VALUES: MountedFormValues = { litellm_credential_name: null };
+
 export default function AddModelPanel() {
   const { accessToken } = useAuthorized();
-  const [form] = Form.useForm();
+  const form = useForm<MountedFormValues>({ mode: "onChange", defaultValues: INITIAL_VALUES });
+  const registry = useMountRegistry();
   const queryClient = useQueryClient();
   const { data: modelCostMapData } = useModelCostMap();
   const { data: credentialsResponse } = useCredentials();
@@ -26,28 +33,36 @@ export default function AddModelPanel() {
 
   const refresh = () => queryClient.invalidateQueries({ queryKey: ["models", "list"] });
 
-  const handleOk = async () => {
-    try {
-      const values = await form.validateFields();
-      await handleAddModelSubmit(values, accessToken, form, refresh);
-    } catch (error: any) {
-      const errorMessages =
-        error.errorFields?.map((field: any) => `${field.name.join(".")}: ${field.errors.join(", ")}`).join(" | ") ||
-        "Unknown validation error";
-      toast.fromError(`Please fill in the following required fields: ${errorMessages}`);
+  const mountedValues = () => projectMountedValues(registry, form.getValues);
+
+  const handleOk = async (): Promise<boolean> => {
+    const isValid = await form.trigger(registry.mountedNames() as string[]);
+    if (!isValid) {
+      return false;
     }
+    await handleAddModelSubmit(
+      mountedValues(),
+      accessToken,
+      { resetFields: () => form.reset(INITIAL_VALUES) },
+      refresh,
+    );
+    return true;
   };
 
   return (
     <AddModelForm
       form={form}
+      registry={registry}
+      mountedValues={mountedValues}
       handleOk={handleOk}
       selectedProvider={selectedProvider}
       setSelectedProvider={setSelectedProvider}
       providerModels={providerModels}
       setProviderModelsFn={(provider) => setProviderModels(getProviderModels(provider, modelCostMapData))}
       getPlaceholder={getPlaceholder}
-      uploadProps={vertexCredentialsUploadProps(form)}
+      uploadProps={vertexCredentialsUploadProps({
+        setFieldsValue: (values) => form.setValue("vertex_credentials", values.vertex_credentials),
+      })}
       showAdvancedSettings={showAdvancedSettings}
       setShowAdvancedSettings={setShowAdvancedSettings}
       teams={teams ?? null}
diff --git a/ui/litellm-dashboard/src/app/(dashboard)/models-and-endpoints/panels/LlmCredentialsPanel.tsx b/ui/litellm-dashboard/src/app/(dashboard)/models-and-endpoints/panels/LlmCredentialsPanel.tsx
index 6112e6bffbd..7251da7c3c3 100644
--- a/ui/litellm-dashboard/src/app/(dashboard)/models-and-endpoints/panels/LlmCredentialsPanel.tsx
+++ b/ui/litellm-dashboard/src/app/(dashboard)/models-and-endpoints/panels/LlmCredentialsPanel.tsx
@@ -1,10 +1,17 @@
 "use client";
 
-import { Form } from "antd";
+import { useForm } from "react-hook-form";
 import CredentialsPanel from "@/components/model_add/CredentialsPanel";
+import type { MountedFormValues } from "@/components/common_components/MountedFormField";
 import { vertexCredentialsUploadProps } from "@/app/(dashboard)/models-and-endpoints/vertexCredentialsUpload";
 
 export default function LlmCredentialsPanel() {
-  const [form] = Form.useForm();
-  return <CredentialsPanel uploadProps={vertexCredentialsUploadProps(form)} />;
+  const form = useForm<MountedFormValues>();
+  return (
+    <CredentialsPanel
+      uploadProps={vertexCredentialsUploadProps({
+        setFieldsValue: (values) => form.setValue("vertex_credentials", values.vertex_credentials),
+      })}
+    />
+  );
 }
diff --git a/ui/litellm-dashboard/src/app/(dashboard)/policies/_components/impact_popover.test.tsx b/ui/litellm-dashboard/src/app/(dashboard)/policies/_components/impact_popover.test.tsx
index 66f03577e20..69c471a7c3d 100644
--- a/ui/litellm-dashboard/src/app/(dashboard)/policies/_components/impact_popover.test.tsx
+++ b/ui/litellm-dashboard/src/app/(dashboard)/policies/_components/impact_popover.test.tsx
@@ -30,16 +30,6 @@ vi.mock("@heroicons/react/outline", () => ({
   },
 }));
 
-vi.mock("@tremor/react", async (importOriginal) => {
-  const actual = await importOriginal<typeof import("@tremor/react")>();
-  return {
-    ...actual,
-    Icon: React.forwardRef<HTMLButtonElement, LegacyIconProps>(({ icon: _icon, ...props }, ref) => (
-      <button ref={ref} type="button" {...props} />
-    )),
-  };
-});
-
 vi.mock("antd", async (importOriginal) => {
   const actual = await importOriginal<typeof import("antd")>();
   return {
diff --git a/ui/litellm-dashboard/src/app/(dashboard)/policies/_components/index.test.tsx b/ui/litellm-dashboard/src/app/(dashboard)/policies/_components/index.test.tsx
index f508f6866d6..cddc04f6d9c 100644
--- a/ui/litellm-dashboard/src/app/(dashboard)/policies/_components/index.test.tsx
+++ b/ui/litellm-dashboard/src/app/(dashboard)/policies/_components/index.test.tsx
@@ -56,33 +56,6 @@ vi.mock("./impact_popover", () => ({
   default: () => <button type="button" aria-label="View blast radius" />,
 }));
 
-vi.mock("@tremor/react", async (importOriginal) => {
-  const actual = await importOriginal<typeof import("@tremor/react")>();
-  return {
-    ...actual,
-    Button: React.forwardRef<HTMLButtonElement, any>(({ children, ...props }, ref) =>
-      React.createElement("button", { ...props, ref }, children),
-    ),
-    Tooltip: ({ children }: { children?: React.ReactNode }) => React.createElement(React.Fragment, null, children),
-    Switch: ({
-      checked,
-      onChange,
-      className,
-    }: {
-      checked?: boolean;
-      onChange?: (v: boolean) => void;
-      className?: string;
-    }) =>
-      React.createElement("input", {
-        type: "checkbox",
-        role: "switch",
-        checked,
-        onChange: (e: React.ChangeEvent<HTMLInputElement>) => onChange?.(e.target.checked),
-        className,
-      }),
-  };
-});
-
 vi.mock("./policy_templates", () => ({
   __esModule: true,
   default: () => <div data-testid="policy-templates-stub" />,
diff --git a/ui/litellm-dashboard/src/app/(dashboard)/tag-management/_components/tag_info.tsx b/ui/litellm-dashboard/src/app/(dashboard)/tag-management/_components/tag_info.tsx
index 6db19c6d090..5c561f38197 100644
--- a/ui/litellm-dashboard/src/app/(dashboard)/tag-management/_components/tag_info.tsx
+++ b/ui/litellm-dashboard/src/app/(dashboard)/tag-management/_components/tag_info.tsx
@@ -1,7 +1,8 @@
 "use client";
 
 import React, { useState, useEffect } from "react";
-import { Tooltip, Button as AntdButton } from "antd";
+import { SimpleTooltip } from "@/components/ui/tooltip";
+import { Button as AntdButton } from "antd";
 import { z } from "zod/v4";
 import { fetchUserModels } from "@/components/organisms/create_key_button";
 import { getModelDisplayName } from "@/components/key_team_helpers/fetch_available_models_team_key";
@@ -280,7 +281,9 @@ const TagInfoView: React.FC<TagInfoViewProps> = ({ tagId, onClose, accessToken,
                     ) : (
                       tagDetails.models.map((modelId) => (
                         <Badge key={modelId} variant="secondary">
-                          <Tooltip title={`ID: ${modelId}`}>{tagDetails.model_info?.[modelId] || modelId}</Tooltip>
+                          <SimpleTooltip content={`ID: ${modelId}`}>
+                            {tagDetails.model_info?.[modelId] || modelId}
+                          </SimpleTooltip>
                         </Badge>
                       ))
                     )}
diff --git a/ui/litellm-dashboard/src/app/(dashboard)/users/_components/view_users/user_info_view.tsx b/ui/litellm-dashboard/src/app/(dashboard)/users/_components/view_users/user_info_view.tsx
index a862e59d793..5ea15df13f0 100644
--- a/ui/litellm-dashboard/src/app/(dashboard)/users/_components/view_users/user_info_view.tsx
+++ b/ui/litellm-dashboard/src/app/(dashboard)/users/_components/view_users/user_info_view.tsx
@@ -17,7 +17,8 @@ import {
   teamMemberDeleteCall,
   Member,
 } from "@/components/networking";
-import { Button as AntdButton, Modal, Tooltip } from "antd";
+import { SimpleTooltip } from "@/components/ui/tooltip";
+import { Button as AntdButton, Modal } from "antd";
 import { Field, FieldGroup, FieldLabel } from "@/components/shared/form/field";
 import {
   Combobox,
@@ -747,10 +748,10 @@ export default function UserInfoView({
                 <SelectContent>
                   {MEMBER_ROLE_OPTIONS.map((option) => (
                     <SelectItem key={option.value} value={option.value} title={option.value}>
-                      <Tooltip title={option.hint}>
+                      <SimpleTooltip content={option.hint}>
                         <span className="font-medium">{option.value}</span>
                         <span className="ml-2 text-muted-foreground text-sm">- {option.hint}</span>
-                      </Tooltip>
+                      </SimpleTooltip>
                     </SelectItem>
                   ))}
                 </SelectContent>
diff --git a/ui/litellm-dashboard/src/app/globals.css b/ui/litellm-dashboard/src/app/globals.css
index dddeb576720..442adf98fa2 100644
--- a/ui/litellm-dashboard/src/app/globals.css
+++ b/ui/litellm-dashboard/src/app/globals.css
@@ -2,9 +2,6 @@
 
 @import "tailwindcss";
 @import "tw-animate-css";
-@import "./tremor-v3-compat.css" layer(utilities);
-
-@source '../../node_modules/@tremor/react';
 
 @plugin '@headlessui/tailwindcss';
 @plugin '@tailwindcss/forms';
@@ -95,6 +92,9 @@
   --accent: oklch(0.967 0.003 264.542);
   --accent-foreground: oklch(0.21 0.034 264.665);
   --destructive: oklch(0.577 0.245 27.325);
+  --success: oklch(0.527 0.154 150.069);
+  --warning: oklch(0.555 0.163 48.998);
+  --info: oklch(0.546 0.245 262.881);
   --border: oklch(0.928 0.006 264.531);
   --input: oklch(0.928 0.006 264.531);
   --ring: oklch(0.707 0.022 261.325);
@@ -130,6 +130,9 @@
   --accent: oklch(0.278 0.033 256.848);
   --accent-foreground: oklch(0.985 0.002 247.839);
   --destructive: oklch(0.704 0.191 22.216);
+  --success: oklch(0.792 0.209 151.711);
+  --warning: oklch(0.828 0.189 84.429);
+  --info: oklch(0.707 0.165 254.624);
   --border: oklch(1 0 0 / 10%);
   --input: oklch(1 0 0 / 15%);
   --ring: oklch(0.551 0.027 264.364);
@@ -168,6 +171,9 @@
   --color-accent: var(--accent);
   --color-accent-foreground: var(--accent-foreground);
   --color-destructive: var(--destructive);
+  --color-success: var(--success);
+  --color-warning: var(--warning);
+  --color-info: var(--info);
   --color-border: var(--border);
   --color-input: var(--input);
   --color-ring: var(--ring);
@@ -186,66 +192,6 @@
   --color-sidebar-ring: var(--sidebar-ring);
 }
 
-@theme {
-  --color-tremor-brand-muted: #8688ef;
-  --color-tremor-brand-subtle: #8e91eb;
-  --color-tremor-brand: #6366f1;
-  --color-tremor-brand-emphasis: #4338ca;
-  --color-tremor-brand-inverted: #ffffff;
-  --color-tremor-background-muted: #f9fafb;
-  --color-tremor-background-subtle: #f3f4f6;
-  --color-tremor-background: #ffffff;
-  --color-tremor-background-emphasis: #374151;
-  --color-tremor-border: #e5e7eb;
-  --color-tremor-ring: #e5e7eb;
-  --color-tremor-content-subtle: #9ca3af;
-  --color-tremor-content: #6b7280;
-  --color-tremor-content-emphasis: #374151;
-  --color-tremor-content-strong: #111827;
-  --color-tremor-content-inverted: #ffffff;
-
-  --color-dark-tremor-brand-faint: #0b1229;
-  --color-dark-tremor-brand-muted: #1e1b4b;
-  --color-dark-tremor-brand-subtle: #3730a3;
-  --color-dark-tremor-brand: #6366f1;
-  --color-dark-tremor-brand-emphasis: #818cf8;
-  --color-dark-tremor-brand-inverted: #1e1b4b;
-  --color-dark-tremor-background-muted: #131a2b;
-  --color-dark-tremor-background-subtle: #1f2937;
-  --color-dark-tremor-background: #111827;
-  --color-dark-tremor-background-emphasis: #d1d5db;
-  --color-dark-tremor-border: #374151;
-  --color-dark-tremor-ring: #1f2937;
-  --color-dark-tremor-content-subtle: #4b5563;
-  --color-dark-tremor-content: #6b7280;
-  --color-dark-tremor-content-emphasis: #e5e7eb;
-  --color-dark-tremor-content-strong: #f9fafb;
-  --color-dark-tremor-content-inverted: #030712;
-
-  --shadow-tremor-input: 0 1px 2px 0 rgb(0 0 0 / 0.05);
-  --shadow-tremor-card: 0 1px 3px 0 rgb(0 0 0 / 0.1), 0 1px 2px -1px rgb(0 0 0 / 0.1);
-  --shadow-tremor-dropdown: 0 4px 6px -1px rgb(0 0 0 / 0.1), 0 2px 4px -2px rgb(0 0 0 / 0.1);
-  --shadow-dark-tremor-input: 0 1px 2px 0 rgb(0 0 0 / 0.05);
-  --shadow-dark-tremor-card: 0 1px 3px 0 rgb(0 0 0 / 0.1), 0 1px 2px -1px rgb(0 0 0 / 0.1);
-  --shadow-dark-tremor-dropdown: 0 4px 6px -1px rgb(0 0 0 / 0.1), 0 2px 4px -2px rgb(0 0 0 / 0.1);
-
-  --radius-tremor-small: 0.375rem;
-  --radius-tremor-default: 0.5rem;
-  --radius-tremor-full: 9999px;
-
-  --text-tremor-label: 0.75rem;
-  --text-tremor-label--line-height: 0.3rem;
-  --text-tremor-default: 0.775rem;
-  --text-tremor-default--line-height: 1.15rem;
-  --text-tremor-title: 1.025rem;
-  --text-tremor-title--line-height: 1.65rem;
-  --text-tremor-metric: 1.675rem;
-  --text-tremor-metric--line-height: 2.15rem;
-}
-
-@source inline("{,hover:,ui-selected:}{bg,text,border}-{slate,gray,zinc,neutral,stone,red,orange,amber,yellow,lime,green,emerald,teal,cyan,sky,blue,indigo,violet,purple,fuchsia,pink,rose}-{50,{100..900..100},950}");
-@source inline("{ring,stroke,fill}-{slate,gray,zinc,neutral,stone,red,orange,amber,yellow,lime,green,emerald,teal,cyan,sky,blue,indigo,violet,purple,fuchsia,pink,rose}-{50,{100..900..100},950}");
-
 @layer base {
   *,
   ::after,
diff --git a/ui/litellm-dashboard/src/app/tremor-v3-compat.css b/ui/litellm-dashboard/src/app/tremor-v3-compat.css
deleted file mode 100644
index 0ade5e4dd88..00000000000
--- a/ui/litellm-dashboard/src/app/tremor-v3-compat.css
+++ /dev/null
@@ -1,615 +0,0 @@
-.bg-slate-500.bg-opacity-10 {
-  background-color: color-mix(in oklab, var(--color-slate-500) 10%, transparent);
-}
-
-.bg-slate-500.bg-opacity-20 {
-  background-color: color-mix(in oklab, var(--color-slate-500) 20%, transparent);
-}
-
-.bg-slate-500.bg-opacity-40 {
-  background-color: color-mix(in oklab, var(--color-slate-500) 40%, transparent);
-}
-
-.hover\:bg-slate-500.hover\:bg-opacity-20:hover {
-  background-color: color-mix(in oklab, var(--color-slate-500) 20%, transparent);
-}
-
-.group:hover .bg-slate-500.group-hover\:bg-opacity-30 {
-  background-color: color-mix(in oklab, var(--color-slate-500) 30%, transparent);
-}
-
-.ring-slate-500.ring-opacity-20 {
-  --tw-ring-color: color-mix(in oklab, var(--color-slate-500) 20%, transparent);
-}
-
-.ring-slate-300.ring-opacity-40 {
-  --tw-ring-color: color-mix(in oklab, var(--color-slate-300) 40%, transparent);
-}
-
-.bg-gray-500.bg-opacity-10 {
-  background-color: color-mix(in oklab, var(--color-gray-500) 10%, transparent);
-}
-
-.bg-gray-500.bg-opacity-20 {
-  background-color: color-mix(in oklab, var(--color-gray-500) 20%, transparent);
-}
-
-.bg-gray-500.bg-opacity-40 {
-  background-color: color-mix(in oklab, var(--color-gray-500) 40%, transparent);
-}
-
-.hover\:bg-gray-500.hover\:bg-opacity-20:hover {
-  background-color: color-mix(in oklab, var(--color-gray-500) 20%, transparent);
-}
-
-.group:hover .bg-gray-500.group-hover\:bg-opacity-30 {
-  background-color: color-mix(in oklab, var(--color-gray-500) 30%, transparent);
-}
-
-.ring-gray-500.ring-opacity-20 {
-  --tw-ring-color: color-mix(in oklab, var(--color-gray-500) 20%, transparent);
-}
-
-.ring-gray-300.ring-opacity-40 {
-  --tw-ring-color: color-mix(in oklab, var(--color-gray-300) 40%, transparent);
-}
-
-.bg-zinc-500.bg-opacity-10 {
-  background-color: color-mix(in oklab, var(--color-zinc-500) 10%, transparent);
-}
-
-.bg-zinc-500.bg-opacity-20 {
-  background-color: color-mix(in oklab, var(--color-zinc-500) 20%, transparent);
-}
-
-.bg-zinc-500.bg-opacity-40 {
-  background-color: color-mix(in oklab, var(--color-zinc-500) 40%, transparent);
-}
-
-.hover\:bg-zinc-500.hover\:bg-opacity-20:hover {
-  background-color: color-mix(in oklab, var(--color-zinc-500) 20%, transparent);
-}
-
-.group:hover .bg-zinc-500.group-hover\:bg-opacity-30 {
-  background-color: color-mix(in oklab, var(--color-zinc-500) 30%, transparent);
-}
-
-.ring-zinc-500.ring-opacity-20 {
-  --tw-ring-color: color-mix(in oklab, var(--color-zinc-500) 20%, transparent);
-}
-
-.ring-zinc-300.ring-opacity-40 {
-  --tw-ring-color: color-mix(in oklab, var(--color-zinc-300) 40%, transparent);
-}
-
-.bg-neutral-500.bg-opacity-10 {
-  background-color: color-mix(in oklab, var(--color-neutral-500) 10%, transparent);
-}
-
-.bg-neutral-500.bg-opacity-20 {
-  background-color: color-mix(in oklab, var(--color-neutral-500) 20%, transparent);
-}
-
-.bg-neutral-500.bg-opacity-40 {
-  background-color: color-mix(in oklab, var(--color-neutral-500) 40%, transparent);
-}
-
-.hover\:bg-neutral-500.hover\:bg-opacity-20:hover {
-  background-color: color-mix(in oklab, var(--color-neutral-500) 20%, transparent);
-}
-
-.group:hover .bg-neutral-500.group-hover\:bg-opacity-30 {
-  background-color: color-mix(in oklab, var(--color-neutral-500) 30%, transparent);
-}
-
-.ring-neutral-500.ring-opacity-20 {
-  --tw-ring-color: color-mix(in oklab, var(--color-neutral-500) 20%, transparent);
-}
-
-.ring-neutral-300.ring-opacity-40 {
-  --tw-ring-color: color-mix(in oklab, var(--color-neutral-300) 40%, transparent);
-}
-
-.bg-stone-500.bg-opacity-10 {
-  background-color: color-mix(in oklab, var(--color-stone-500) 10%, transparent);
-}
-
-.bg-stone-500.bg-opacity-20 {
-  background-color: color-mix(in oklab, var(--color-stone-500) 20%, transparent);
-}
-
-.bg-stone-500.bg-opacity-40 {
-  background-color: color-mix(in oklab, var(--color-stone-500) 40%, transparent);
-}
-
-.hover\:bg-stone-500.hover\:bg-opacity-20:hover {
-  background-color: color-mix(in oklab, var(--color-stone-500) 20%, transparent);
-}
-
-.group:hover .bg-stone-500.group-hover\:bg-opacity-30 {
-  background-color: color-mix(in oklab, var(--color-stone-500) 30%, transparent);
-}
-
-.ring-stone-500.ring-opacity-20 {
-  --tw-ring-color: color-mix(in oklab, var(--color-stone-500) 20%, transparent);
-}
-
-.ring-stone-300.ring-opacity-40 {
-  --tw-ring-color: color-mix(in oklab, var(--color-stone-300) 40%, transparent);
-}
-
-.bg-red-500.bg-opacity-10 {
-  background-color: color-mix(in oklab, var(--color-red-500) 10%, transparent);
-}
-
-.bg-red-500.bg-opacity-20 {
-  background-color: color-mix(in oklab, var(--color-red-500) 20%, transparent);
-}
-
-.bg-red-500.bg-opacity-40 {
-  background-color: color-mix(in oklab, var(--color-red-500) 40%, transparent);
-}
-
-.hover\:bg-red-500.hover\:bg-opacity-20:hover {
-  background-color: color-mix(in oklab, var(--color-red-500) 20%, transparent);
-}
-
-.group:hover .bg-red-500.group-hover\:bg-opacity-30 {
-  background-color: color-mix(in oklab, var(--color-red-500) 30%, transparent);
-}
-
-.ring-red-500.ring-opacity-20 {
-  --tw-ring-color: color-mix(in oklab, var(--color-red-500) 20%, transparent);
-}
-
-.ring-red-300.ring-opacity-40 {
-  --tw-ring-color: color-mix(in oklab, var(--color-red-300) 40%, transparent);
-}
-
-.bg-orange-500.bg-opacity-10 {
-  background-color: color-mix(in oklab, var(--color-orange-500) 10%, transparent);
-}
-
-.bg-orange-500.bg-opacity-20 {
-  background-color: color-mix(in oklab, var(--color-orange-500) 20%, transparent);
-}
-
-.bg-orange-500.bg-opacity-40 {
-  background-color: color-mix(in oklab, var(--color-orange-500) 40%, transparent);
-}
-
-.hover\:bg-orange-500.hover\:bg-opacity-20:hover {
-  background-color: color-mix(in oklab, var(--color-orange-500) 20%, transparent);
-}
-
-.group:hover .bg-orange-500.group-hover\:bg-opacity-30 {
-  background-color: color-mix(in oklab, var(--color-orange-500) 30%, transparent);
-}
-
-.ring-orange-500.ring-opacity-20 {
-  --tw-ring-color: color-mix(in oklab, var(--color-orange-500) 20%, transparent);
-}
-
-.ring-orange-300.ring-opacity-40 {
-  --tw-ring-color: color-mix(in oklab, var(--color-orange-300) 40%, transparent);
-}
-
-.bg-amber-500.bg-opacity-10 {
-  background-color: color-mix(in oklab, var(--color-amber-500) 10%, transparent);
-}
-
-.bg-amber-500.bg-opacity-20 {
-  background-color: color-mix(in oklab, var(--color-amber-500) 20%, transparent);
-}
-
-.bg-amber-500.bg-opacity-40 {
-  background-color: color-mix(in oklab, var(--color-amber-500) 40%, transparent);
-}
-
-.hover\:bg-amber-500.hover\:bg-opacity-20:hover {
-  background-color: color-mix(in oklab, var(--color-amber-500) 20%, transparent);
-}
-
-.group:hover .bg-amber-500.group-hover\:bg-opacity-30 {
-  background-color: color-mix(in oklab, var(--color-amber-500) 30%, transparent);
-}
-
-.ring-amber-500.ring-opacity-20 {
-  --tw-ring-color: color-mix(in oklab, var(--color-amber-500) 20%, transparent);
-}
-
-.ring-amber-300.ring-opacity-40 {
-  --tw-ring-color: color-mix(in oklab, var(--color-amber-300) 40%, transparent);
-}
-
-.bg-yellow-500.bg-opacity-10 {
-  background-color: color-mix(in oklab, var(--color-yellow-500) 10%, transparent);
-}
-
-.bg-yellow-500.bg-opacity-20 {
-  background-color: color-mix(in oklab, var(--color-yellow-500) 20%, transparent);
-}
-
-.bg-yellow-500.bg-opacity-40 {
-  background-color: color-mix(in oklab, var(--color-yellow-500) 40%, transparent);
-}
-
-.hover\:bg-yellow-500.hover\:bg-opacity-20:hover {
-  background-color: color-mix(in oklab, var(--color-yellow-500) 20%, transparent);
-}
-
-.group:hover .bg-yellow-500.group-hover\:bg-opacity-30 {
-  background-color: color-mix(in oklab, var(--color-yellow-500) 30%, transparent);
-}
-
-.ring-yellow-500.ring-opacity-20 {
-  --tw-ring-color: color-mix(in oklab, var(--color-yellow-500) 20%, transparent);
-}
-
-.ring-yellow-300.ring-opacity-40 {
-  --tw-ring-color: color-mix(in oklab, var(--color-yellow-300) 40%, transparent);
-}
-
-.bg-lime-500.bg-opacity-10 {
-  background-color: color-mix(in oklab, var(--color-lime-500) 10%, transparent);
-}
-
-.bg-lime-500.bg-opacity-20 {
-  background-color: color-mix(in oklab, var(--color-lime-500) 20%, transparent);
-}
-
-.bg-lime-500.bg-opacity-40 {
-  background-color: color-mix(in oklab, var(--color-lime-500) 40%, transparent);
-}
-
-.hover\:bg-lime-500.hover\:bg-opacity-20:hover {
-  background-color: color-mix(in oklab, var(--color-lime-500) 20%, transparent);
-}
-
-.group:hover .bg-lime-500.group-hover\:bg-opacity-30 {
-  background-color: color-mix(in oklab, var(--color-lime-500) 30%, transparent);
-}
-
-.ring-lime-500.ring-opacity-20 {
-  --tw-ring-color: color-mix(in oklab, var(--color-lime-500) 20%, transparent);
-}
-
-.ring-lime-300.ring-opacity-40 {
-  --tw-ring-color: color-mix(in oklab, var(--color-lime-300) 40%, transparent);
-}
-
-.bg-green-500.bg-opacity-10 {
-  background-color: color-mix(in oklab, var(--color-green-500) 10%, transparent);
-}
-
-.bg-green-500.bg-opacity-20 {
-  background-color: color-mix(in oklab, var(--color-green-500) 20%, transparent);
-}
-
-.bg-green-500.bg-opacity-40 {
-  background-color: color-mix(in oklab, var(--color-green-500) 40%, transparent);
-}
-
-.hover\:bg-green-500.hover\:bg-opacity-20:hover {
-  background-color: color-mix(in oklab, var(--color-green-500) 20%, transparent);
-}
-
-.group:hover .bg-green-500.group-hover\:bg-opacity-30 {
-  background-color: color-mix(in oklab, var(--color-green-500) 30%, transparent);
-}
-
-.ring-green-500.ring-opacity-20 {
-  --tw-ring-color: color-mix(in oklab, var(--color-green-500) 20%, transparent);
-}
-
-.ring-green-300.ring-opacity-40 {
-  --tw-ring-color: color-mix(in oklab, var(--color-green-300) 40%, transparent);
-}
-
-.bg-emerald-500.bg-opacity-10 {
-  background-color: color-mix(in oklab, var(--color-emerald-500) 10%, transparent);
-}
-
-.bg-emerald-500.bg-opacity-20 {
-  background-color: color-mix(in oklab, var(--color-emerald-500) 20%, transparent);
-}
-
-.bg-emerald-500.bg-opacity-40 {
-  background-color: color-mix(in oklab, var(--color-emerald-500) 40%, transparent);
-}
-
-.hover\:bg-emerald-500.hover\:bg-opacity-20:hover {
-  background-color: color-mix(in oklab, var(--color-emerald-500) 20%, transparent);
-}
-
-.group:hover .bg-emerald-500.group-hover\:bg-opacity-30 {
-  background-color: color-mix(in oklab, var(--color-emerald-500) 30%, transparent);
-}
-
-.ring-emerald-500.ring-opacity-20 {
-  --tw-ring-color: color-mix(in oklab, var(--color-emerald-500) 20%, transparent);
-}
-
-.ring-emerald-300.ring-opacity-40 {
-  --tw-ring-color: color-mix(in oklab, var(--color-emerald-300) 40%, transparent);
-}
-
-.bg-teal-500.bg-opacity-10 {
-  background-color: color-mix(in oklab, var(--color-teal-500) 10%, transparent);
-}
-
-.bg-teal-500.bg-opacity-20 {
-  background-color: color-mix(in oklab, var(--color-teal-500) 20%, transparent);
-}
-
-.bg-teal-500.bg-opacity-40 {
-  background-color: color-mix(in oklab, var(--color-teal-500) 40%, transparent);
-}
-
-.hover\:bg-teal-500.hover\:bg-opacity-20:hover {
-  background-color: color-mix(in oklab, var(--color-teal-500) 20%, transparent);
-}
-
-.group:hover .bg-teal-500.group-hover\:bg-opacity-30 {
-  background-color: color-mix(in oklab, var(--color-teal-500) 30%, transparent);
-}
-
-.ring-teal-500.ring-opacity-20 {
-  --tw-ring-color: color-mix(in oklab, var(--color-teal-500) 20%, transparent);
-}
-
-.ring-teal-300.ring-opacity-40 {
-  --tw-ring-color: color-mix(in oklab, var(--color-teal-300) 40%, transparent);
-}
-
-.bg-cyan-500.bg-opacity-10 {
-  background-color: color-mix(in oklab, var(--color-cyan-500) 10%, transparent);
-}
-
-.bg-cyan-500.bg-opacity-20 {
-  background-color: color-mix(in oklab, var(--color-cyan-500) 20%, transparent);
-}
-
-.bg-cyan-500.bg-opacity-40 {
-  background-color: color-mix(in oklab, var(--color-cyan-500) 40%, transparent);
-}
-
-.hover\:bg-cyan-500.hover\:bg-opacity-20:hover {
-  background-color: color-mix(in oklab, var(--color-cyan-500) 20%, transparent);
-}
-
-.group:hover .bg-cyan-500.group-hover\:bg-opacity-30 {
-  background-color: color-mix(in oklab, var(--color-cyan-500) 30%, transparent);
-}
-
-.ring-cyan-500.ring-opacity-20 {
-  --tw-ring-color: color-mix(in oklab, var(--color-cyan-500) 20%, transparent);
-}
-
-.ring-cyan-300.ring-opacity-40 {
-  --tw-ring-color: color-mix(in oklab, var(--color-cyan-300) 40%, transparent);
-}
-
-.bg-sky-500.bg-opacity-10 {
-  background-color: color-mix(in oklab, var(--color-sky-500) 10%, transparent);
-}
-
-.bg-sky-500.bg-opacity-20 {
-  background-color: color-mix(in oklab, var(--color-sky-500) 20%, transparent);
-}
-
-.bg-sky-500.bg-opacity-40 {
-  background-color: color-mix(in oklab, var(--color-sky-500) 40%, transparent);
-}
-
-.hover\:bg-sky-500.hover\:bg-opacity-20:hover {
-  background-color: color-mix(in oklab, var(--color-sky-500) 20%, transparent);
-}
-
-.group:hover .bg-sky-500.group-hover\:bg-opacity-30 {
-  background-color: color-mix(in oklab, var(--color-sky-500) 30%, transparent);
-}
-
-.ring-sky-500.ring-opacity-20 {
-  --tw-ring-color: color-mix(in oklab, var(--color-sky-500) 20%, transparent);
-}
-
-.ring-sky-300.ring-opacity-40 {
-  --tw-ring-color: color-mix(in oklab, var(--color-sky-300) 40%, transparent);
-}
-
-.bg-blue-500.bg-opacity-10 {
-  background-color: color-mix(in oklab, var(--color-blue-500) 10%, transparent);
-}
-
-.bg-blue-500.bg-opacity-20 {
-  background-color: color-mix(in oklab, var(--color-blue-500) 20%, transparent);
-}
-
-.bg-blue-500.bg-opacity-40 {
-  background-color: color-mix(in oklab, var(--color-blue-500) 40%, transparent);
-}
-
-.hover\:bg-blue-500.hover\:bg-opacity-20:hover {
-  background-color: color-mix(in oklab, var(--color-blue-500) 20%, transparent);
-}
-
-.group:hover .bg-blue-500.group-hover\:bg-opacity-30 {
-  background-color: color-mix(in oklab, var(--color-blue-500) 30%, transparent);
-}
-
-.ring-blue-500.ring-opacity-20 {
-  --tw-ring-color: color-mix(in oklab, var(--color-blue-500) 20%, transparent);
-}
-
-.ring-blue-300.ring-opacity-40 {
-  --tw-ring-color: color-mix(in oklab, var(--color-blue-300) 40%, transparent);
-}
-
-.bg-indigo-500.bg-opacity-10 {
-  background-color: color-mix(in oklab, var(--color-indigo-500) 10%, transparent);
-}
-
-.bg-indigo-500.bg-opacity-20 {
-  background-color: color-mix(in oklab, var(--color-indigo-500) 20%, transparent);
-}
-
-.bg-indigo-500.bg-opacity-40 {
-  background-color: color-mix(in oklab, var(--color-indigo-500) 40%, transparent);
-}
-
-.hover\:bg-indigo-500.hover\:bg-opacity-20:hover {
-  background-color: color-mix(in oklab, var(--color-indigo-500) 20%, transparent);
-}
-
-.group:hover .bg-indigo-500.group-hover\:bg-opacity-30 {
-  background-color: color-mix(in oklab, var(--color-indigo-500) 30%, transparent);
-}
-
-.ring-indigo-500.ring-opacity-20 {
-  --tw-ring-color: color-mix(in oklab, var(--color-indigo-500) 20%, transparent);
-}
-
-.ring-indigo-300.ring-opacity-40 {
-  --tw-ring-color: color-mix(in oklab, var(--color-indigo-300) 40%, transparent);
-}
-
-.bg-violet-500.bg-opacity-10 {
-  background-color: color-mix(in oklab, var(--color-violet-500) 10%, transparent);
-}
-
-.bg-violet-500.bg-opacity-20 {
-  background-color: color-mix(in oklab, var(--color-violet-500) 20%, transparent);
-}
-
-.bg-violet-500.bg-opacity-40 {
-  background-color: color-mix(in oklab, var(--color-violet-500) 40%, transparent);
-}
-
-.hover\:bg-violet-500.hover\:bg-opacity-20:hover {
-  background-color: color-mix(in oklab, var(--color-violet-500) 20%, transparent);
-}
-
-.group:hover .bg-violet-500.group-hover\:bg-opacity-30 {
-  background-color: color-mix(in oklab, var(--color-violet-500) 30%, transparent);
-}
-
-.ring-violet-500.ring-opacity-20 {
-  --tw-ring-color: color-mix(in oklab, var(--color-violet-500) 20%, transparent);
-}
-
-.ring-violet-300.ring-opacity-40 {
-  --tw-ring-color: color-mix(in oklab, var(--color-violet-300) 40%, transparent);
-}
-
-.bg-purple-500.bg-opacity-10 {
-  background-color: color-mix(in oklab, var(--color-purple-500) 10%, transparent);
-}
-
-.bg-purple-500.bg-opacity-20 {
-  background-color: color-mix(in oklab, var(--color-purple-500) 20%, transparent);
-}
-
-.bg-purple-500.bg-opacity-40 {
-  background-color: color-mix(in oklab, var(--color-purple-500) 40%, transparent);
-}
-
-.hover\:bg-purple-500.hover\:bg-opacity-20:hover {
-  background-color: color-mix(in oklab, var(--color-purple-500) 20%, transparent);
-}
-
-.group:hover .bg-purple-500.group-hover\:bg-opacity-30 {
-  background-color: color-mix(in oklab, var(--color-purple-500) 30%, transparent);
-}
-
-.ring-purple-500.ring-opacity-20 {
-  --tw-ring-color: color-mix(in oklab, var(--color-purple-500) 20%, transparent);
-}
-
-.ring-purple-300.ring-opacity-40 {
-  --tw-ring-color: color-mix(in oklab, var(--color-purple-300) 40%, transparent);
-}
-
-.bg-fuchsia-500.bg-opacity-10 {
-  background-color: color-mix(in oklab, var(--color-fuchsia-500) 10%, transparent);
-}
-
-.bg-fuchsia-500.bg-opacity-20 {
-  background-color: color-mix(in oklab, var(--color-fuchsia-500) 20%, transparent);
-}
-
-.bg-fuchsia-500.bg-opacity-40 {
-  background-color: color-mix(in oklab, var(--color-fuchsia-500) 40%, transparent);
-}
-
-.hover\:bg-fuchsia-500.hover\:bg-opacity-20:hover {
-  background-color: color-mix(in oklab, var(--color-fuchsia-500) 20%, transparent);
-}
-
-.group:hover .bg-fuchsia-500.group-hover\:bg-opacity-30 {
-  background-color: color-mix(in oklab, var(--color-fuchsia-500) 30%, transparent);
-}
-
-.ring-fuchsia-500.ring-opacity-20 {
-  --tw-ring-color: color-mix(in oklab, var(--color-fuchsia-500) 20%, transparent);
-}
-
-.ring-fuchsia-300.ring-opacity-40 {
-  --tw-ring-color: color-mix(in oklab, var(--color-fuchsia-300) 40%, transparent);
-}
-
-.bg-pink-500.bg-opacity-10 {
-  background-color: color-mix(in oklab, var(--color-pink-500) 10%, transparent);
-}
-
-.bg-pink-500.bg-opacity-20 {
-  background-color: color-mix(in oklab, var(--color-pink-500) 20%, transparent);
-}
-
-.bg-pink-500.bg-opacity-40 {
-  background-color: color-mix(in oklab, var(--color-pink-500) 40%, transparent);
-}
-
-.hover\:bg-pink-500.hover\:bg-opacity-20:hover {
-  background-color: color-mix(in oklab, var(--color-pink-500) 20%, transparent);
-}
-
-.group:hover .bg-pink-500.group-hover\:bg-opacity-30 {
-  background-color: color-mix(in oklab, var(--color-pink-500) 30%, transparent);
-}
-
-.ring-pink-500.ring-opacity-20 {
-  --tw-ring-color: color-mix(in oklab, var(--color-pink-500) 20%, transparent);
-}
-
-.ring-pink-300.ring-opacity-40 {
-  --tw-ring-color: color-mix(in oklab, var(--color-pink-300) 40%, transparent);
-}
-
-.bg-rose-500.bg-opacity-10 {
-  background-color: color-mix(in oklab, var(--color-rose-500) 10%, transparent);
-}
-
-.bg-rose-500.bg-opacity-20 {
-  background-color: color-mix(in oklab, var(--color-rose-500) 20%, transparent);
-}
-
-.bg-rose-500.bg-opacity-40 {
-  background-color: color-mix(in oklab, var(--color-rose-500) 40%, transparent);
-}
-
-.hover\:bg-rose-500.hover\:bg-opacity-20:hover {
-  background-color: color-mix(in oklab, var(--color-rose-500) 20%, transparent);
-}
-
-.group:hover .bg-rose-500.group-hover\:bg-opacity-30 {
-  background-color: color-mix(in oklab, var(--color-rose-500) 30%, transparent);
-}
-
-.ring-rose-500.ring-opacity-20 {
-  --tw-ring-color: color-mix(in oklab, var(--color-rose-500) 20%, transparent);
-}
-
-.ring-rose-300.ring-opacity-40 {
-  --tw-ring-color: color-mix(in oklab, var(--color-rose-300) 40%, transparent);
-}
diff --git a/ui/litellm-dashboard/src/components/ModelInfoEditForm.tsx b/ui/litellm-dashboard/src/components/ModelInfoEditForm.tsx
new file mode 100644
index 00000000000..fff732fe270
--- /dev/null
+++ b/ui/litellm-dashboard/src/components/ModelInfoEditForm.tsx
@@ -0,0 +1,817 @@
+"use client";
+
+import { zodResolver } from "@hookform/resolvers/zod";
+// eslint-disable-next-line no-restricted-imports -- the dashboard has no shadcn date-time picker; the PTU window fields need one
+import { DatePicker } from "antd";
+import { CircleHelp } from "lucide-react";
+import type { Dayjs } from "dayjs";
+import * as React from "react";
+import { useForm, type Resolver } from "react-hook-form";
+import { z } from "zod/v4";
+
+import { TagsInput } from "@/app/(dashboard)/guardrails/_components/content_filter/TagsInput";
+import { FormField } from "@/components/shared/form/FormField";
+import { Badge } from "@/components/ui/badge";
+import { Button } from "@/components/ui/button";
+import { Input } from "@/components/ui/input";
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from "@/components/ui/select";
+import { Switch } from "@/components/ui/switch";
+import { Textarea } from "@/components/ui/textarea";
+import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from "@/components/ui/tooltip";
+import { UiLoadingSpinner } from "@/components/ui/ui-loading-spinner";
+
+import CacheControlInjectionPoints, {
+  CACHE_CONTROL_LABEL,
+  CACHE_CONTROL_TOOLTIP,
+  type CacheControlInjectionPoint,
+} from "./add_model/cache_control_settings";
+import type { CredentialItem } from "./networking";
+import NumericalInput from "./shared/numerical_input";
+import type { Tag } from "./tag_management/types";
+import VectorStoreSelector from "./vector_store_management/VectorStoreSelector";
+import { formatPtuUtcDisplay, utcIsoToPickerValue } from "../utils/ptuDatetime";
+import { isMaskedSecret } from "../utils/maskedSecretUtils";
+import {
+  MAX_COST_PER_PTU_PER_HOUR,
+  MAX_PTU_COUNT,
+  PTU_COUNT_FIELD,
+  PTU_END_FIELD,
+  PTU_RATE_FIELD,
+  PTU_START_FIELD,
+  isFilledPtuValue,
+  isNonNegativePtuRate,
+  isPositiveWholePtuCount,
+  ptuWindowIsOrdered,
+} from "../utils/ptuValidation";
+
+interface PtuEditField {
+  name: string;
+  label: string;
+  input: "number" | "datetime";
+  placeholder?: string;
+  isCount?: boolean;
+}
+
+const PTU_EDIT_FIELDS: PtuEditField[] = [
+  { name: PTU_COUNT_FIELD, label: "PTU Count", input: "number", placeholder: "e.g. 15", isCount: true },
+  { name: PTU_RATE_FIELD, label: "Cost per PTU / Hour (USD)", input: "number", placeholder: "e.g. 2.00" },
+  { name: PTU_START_FIELD, label: "PTU Effective From (UTC)", input: "datetime" },
+  { name: PTU_END_FIELD, label: "PTU Effective To (UTC)", input: "datetime" },
+];
+
+export type TouchedPricingField = "input_cost" | "output_cost" | "cache_read_cost" | "cache_write_cost";
+
+const PRICING_FIELDS: readonly TouchedPricingField[] = [
+  "input_cost",
+  "output_cost",
+  "cache_read_cost",
+  "cache_write_cost",
+] as const;
+
+const COST_SOURCES: Record<TouchedPricingField, { param: string; info: string }> = {
+  input_cost: { param: "input_cost_per_token", info: "input_cost_per_token" },
+  output_cost: { param: "output_cost_per_token", info: "output_cost_per_token" },
+  cache_read_cost: { param: "cache_read_input_token_cost", info: "cache_read_input_token_cost" },
+  cache_write_cost: { param: "cache_creation_input_token_cost", info: "cache_creation_input_token_cost" },
+};
+
+export interface ModelEditFormValues {
+  model_name?: string;
+  litellm_model_name?: string;
+  api_base?: string;
+  custom_llm_provider?: string;
+  organization?: string;
+  tpm?: string | number | null;
+  rpm?: string | number | null;
+  max_retries?: string | number | null;
+  timeout?: string | number | null;
+  stream_timeout?: string | number | null;
+  input_cost?: string | number | null;
+  output_cost?: string | number | null;
+  cache_read_cost?: string | number | null;
+  cache_write_cost?: string | number | null;
+  ptu_count?: string | number | null;
+  cost_per_ptu_per_hour?: string | number | null;
+  ptu_effective_from?: Dayjs | null;
+  ptu_effective_to?: Dayjs | null;
+  cache_control?: boolean;
+  cache_control_injection_points?: CacheControlInjectionPoint[];
+  model_access_group?: string[];
+  guardrails?: string[];
+  vector_store_ids?: string[];
+  tags?: string[];
+  health_check_model?: string | null;
+  litellm_credential_name?: string;
+  litellm_extra_params?: string;
+  model_info?: string;
+}
+
+type ModelEditFieldName = keyof ModelEditFormValues;
+
+const scalar = z.union([z.string(), z.number(), z.null()]).optional();
+const textish = z.string().optional();
+
+const modelEditShape = {
+  model_name: textish,
+  litellm_model_name: textish,
+  api_base: textish,
+  custom_llm_provider: textish,
+  organization: textish,
+  tpm: scalar,
+  rpm: scalar,
+  max_retries: scalar,
+  timeout: scalar,
+  stream_timeout: scalar,
+  input_cost: scalar,
+  output_cost: scalar,
+  cache_read_cost: scalar,
+  cache_write_cost: scalar,
+  ptu_count: scalar,
+  cost_per_ptu_per_hour: scalar,
+  ptu_effective_from: z.custom<Dayjs | null>().nullish(),
+  ptu_effective_to: z.custom<Dayjs | null>().nullish(),
+  cache_control: z.boolean().optional(),
+  cache_control_injection_points: z.array(z.custom<CacheControlInjectionPoint>()).optional(),
+  model_access_group: z.array(z.string()).optional(),
+  guardrails: z.array(z.string()).optional(),
+  vector_store_ids: z.array(z.string()).optional(),
+  tags: z.array(z.string()).optional(),
+  health_check_model: z.string().nullish(),
+  litellm_credential_name: textish,
+  litellm_extra_params: textish,
+  model_info: textish,
+};
+
+const isJson = (value: string): boolean => {
+  try {
+    JSON.parse(value);
+    return true;
+  } catch {
+    return false;
+  }
+};
+
+const buildSchema = (ptuEnabled: boolean, isFieldTouched: (field: TouchedPricingField) => boolean) =>
+  z.object(modelEditShape).superRefine((values, ctx) => {
+    const reject = (path: ModelEditFieldName, message: string) =>
+      ctx.addIssue({ code: "custom", path: [path], message });
+
+    if (values.litellm_extra_params && !isJson(values.litellm_extra_params)) {
+      reject("litellm_extra_params", "Please enter valid JSON");
+    }
+
+    // antd validates only mounted fields, and the PTU block does not render when the flag is off.
+    if (!ptuEnabled) {
+      return;
+    }
+
+    if (!isPositiveWholePtuCount(values.ptu_count)) {
+      reject("ptu_count", `PTU Count must be a whole number between 1 and ${MAX_PTU_COUNT.toLocaleString()}`);
+    }
+    if (!isNonNegativePtuRate(values.cost_per_ptu_per_hour)) {
+      reject(
+        "cost_per_ptu_per_hour",
+        `Cost per PTU / Hour must be between 0 and ${MAX_COST_PER_PTU_PER_HOUR.toLocaleString()}`,
+      );
+    }
+    if (isFilledPtuValue(values.ptu_count) !== isFilledPtuValue(values.cost_per_ptu_per_hour)) {
+      const message = "PTU Count and Cost per PTU / Hour must be set together";
+      reject("ptu_count", message);
+      reject("cost_per_ptu_per_hour", message);
+    }
+    if (isFilledPtuValue(values.ptu_count) && !isFilledPtuValue(values.ptu_effective_from)) {
+      reject("ptu_effective_from", "PTU Effective From is required when PTU Count is set");
+    }
+    if (!ptuWindowIsOrdered(values.ptu_effective_from, values.ptu_effective_to)) {
+      const message = "PTU Effective To must be after PTU Effective From";
+      reject("ptu_effective_from", message);
+      reject("ptu_effective_to", message);
+    }
+
+    for (const field of PRICING_FIELDS) {
+      const value = values[field];
+      if (
+        isFieldTouched(field) &&
+        isFilledPtuValue(values.ptu_count) &&
+        isFilledPtuValue(value) &&
+        Number(value) !== 0
+      ) {
+        reject(field, "A PTU deployment bills by reserved capacity, so this cost must be 0 or blank");
+      }
+    }
+  });
+
+const perMillionTokens = (...rates: (number | null | undefined)[]): number | null => {
+  const rate = rates.find((candidate) => candidate != null);
+  return rate == null ? null : rate * 1_000_000;
+};
+
+export const toModelEditFormValues = (localModelData: any, isWildcardModel: boolean): ModelEditFormValues => ({
+  model_name: localModelData.model_name,
+  litellm_model_name: localModelData.litellm_model_name,
+  api_base: localModelData.litellm_params.api_base,
+  custom_llm_provider: localModelData.litellm_params.custom_llm_provider,
+  organization: localModelData.litellm_params.organization,
+  tpm: localModelData.litellm_params.tpm,
+  rpm: localModelData.litellm_params.rpm,
+  max_retries: localModelData.litellm_params.max_retries,
+  timeout: localModelData.litellm_params.timeout,
+  stream_timeout: localModelData.litellm_params.stream_timeout,
+  input_cost: perMillionTokens(
+    localModelData.litellm_params.input_cost_per_token,
+    localModelData.model_info?.input_cost_per_token,
+  ),
+  output_cost: perMillionTokens(
+    localModelData.litellm_params?.output_cost_per_token,
+    localModelData.model_info?.output_cost_per_token,
+  ),
+  ptu_count: localModelData.model_info?.ptu_count ?? null,
+  cost_per_ptu_per_hour: localModelData.model_info?.cost_per_ptu_per_hour ?? null,
+  ptu_effective_from: utcIsoToPickerValue(localModelData.model_info?.ptu_effective_from),
+  ptu_effective_to: utcIsoToPickerValue(localModelData.model_info?.ptu_effective_to),
+  cache_read_cost: perMillionTokens(
+    localModelData.litellm_params?.cache_read_input_token_cost,
+    localModelData.model_info?.cache_read_input_token_cost,
+  ),
+  cache_write_cost: perMillionTokens(
+    localModelData.litellm_params?.cache_creation_input_token_cost,
+    localModelData.model_info?.cache_creation_input_token_cost,
+  ),
+  cache_control: localModelData.litellm_params?.cache_control_injection_points ? true : false,
+  cache_control_injection_points: localModelData.litellm_params?.cache_control_injection_points || [],
+  model_access_group: Array.isArray(localModelData.model_info?.access_groups)
+    ? localModelData.model_info.access_groups
+    : [],
+  guardrails: Array.isArray(localModelData.litellm_params?.guardrails) ? localModelData.litellm_params.guardrails : [],
+  vector_store_ids:
+    Array.isArray(localModelData.litellm_params?.vector_store_ids) &&
+    localModelData.litellm_params.vector_store_ids.length > 0
+      ? localModelData.litellm_params.vector_store_ids
+      : undefined,
+  tags: Array.isArray(localModelData.litellm_params?.tags) ? localModelData.litellm_params.tags : [],
+  // antd never mounted this field for a non-wildcard model, so the key must be absent, not null.
+  ...(isWildcardModel ? { health_check_model: localModelData.model_info?.health_check_model } : {}),
+  litellm_credential_name: localModelData.litellm_params?.litellm_credential_name || "",
+  litellm_extra_params: JSON.stringify(
+    Object.fromEntries(
+      Object.entries(localModelData.litellm_params || {}).filter(
+        ([key, value]) => key !== "litellm_credential_name" && !isMaskedSecret(value),
+      ),
+    ),
+    null,
+    2,
+  ),
+});
+
+const displayCost = (localModelData: any, field: TouchedPricingField): string => {
+  const { param, info } = COST_SOURCES[field];
+  const rate = localModelData?.litellm_params?.[param] ?? localModelData?.model_info?.[info];
+  return rate != null ? (Number(rate) * 1_000_000).toFixed(4) : "Not Set";
+};
+
+interface ModelInfoEditFormProps {
+  localModelData: any;
+  modelData: { model_info: { team_id?: string | null } & Record<string, unknown> };
+  accessToken: string | null;
+  isEditing: boolean;
+  isSaving: boolean;
+  isWildcardModel: boolean;
+  ptuCostAttributionEnabled: boolean;
+  showCacheControl: boolean;
+  setShowCacheControl: (checked: boolean) => void;
+  onCancel: () => void;
+  onSubmit: (values: ModelEditFormValues, isFieldTouched: (field: TouchedPricingField) => boolean) => Promise<void>;
+  modelAccessGroups: string[] | null;
+  guardrailsList: string[];
+  tagsList: Record<string, Tag>;
+  credentialsList: CredentialItem[];
+  healthCheckModelOptions: { value: string; label: string }[];
+}
+
+const Display: React.FC<{ children: React.ReactNode }> = ({ children }) => (
+  <div className="mt-1 rounded-sm bg-muted p-2">{children}</div>
+);
+
+const FieldLabel: React.FC<{ children: React.ReactNode }> = ({ children }) => (
+  <p className="text-sm font-medium text-foreground">{children}</p>
+);
+
+const Hint: React.FC<{ text: string }> = ({ text }) => (
+  <Tooltip>
+    <TooltipTrigger
+      render={<CircleHelp className="ml-1 inline size-3.5 shrink-0 cursor-help text-muted-foreground" />}
+    />
+    <TooltipContent className="max-w-xs">{text}</TooltipContent>
+  </Tooltip>
+);
+
+const DocsHint: React.FC<{ text: string; href: string }> = ({ text, href }) => (
+  <a href={href} target="_blank" rel="noopener noreferrer" onClick={(event) => event.stopPropagation()}>
+    <Hint text={text} />
+  </a>
+);
+
+const ChipList: React.FC<{ values: unknown; emptyLabel: string }> = ({ values, emptyLabel }) => {
+  if (!values) {
+    return <>Not Set</>;
+  }
+  if (!Array.isArray(values)) {
+    return <>{String(values)}</>;
+  }
+  if (values.length === 0) {
+    return <>{emptyLabel}</>;
+  }
+  return (
+    <div className="flex flex-wrap gap-1">
+      {values.map((entry: string, index: number) => (
+        <Badge key={index} variant="secondary">
+          {entry}
+        </Badge>
+      ))}
+    </div>
+  );
+};
+
+const ModelInfoEditForm: React.FC<ModelInfoEditFormProps> = ({
+  localModelData,
+  modelData,
+  accessToken,
+  isEditing,
+  isSaving,
+  isWildcardModel,
+  ptuCostAttributionEnabled,
+  showCacheControl,
+  setShowCacheControl,
+  onCancel,
+  onSubmit,
+  modelAccessGroups,
+  guardrailsList,
+  tagsList,
+  credentialsList,
+  healthCheckModelOptions,
+}) => {
+  // Neither RHF's blur-based touchedFields nor its resettable dirtyFields matches antd's touched-on-change.
+  const touchedRef = React.useRef<ReadonlySet<string>>(new Set<string>());
+  const isFieldTouched = React.useCallback((field: TouchedPricingField) => touchedRef.current.has(field), []);
+  const markTouched = (field: string) => {
+    touchedRef.current = new Set([...touchedRef.current, field]);
+  };
+
+  // react-hook-form refreshes control._options every render, so this rebuild is what the next submit runs.
+  const resolver: Resolver<ModelEditFormValues> = (values, context, options) =>
+    zodResolver(buildSchema(ptuCostAttributionEnabled, isFieldTouched))(values, context, options);
+
+  const form = useForm<ModelEditFormValues>({
+    resolver,
+    defaultValues: toModelEditFormValues(localModelData, isWildcardModel),
+  });
+
+  const submit = (event: React.FormEvent<HTMLFormElement>) =>
+    form.handleSubmit(async (values) => {
+      await onSubmit(values, isFieldTouched);
+    })(event);
+
+  const cancel = () => {
+    form.reset(toModelEditFormValues(localModelData, isWildcardModel));
+    touchedRef.current = new Set<string>();
+    onCancel();
+  };
+
+  const textField = (name: ModelEditFieldName, label: string, placeholder: string, stored: unknown) => (
+    <div>
+      <FieldLabel>{label}</FieldLabel>
+      {isEditing ? (
+        <FormField control={form.control} name={name}>
+          {({ value, ...control }) => <Input {...control} value={(value as string) ?? ""} placeholder={placeholder} />}
+        </FormField>
+      ) : (
+        <Display>{(stored as string) || "Not Set"}</Display>
+      )}
+    </div>
+  );
+
+  const numberField = (name: ModelEditFieldName, label: string, placeholder: string, stored: unknown) => (
+    <div>
+      <FieldLabel>{label}</FieldLabel>
+      {isEditing ? (
+        <FormField control={form.control} name={name}>
+          {({ value, ...control }) => <NumericalInput {...control} value={value ?? ""} placeholder={placeholder} />}
+        </FormField>
+      ) : (
+        <Display>{(stored as string) || "Not Set"}</Display>
+      )}
+    </div>
+  );
+
+  const pricingField = (name: TouchedPricingField, label: string, placeholder: string, description?: string) =>
+    isEditing ? (
+      <FormField control={form.control} name={name} label={label} description={description}>
+        {({ value, onChange, ...control }) => (
+          <NumericalInput
+            {...control}
+            value={value ?? ""}
+            placeholder={placeholder}
+            onChange={(event: React.ChangeEvent<HTMLInputElement>) => {
+              markTouched(name);
+              onChange(event);
+            }}
+          />
+        )}
+      </FormField>
+    ) : (
+      <div>
+        <FieldLabel>{label}</FieldLabel>
+        <Display>{displayCost(localModelData, name)}</Display>
+      </div>
+    );
+
+  const tagsField = (
+    name: "model_access_group" | "guardrails" | "tags",
+    options: { value: string; label: string }[],
+    placeholder: string,
+  ) => (
+    <FormField control={form.control} name={name}>
+      {({ id, value, onChange }) => (
+        <TagsInput
+          id={id}
+          value={(value as string[]) ?? []}
+          onValueChange={onChange}
+          options={options}
+          placeholder={placeholder}
+          tokenSeparators={[","]}
+        />
+      )}
+    </FormField>
+  );
+
+  return (
+    <TooltipProvider>
+      <form onSubmit={submit}>
+        <div className="space-y-4">
+          <div className="space-y-4">
+            {textField("model_name", "Model Name", "Enter model name", localModelData.model_name)}
+            {textField(
+              "litellm_model_name",
+              "LiteLLM Model Name",
+              "Enter LiteLLM model name",
+              localModelData.litellm_model_name,
+            )}
+
+            {pricingField("input_cost", "Input Cost (per 1M tokens)", "Enter input cost")}
+            {pricingField("output_cost", "Output Cost (per 1M tokens)", "Enter output cost")}
+
+            {ptuCostAttributionEnabled &&
+              PTU_EDIT_FIELDS.map((ptuField) => (
+                <div key={ptuField.name}>
+                  <FieldLabel>{ptuField.label}</FieldLabel>
+                  {isEditing ? (
+                    <FormField control={form.control} name={ptuField.name as ModelEditFieldName}>
+                      {({ value, onChange, ...control }) =>
+                        ptuField.input === "number" ? (
+                          <NumericalInput
+                            {...control}
+                            onChange={onChange}
+                            value={value ?? ""}
+                            placeholder={ptuField.placeholder}
+                            step={ptuField.isCount ? 1 : undefined}
+                            min={ptuField.isCount ? 1 : 0}
+                          />
+                        ) : (
+                          <DatePicker
+                            showTime
+                            style={{ width: "100%" }}
+                            value={(value as Dayjs | null) ?? null}
+                            onChange={onChange}
+                          />
+                        )
+                      }
+                    </FormField>
+                  ) : (
+                    <Display>
+                      {(ptuField.input === "datetime"
+                        ? formatPtuUtcDisplay(localModelData?.model_info?.[ptuField.name])
+                        : localModelData?.model_info?.[ptuField.name]) ?? "Not Set"}
+                    </Display>
+                  )}
+                </div>
+              ))}
+
+            {pricingField(
+              "cache_read_cost",
+              "Cache Read Cost (per 1M tokens)",
+              "Defaults to Input Cost if blank",
+              "If left blank on save, defaults to Input Cost.",
+            )}
+            {pricingField(
+              "cache_write_cost",
+              "Cache Write Cost (per 1M tokens)",
+              "Defaults to Input Cost if blank",
+              "If left blank on save, defaults to Input Cost (backend falls back to input_cost_per_token).",
+            )}
+
+            {textField("api_base", "API Base", "Enter API base", localModelData.litellm_params?.api_base)}
+            {textField(
+              "custom_llm_provider",
+              "Custom LLM Provider",
+              "Enter custom LLM provider",
+              localModelData.litellm_params?.custom_llm_provider,
+            )}
+            {textField(
+              "organization",
+              "Organization",
+              "Enter organization",
+              localModelData.litellm_params?.organization,
+            )}
+
+            {numberField("tpm", "TPM (Tokens per Minute)", "Enter TPM", localModelData.litellm_params?.tpm)}
+            {numberField("rpm", "RPM (Requests per Minute)", "Enter RPM", localModelData.litellm_params?.rpm)}
+            {numberField("max_retries", "Max Retries", "Enter max retries", localModelData.litellm_params?.max_retries)}
+            {numberField("timeout", "Timeout (seconds)", "Enter timeout", localModelData.litellm_params?.timeout)}
+            {numberField(
+              "stream_timeout",
+              "Stream Timeout (seconds)",
+              "Enter stream timeout",
+              localModelData.litellm_params?.stream_timeout,
+            )}
+
+            <div>
+              <FieldLabel>Model Access Groups</FieldLabel>
+              {isEditing ? (
+                tagsField(
+                  "model_access_group",
+                  (modelAccessGroups ?? []).map((group) => ({ value: group, label: group })),
+                  "Select existing groups or type to create new ones",
+                )
+              ) : (
+                <Display>
+                  <ChipList values={localModelData.model_info?.access_groups} emptyLabel="No groups assigned" />
+                </Display>
+              )}
+            </div>
+
+            <div>
+              <FieldLabel>
+                Guardrails
+                <DocsHint
+                  text="Apply safety guardrails to this model to filter content or enforce policies"
+                  href="https://docs.litellm.ai/docs/proxy/guardrails/quick_start"
+                />
+              </FieldLabel>
+              {isEditing ? (
+                tagsField(
+                  "guardrails",
+                  guardrailsList.map((name) => ({ value: name, label: name })),
+                  "Select existing guardrails or type to create new ones",
+                )
+              ) : (
+                <Display>
+                  <ChipList values={localModelData.litellm_params?.guardrails} emptyLabel="No guardrails assigned" />
+                </Display>
+              )}
+            </div>
+
+            <div>
+              <FieldLabel>
+                Attached Knowledge Bases (RAG)
+                <DocsHint
+                  text="Vector stores used for RAG. Every request to this model will automatically retrieve context from these knowledge bases."
+                  href="https://docs.litellm.ai/docs/completion/knowledgebase"
+                />
+              </FieldLabel>
+              {isEditing ? (
+                <FormField control={form.control} name="vector_store_ids">
+                  {({ value, onChange }) => (
+                    <VectorStoreSelector
+                      value={value as string[] | undefined}
+                      onChange={onChange}
+                      accessToken={accessToken || ""}
+                      placeholder="Select knowledge bases (optional)"
+                    />
+                  )}
+                </FormField>
+              ) : (
+                <Display>
+                  <ChipList
+                    values={localModelData.litellm_params?.vector_store_ids}
+                    emptyLabel="No knowledge bases attached"
+                  />
+                </Display>
+              )}
+            </div>
+
+            <div>
+              <FieldLabel>Tags</FieldLabel>
+              {isEditing ? (
+                tagsField(
+                  "tags",
+                  Object.values(tagsList).map((tag: Tag) => ({ value: tag.name, label: tag.name })),
+                  "Select existing tags or type to create new ones",
+                )
+              ) : (
+                <Display>
+                  <ChipList values={localModelData.litellm_params?.tags} emptyLabel="No tags assigned" />
+                </Display>
+              )}
+            </div>
+
+            <div>
+              <FieldLabel>Existing Credentials</FieldLabel>
+              {isEditing ? (
+                <FormField control={form.control} name="litellm_credential_name">
+                  {({ id, value, onChange, onBlur }) => {
+                    const items = [
+                      { value: "", label: "None" },
+                      ...credentialsList.map((credential) => ({
+                        value: credential.credential_name,
+                        label: credential.credential_name,
+                      })),
+                    ];
+                    return (
+                      <Select
+                        items={items}
+                        value={(value as string) ?? ""}
+                        onValueChange={(selected: string | null) => onChange(selected ?? "")}
+                      >
+                        <SelectTrigger id={id} className="w-full" onBlur={onBlur}>
+                          <SelectValue placeholder="Select or search for existing credentials" />
+                        </SelectTrigger>
+                        <SelectContent>
+                          {items.map((item) => (
+                            <SelectItem key={item.value} value={item.value}>
+                              {item.label}
+                            </SelectItem>
+                          ))}
+                        </SelectContent>
+                      </Select>
+                    );
+                  }}
+                </FormField>
+              ) : (
+                <Display>{localModelData.litellm_params?.litellm_credential_name || "Manual"}</Display>
+              )}
+            </div>
+
+            {isWildcardModel && (
+              <div>
+                <FieldLabel>Health Check Model</FieldLabel>
+                {isEditing ? (
+                  <FormField control={form.control} name="health_check_model">
+                    {({ id, value, onChange, onBlur }) => (
+                      <Select
+                        items={healthCheckModelOptions}
+                        value={(value as string | null) ?? null}
+                        onValueChange={onChange}
+                      >
+                        <SelectTrigger id={id} className="w-full" onBlur={onBlur}>
+                          <SelectValue placeholder="Select existing health check model" />
+                        </SelectTrigger>
+                        <SelectContent>
+                          <SelectItem value={null}>None</SelectItem>
+                          {healthCheckModelOptions.map((option) => (
+                            <SelectItem key={option.value} value={option.value}>
+                              {option.label}
+                            </SelectItem>
+                          ))}
+                        </SelectContent>
+                      </Select>
+                    )}
+                  </FormField>
+                ) : (
+                  <Display>{localModelData.model_info?.health_check_model || "Not Set"}</Display>
+                )}
+              </div>
+            )}
+
+            {isEditing ? (
+              <>
+                <FormField
+                  control={form.control}
+                  name="cache_control"
+                  label={
+                    <>
+                      {CACHE_CONTROL_LABEL}
+                      <Hint text={CACHE_CONTROL_TOOLTIP} />
+                    </>
+                  }
+                  orientation="horizontal"
+                >
+                  {({ id, value, onChange, onBlur }) => (
+                    <Switch
+                      id={id}
+                      onBlur={onBlur}
+                      checked={Boolean(value)}
+                      onCheckedChange={(checked: boolean) => {
+                        onChange(checked);
+                        setShowCacheControl(checked);
+                      }}
+                    />
+                  )}
+                </FormField>
+                {showCacheControl && (
+                  <FormField control={form.control} name="cache_control_injection_points">
+                    {({ value, onChange }) => (
+                      <CacheControlInjectionPoints
+                        value={(value as CacheControlInjectionPoint[]) ?? []}
+                        onChange={onChange}
+                      />
+                    )}
+                  </FormField>
+                )}
+              </>
+            ) : (
+              <div>
+                <FieldLabel>Cache Control</FieldLabel>
+                <Display>
+                  {localModelData.litellm_params?.cache_control_injection_points ? (
+                    <div>
+                      <p>Enabled</p>
+                      <div className="mt-2">
+                        {localModelData.litellm_params.cache_control_injection_points.map((point: any, i: number) => (
+                          <div key={i} className="mb-1 text-sm text-muted-foreground">
+                            Location: {point.location},{point.role && <span> Role: {point.role}</span>}
+                            {point.index !== undefined && <span> Index: {point.index}</span>}
+                          </div>
+                        ))}
+                      </div>
+                    </div>
+                  ) : (
+                    "Disabled"
+                  )}
+                </Display>
+              </div>
+            )}
+
+            <div>
+              <FieldLabel>Model Info</FieldLabel>
+              {isEditing ? (
+                <FormField control={form.control} name="model_info">
+                  {({ value, ...control }) => (
+                    <Textarea
+                      {...control}
+                      rows={4}
+                      placeholder={'{"gpt-4": 100, "claude-v1": 200}'}
+                      defaultValue={JSON.stringify(modelData.model_info, null, 2)}
+                    />
+                  )}
+                </FormField>
+              ) : (
+                <Display>
+                  <pre className="mt-1 overflow-auto rounded-sm bg-muted p-2 text-xs">
+                    {JSON.stringify(localModelData.model_info, null, 2)}
+                  </pre>
+                </Display>
+              )}
+            </div>
+
+            <div>
+              <FieldLabel>
+                LiteLLM Params
+                <DocsHint
+                  text="Optional litellm params used for making a litellm.completion() call. Some params are automatically added by LiteLLM."
+                  href="https://docs.litellm.ai/docs/completion/input"
+                />
+              </FieldLabel>
+              {isEditing ? (
+                <FormField control={form.control} name="litellm_extra_params">
+                  {({ value, ...control }) => (
+                    <Textarea
+                      {...control}
+                      value={(value as string) ?? ""}
+                      rows={4}
+                      placeholder={'{\n  "rpm": 100,\n  "timeout": 0,\n  "stream_timeout": 0\n}'}
+                    />
+                  )}
+                </FormField>
+              ) : (
+                <Display>
+                  <pre className="mt-1 overflow-auto rounded-sm bg-muted p-2 text-xs">
+                    {JSON.stringify(localModelData.litellm_params, null, 2)}
+                  </pre>
+                </Display>
+              )}
+            </div>
+
+            <div>
+              <FieldLabel>Team ID</FieldLabel>
+              <Display>{modelData.model_info.team_id || "Not Set"}</Display>
+            </div>
+          </div>
+
+          {isEditing && (
+            <div className="mt-6 flex justify-end gap-2">
+              <Button type="submit" variant="secondary" onClick={cancel} disabled={isSaving}>
+                Cancel
+              </Button>
+              <Button type="submit" disabled={isSaving} aria-busy={isSaving}>
+                {isSaving && <UiLoadingSpinner className="size-4" />}
+                Save Changes
+              </Button>
+            </div>
+          )}
+        </div>
+      </form>
+    </TooltipProvider>
+  );
+};
+
+export default ModelInfoEditForm;
diff --git a/ui/litellm-dashboard/src/components/ModelSelect/ModelSelect.tsx b/ui/litellm-dashboard/src/components/ModelSelect/ModelSelect.tsx
index d3ede5f4318..c3936cc456d 100644
--- a/ui/litellm-dashboard/src/components/ModelSelect/ModelSelect.tsx
+++ b/ui/litellm-dashboard/src/components/ModelSelect/ModelSelect.tsx
@@ -40,6 +40,7 @@ export const MODEL_SENTINEL_OPTIONS = [
 const MAX_VISIBLE_MODEL_CHIPS = 5;
 
 export interface ModelSelectProps {
+  id?: string;
   teamID?: string;
   organizationID?: string;
   options?: {
@@ -122,7 +123,7 @@ const filterModels = (
 
 export const ModelSelect = (props: ModelSelectProps) => {
   const anchor = useComboboxAnchor();
-  const { teamID, organizationID, options, context, dataTestId, value = [], onChange, style } = props;
+  const { id, teamID, organizationID, options, context, dataTestId, value = [], onChange, style } = props;
   const { showAllProxyModelsOverride, includeSpecialOptions } = options || {};
   const { data: allProxyModels, isLoading: isLoadingAllProxyModels } = useAllProxyModels();
   const { data: team, isLoading: isLoadingTeam } = useTeam(teamID);
@@ -256,7 +257,7 @@ export const ModelSelect = (props: ModelSelectProps) => {
               </>
             )}
           </ComboboxValue>
-          <ComboboxChipsInput placeholder="Select Models" aria-label="Select Models" className="min-w-24" />
+          <ComboboxChipsInput id={id} placeholder="Select Models" aria-label="Select Models" className="min-w-24" />
         </ComboboxChips>
         <ComboboxContent anchor={anchor}>
           <ComboboxEmpty>No models found</ComboboxEmpty>
diff --git a/ui/litellm-dashboard/src/components/Settings/RouterSettings/Fallbacks/FallbackGroupConfig.tsx b/ui/litellm-dashboard/src/components/Settings/RouterSettings/Fallbacks/FallbackGroupConfig.tsx
index 381818a53f5..e3a36f4fbf2 100644
--- a/ui/litellm-dashboard/src/components/Settings/RouterSettings/Fallbacks/FallbackGroupConfig.tsx
+++ b/ui/litellm-dashboard/src/components/Settings/RouterSettings/Fallbacks/FallbackGroupConfig.tsx
@@ -3,7 +3,8 @@
  * Handles primary model selection and fallback chain configuration
  */
 
-import { Select, Tooltip } from "antd";
+import { SimpleTooltip } from "@/components/ui/tooltip";
+import { Select } from "antd";
 import { AlertCircle, ArrowDown, X } from "lucide-react";
 import React from "react";
 
@@ -142,12 +143,9 @@ export function FallbackGroupConfig({
               }}
               maxTagCount="responsive"
               maxTagPlaceholder={(omittedValues) => (
-                <Tooltip
-                  styles={{ root: { pointerEvents: "none" } }}
-                  title={omittedValues.map(({ value }) => value).join(", ")}
-                >
+                <SimpleTooltip content={omittedValues.map(({ value }) => value).join(", ")}>
                   <span>+{omittedValues.length} more</span>
-                </Tooltip>
+                </SimpleTooltip>
               )}
               showSearch
               filterOption={(input, option) => (option?.label ?? "").toLowerCase().includes(input.toLowerCase())}
diff --git a/ui/litellm-dashboard/src/components/Teams.test.tsx b/ui/litellm-dashboard/src/components/Teams.test.tsx
index 0ef4357e73f..d0d41837dce 100644
--- a/ui/litellm-dashboard/src/components/Teams.test.tsx
+++ b/ui/litellm-dashboard/src/components/Teams.test.tsx
@@ -1223,3 +1223,261 @@ describe("Teams - which fields reach the create payload depends on the open sect
     expect(payload.team_id).toBe("tid-kept");
   });
 });
+
+describe("Teams - the exact bytes the create call sends", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    can.mockReturnValue(true);
+    vi.mocked(fetchAvailableModelsForTeamOrKey).mockResolvedValue(["gpt-4"]);
+    vi.mocked(fetchMCPAccessGroups).mockResolvedValue([]);
+    vi.mocked(getGuardrailsList).mockResolvedValue({ guardrails: [] });
+    vi.mocked(getPoliciesList).mockResolvedValue({ policies: [] });
+    vi.mocked(getDefaultTeamSettings).mockResolvedValue({ values: {} });
+    vi.mocked(teamCreateCall).mockResolvedValue({ team_id: "new-team-1" });
+    vi.mocked(useTeamMetadataSchema).mockReturnValue({ data: [], isLoading: false } as any);
+    mockUseOrganizations.mockReturnValue({ data: null });
+  });
+
+  const openCreateModal = async (options?: { premiumUser?: boolean }) => {
+    renderWithQueryClient(
+      <Teams accessToken="test-token" userID="user-123" userRole="Admin" premiumUser={options?.premiumUser ?? false} />,
+    );
+    act(() => {
+      fireEvent.click(screen.getAllByRole("button", { name: /create team/i })[0]);
+    });
+    await waitFor(() => {
+      expect(screen.getByLabelText(/team name/i)).toBeInTheDocument();
+    });
+    fireEvent.change(screen.getByLabelText(/team name/i), { target: { value: "Byte Contract Team" } });
+  };
+
+  const submit = async () => {
+    const buttons = screen.getAllByRole("button", { name: /create team/i });
+    fireEvent.click(buttons[buttons.length - 1]);
+    await waitFor(() => {
+      expect(teamCreateCall).toHaveBeenCalled();
+    });
+    return vi.mocked(teamCreateCall).mock.calls[0][1] as Record<string, unknown>;
+  };
+
+  const wireBody = (payload: Record<string, unknown>) => JSON.parse(JSON.stringify(payload)) as Record<string, unknown>;
+
+  const openSection = async (title: string, mountedProbe: RegExp | string) => {
+    fireEvent.click(screen.getByText(title));
+    await waitFor(() => {
+      expect(screen.getAllByText(mountedProbe).length).toBeGreaterThan(0);
+    });
+  };
+
+  it("sends three keys and nothing else when every section is left closed", async () => {
+    await openCreateModal();
+
+    const payload = await submit();
+
+    expect(payload).toStrictEqual({
+      team_alias: "Byte Contract Team",
+      organization_id: null,
+      models: ["no-default-models"],
+      max_budget: undefined,
+      budget_duration: undefined,
+      tpm_limit: undefined,
+      rpm_limit: undefined,
+      metadata: undefined,
+    });
+    expect(wireBody(payload)).toStrictEqual({
+      team_alias: "Byte Contract Team",
+      organization_id: null,
+      models: ["no-default-models"],
+    });
+  });
+
+  it("keeps every newly mounted but untouched field out of the request body", async () => {
+    await openCreateModal();
+
+    await openSection("Additional Settings", /Team Member Key Duration/);
+    await openSection("MCP Settings", /Allowed MCP Servers/);
+    await openSection("Agent Settings", /Allowed Agents/);
+    await openSection("Search Tool Settings", /Allowed Search Tools/);
+
+    const payload = await submit();
+
+    expect(payload).toStrictEqual({
+      team_alias: "Byte Contract Team",
+      organization_id: null,
+      models: ["no-default-models"],
+      max_budget: undefined,
+      budget_duration: undefined,
+      tpm_limit: undefined,
+      rpm_limit: undefined,
+      metadata: undefined,
+      team_id: undefined,
+      team_member_budget: undefined,
+      team_member_key_duration: undefined,
+      team_member_rpm_limit: undefined,
+      team_member_tpm_limit: undefined,
+      secret_manager_settings: undefined,
+      guardrails: undefined,
+      disable_global_guardrails: undefined,
+      policies: undefined,
+      access_group_ids: undefined,
+      allowed_vector_store_ids: undefined,
+      allowed_passthrough_routes: undefined,
+      allowed_mcp_servers_and_groups: undefined,
+      mcp_tool_permissions: {},
+      allowed_agents_and_groups: undefined,
+      object_permission_search_tools: undefined,
+    });
+    expect(wireBody(payload)).toStrictEqual({
+      team_alias: "Byte Contract Team",
+      organization_id: null,
+      models: ["no-default-models"],
+      mcp_tool_permissions: {},
+    });
+  });
+
+  it.each([
+    ["MCP Settings", /Allowed MCP Servers/, ["allowed_mcp_servers_and_groups", "mcp_tool_permissions"]],
+    ["Agent Settings", /Allowed Agents/, ["allowed_agents_and_groups"]],
+    ["Search Tool Settings", /Allowed Search Tools/, ["object_permission_search_tools"]],
+  ])("registers %s fields only while that one section is open", async (title, probe, keys) => {
+    await openCreateModal();
+
+    const closedPayload = await submit();
+    for (const key of keys as string[]) {
+      expect(closedPayload).not.toHaveProperty(key);
+    }
+  });
+
+  it("carries every typed value to the payload at the type antd sends today", async () => {
+    await openCreateModal();
+
+    fireEvent.change(screen.getByLabelText("Max Budget (USD)"), { target: { value: "150.75" } });
+    fireEvent.change(screen.getByLabelText("Tokens per minute Limit (TPM)"), { target: { value: "900" } });
+    fireEvent.change(screen.getByLabelText("Requests per minute Limit (RPM)"), { target: { value: "800" } });
+
+    await openSection("Additional Settings", /Team Member Key Duration/);
+
+    fireEvent.change(screen.getByLabelText("Team ID"), { target: { value: "tid-1" } });
+    fireEvent.change(screen.getByLabelText("Team Member Budget (USD)"), { target: { value: "12.5" } });
+    fireEvent.change(screen.getByLabelText(/Team Member Key Duration/), { target: { value: "30d" } });
+    fireEvent.change(screen.getByLabelText("Team Member RPM Limit"), { target: { value: "7" } });
+    fireEvent.change(screen.getByLabelText("Team Member TPM Limit"), { target: { value: "8" } });
+    fireEvent.change(screen.getByLabelText("Secret Manager Settings"), {
+      target: { value: '{"namespace":"admin"}' },
+    });
+
+    const payload = await submit();
+
+    expect(payload.max_budget).toBe("150.75");
+    expect(payload.tpm_limit).toBe("900");
+    expect(payload.rpm_limit).toBe("800");
+    expect(payload.team_id).toBe("tid-1");
+    expect(payload.team_member_budget).toBe(12.5);
+    expect(payload.team_member_key_duration).toBe("30d");
+    expect(payload.team_member_rpm_limit).toBe("7");
+    expect(payload.team_member_tpm_limit).toBe("8");
+    expect(payload.secret_manager_settings).toStrictEqual({ namespace: "admin" });
+  });
+
+  it("blocks the create on an invalid secret manager config, with the rule message suppressed by help", async () => {
+    await openCreateModal();
+    await openSection("Additional Settings", /Team Member Key Duration/);
+
+    fireEvent.change(screen.getByLabelText("Secret Manager Settings"), { target: { value: "   " } });
+
+    const buttons = screen.getAllByRole("button", { name: /create team/i });
+    fireEvent.click(buttons[buttons.length - 1]);
+
+    await waitFor(() => {
+      expect(screen.getByLabelText("Secret Manager Settings")).toHaveAttribute("aria-invalid", "true");
+    });
+    expect(teamCreateCall).not.toHaveBeenCalled();
+    expect(screen.queryByText("Please enter valid JSON")).not.toBeInTheDocument();
+  });
+
+  it("turns the disable-global-guardrails switch into a boolean for a premium user", async () => {
+    await openCreateModal({ premiumUser: true });
+    await openSection("Additional Settings", /Team Member Key Duration/);
+
+    const switches = screen.getAllByRole("switch");
+    fireEvent.click(switches[switches.length - 1]);
+
+    const payload = await submit();
+
+    expect(payload.disable_global_guardrails).toBe(true);
+  });
+
+  it("leaves the disable-global-guardrails switch inert for a non-premium user", async () => {
+    await openCreateModal();
+    await openSection("Additional Settings", /Team Member Key Duration/);
+
+    const switches = screen.getAllByRole("switch");
+    fireEvent.click(switches[switches.length - 1]);
+
+    const payload = await submit();
+
+    expect(payload.disable_global_guardrails).toBeUndefined();
+  });
+
+  it.each([
+    ["MCP Settings", /Allowed MCP Servers/, ["allowed_mcp_servers_and_groups", "mcp_tool_permissions"]],
+    ["Agent Settings", /Allowed Agents/, ["allowed_agents_and_groups"]],
+    ["Search Tool Settings", /Allowed Search Tools/, ["object_permission_search_tools"]],
+  ])("adds the %s keys as soon as that one section is opened", async (title, probe, keys) => {
+    await openCreateModal();
+
+    await openSection(title as string, probe as RegExp);
+    const payload = await submit();
+
+    for (const key of keys as string[]) {
+      expect(payload).toHaveProperty(key);
+    }
+  });
+
+  it("leaves policies out of the request body for a caller without the viewPolicies capability", async () => {
+    can.mockReturnValue(false);
+
+    await openCreateModal();
+    await openSection("Additional Settings", /Team Member Key Duration/);
+
+    const payload = await submit();
+
+    expect(payload).toStrictEqual({
+      team_alias: "Byte Contract Team",
+      organization_id: null,
+      models: ["no-default-models"],
+      max_budget: undefined,
+      budget_duration: undefined,
+      tpm_limit: undefined,
+      rpm_limit: undefined,
+      metadata: undefined,
+      team_id: undefined,
+      team_member_budget: undefined,
+      team_member_key_duration: undefined,
+      team_member_rpm_limit: undefined,
+      team_member_tpm_limit: undefined,
+      secret_manager_settings: undefined,
+      guardrails: undefined,
+      disable_global_guardrails: undefined,
+      access_group_ids: undefined,
+      allowed_vector_store_ids: undefined,
+      allowed_passthrough_routes: undefined,
+    });
+  });
+
+  it("blocks the create on an empty team name and names the rule", async () => {
+    renderWithQueryClient(<Teams accessToken="test-token" userID="user-123" userRole="Admin" />);
+    act(() => {
+      fireEvent.click(screen.getAllByRole("button", { name: /create team/i })[0]);
+    });
+    await waitFor(() => {
+      expect(screen.getByLabelText(/team name/i)).toBeInTheDocument();
+    });
+
+    const buttons = screen.getAllByRole("button", { name: /create team/i });
+    fireEvent.click(buttons[buttons.length - 1]);
+
+    expect(await screen.findByText("Please input a team name")).toBeInTheDocument();
+    expect(teamCreateCall).not.toHaveBeenCalled();
+  });
+});
diff --git a/ui/litellm-dashboard/src/components/Teams.tsx b/ui/litellm-dashboard/src/components/Teams.tsx
index b1f96f51028..94e84c6e721 100644
--- a/ui/litellm-dashboard/src/components/Teams.tsx
+++ b/ui/litellm-dashboard/src/components/Teams.tsx
@@ -4,12 +4,21 @@ import AvailableTeamsPanel from "@/components/team/AvailableTeamsPanel";
 import TeamInfoView from "@/components/team/TeamInfo";
 import TeamSSOSettings from "@/components/TeamSSOSettings";
 import { isProxyAdminRole } from "@/utils/roles";
-import { InfoCircleOutlined } from "@ant-design/icons";
 import { Collapsible, CollapsibleContent, CollapsibleTrigger } from "@/components/ui/collapsible";
 import { Input as UIInput } from "@/components/ui/input";
-import { Button, Form, Input, Layout, Modal, Select, Switch, Tabs, theme, Tooltip, Typography } from "antd";
+import { Switch } from "@/components/ui/switch";
+import { Textarea } from "@/components/ui/textarea";
+import { TooltipProvider } from "@/components/ui/tooltip";
+import { Field, FieldDescription, FieldGroup, FieldLabel } from "@/components/shared/form/field";
+import { FormField } from "@/components/shared/form/FormField";
+import { SearchSelect } from "@/components/shared/SearchSelect";
+import { labelWithDocsHint, labelWithHint } from "@/components/shared/form/LabelWithHint";
+import { useZodForm } from "@/lib/forms/useZodForm";
+import { TagsInput } from "@/app/(dashboard)/guardrails/_components/content_filter/TagsInput";
+import { Layout, Modal, Tabs, theme } from "antd";
 import { ChevronDown, Plus, Users } from "lucide-react";
-import React, { useEffect, useState } from "react";
+import React, { useEffect, useMemo, useState } from "react";
+import { z } from "zod/v4";
 import { useQuery, useQueryClient } from "@tanstack/react-query";
 import { PageHeader } from "@/components/shared/PageHeader";
 import { Button as UIButton } from "@/components/ui/button";
@@ -17,7 +26,10 @@ import { teamsTableKeys } from "@/app/(dashboard)/hooks/teams/useTeams";
 import { parseAsString, useQueryState } from "nuqs";
 import { TeamsTable } from "./TeamsPage/TeamsTable";
 import AccessGroupSelector from "./common_components/AccessGroupSelector";
-import MetadataKeyValueFields, { metadataPairsToObject } from "./common_components/MetadataKeyValueFields";
+import MetadataKeyValueFields, {
+  metadataPairsSchema,
+  metadataPairsToObject,
+} from "./common_components/MetadataKeyValueFields";
 import { useTeamMetadataSchema } from "@/app/(dashboard)/hooks/teams/useTeamMetadataSchema";
 import PassThroughRoutesSelector from "./common_components/PassThroughRoutesSelector";
 import AgentSelector from "./agent_management/AgentSelector";
@@ -51,6 +63,102 @@ import { teamCreateCall } from "./networking";
 import { normalizeTeamModelSelection } from "./team/teamModelAccess";
 import { ModelSelect } from "./ModelSelect/ModelSelect";
 
+const SUPPRESSED_BY_DESCRIPTION = "";
+
+const numericInputSchema = z.union([z.string(), z.number()]).optional();
+
+const teamCreateFieldsSchema = z.object({
+  team_alias: z.string().min(1, "Please input a team name"),
+  organization_id: z.string().nullish(),
+  models: z.array(z.string()).optional(),
+  max_budget: numericInputSchema,
+  budget_duration: z.string().nullish(),
+  tpm_limit: numericInputSchema,
+  rpm_limit: numericInputSchema,
+  metadata: metadataPairsSchema.optional(),
+  team_id: z.string().optional(),
+  team_member_budget: z.number().optional(),
+  team_member_key_duration: z.string().optional(),
+  team_member_rpm_limit: numericInputSchema,
+  team_member_tpm_limit: numericInputSchema,
+  secret_manager_settings: z.string().optional(),
+  guardrails: z.array(z.string()).optional(),
+  disable_global_guardrails: z.boolean().optional(),
+  policies: z.array(z.string()).optional(),
+  access_group_ids: z.array(z.string()).optional(),
+  allowed_vector_store_ids: z.array(z.string()).optional(),
+  allowed_passthrough_routes: z.array(z.string()).optional(),
+  allowed_mcp_servers_and_groups: z
+    .object({
+      servers: z.array(z.string()),
+      accessGroups: z.array(z.string()),
+      toolsets: z.array(z.string()).optional(),
+    })
+    .optional(),
+  mcp_tool_permissions: z.record(z.string(), z.array(z.string())).optional(),
+  allowed_agents_and_groups: z.object({ agents: z.array(z.string()), accessGroups: z.array(z.string()) }).optional(),
+  object_permission_search_tools: z.array(z.string()).optional(),
+});
+
+type TeamCreateFormValues = z.infer<typeof teamCreateFieldsSchema>;
+
+const EMPTY_TEAM_CREATE_VALUES: TeamCreateFormValues = {
+  team_alias: "",
+  organization_id: null,
+  models: [],
+  max_budget: undefined,
+  budget_duration: undefined,
+  tpm_limit: undefined,
+  rpm_limit: undefined,
+  metadata: [],
+  team_id: undefined,
+  team_member_budget: undefined,
+  team_member_key_duration: undefined,
+  team_member_rpm_limit: undefined,
+  team_member_tpm_limit: undefined,
+  secret_manager_settings: undefined,
+  guardrails: undefined,
+  disable_global_guardrails: undefined,
+  policies: undefined,
+  access_group_ids: undefined,
+  allowed_vector_store_ids: undefined,
+  allowed_passthrough_routes: undefined,
+  allowed_mcp_servers_and_groups: undefined,
+  mcp_tool_permissions: {},
+  allowed_agents_and_groups: undefined,
+  object_permission_search_tools: undefined,
+};
+
+const ADDITIONAL_SETTINGS_FIELDS = [
+  "team_id",
+  "team_member_budget",
+  "team_member_key_duration",
+  "team_member_rpm_limit",
+  "team_member_tpm_limit",
+  "secret_manager_settings",
+  "guardrails",
+  "disable_global_guardrails",
+  "policies",
+  "access_group_ids",
+  "allowed_vector_store_ids",
+  "allowed_passthrough_routes",
+] as const;
+const MCP_SETTINGS_FIELDS = ["allowed_mcp_servers_and_groups", "mcp_tool_permissions"] as const;
+const AGENT_SETTINGS_FIELDS = ["allowed_agents_and_groups"] as const;
+const SEARCH_TOOL_SETTINGS_FIELDS = ["object_permission_search_tools"] as const;
+
+const isParsableJson = (value: string | undefined): boolean => {
+  if (!value) {
+    return true;
+  }
+  try {
+    JSON.parse(value);
+    return true;
+  } catch {
+    return false;
+  }
+};
+
 const canCreateOrManageTeams = (
   userRole: string | null,
   userID: string | null,
@@ -101,7 +209,29 @@ const Teams: React.FC<TeamProps> = ({ accessToken, userID, userRole, premiumUser
   const [currentOrg] = useState<Organization | null>(null);
   const [currentOrgForCreateTeam, setCurrentOrgForCreateTeam] = useState<Organization | null>(null);
 
-  const [form] = Form.useForm();
+  const isOrgAdmin = userRole !== "Admin";
+  const [additionalSettingsOpen, setAdditionalSettingsOpen] = useState(false);
+  const [mcpSettingsOpen, setMcpSettingsOpen] = useState(false);
+  const [agentSettingsOpen, setAgentSettingsOpen] = useState(false);
+  const [searchToolSettingsOpen, setSearchToolSettingsOpen] = useState(false);
+
+  const teamCreateSchema = useMemo(
+    () =>
+      teamCreateFieldsSchema.superRefine((values, ctx) => {
+        if (isOrgAdmin && !values.organization_id) {
+          ctx.addIssue({ code: "custom", message: SUPPRESSED_BY_DESCRIPTION, path: ["organization_id"] });
+        }
+        if (additionalSettingsOpen && !isParsableJson(values.secret_manager_settings)) {
+          ctx.addIssue({ code: "custom", message: SUPPRESSED_BY_DESCRIPTION, path: ["secret_manager_settings"] });
+        }
+      }),
+    [isOrgAdmin, additionalSettingsOpen],
+  );
+
+  const form = useZodForm(teamCreateSchema, { defaultValues: EMPTY_TEAM_CREATE_VALUES });
+  const watchedOrganizationId = form.watch("organization_id");
+  const watchedMcpSelection = form.watch("allowed_mcp_servers_and_groups");
+  const watchedToolPermissions = form.watch("mcp_tool_permissions");
 
   const [selectedTeam, setSelectedTeam] = useState<Team | null>(null);
   const [selectedTeamId, setSelectedTeamId] = useQueryState("team", parseAsString.withOptions({ history: "push" }));
@@ -134,27 +264,26 @@ const Teams: React.FC<TeamProps> = ({ accessToken, userID, userRole, premiumUser
     : "n/a";
 
   useEffect(() => {
-    form.setFieldValue("models", []);
+    form.setValue("models", []);
   }, [currentOrgForCreateTeam, userModels]);
 
   // Handle organization preselection when modal opens
   useEffect(() => {
     if (isTeamModalVisible) {
       const adminOrgs = getAdminOrganizations(userRole, userID, organizations);
-      const isOrgAdmin = userRole !== "Admin";
 
       // Org admins must scope a team to an org, so with exactly one we preselect it.
       // Proxy admins can create org-less teams, so the field stays optional regardless of org count.
       if (isOrgAdmin && adminOrgs.length === 1) {
         const org = adminOrgs[0];
-        form.setFieldValue("organization_id", org.organization_id);
+        form.setValue("organization_id", org.organization_id);
         setCurrentOrgForCreateTeam(org);
       } else {
-        form.setFieldValue("organization_id", currentOrg?.organization_id || null);
+        form.setValue("organization_id", currentOrg?.organization_id || null);
         setCurrentOrgForCreateTeam(currentOrg);
       }
     }
-  }, [isTeamModalVisible, userRole, userID, organizations, currentOrg]);
+  }, [isTeamModalVisible, isOrgAdmin, userRole, userID, organizations, currentOrg]);
 
   // Add this useEffect to fetch guardrails
   useEffect(() => {
@@ -190,22 +319,26 @@ const Teams: React.FC<TeamProps> = ({ accessToken, userID, userRole, premiumUser
     if (canViewPolicies) fetchPolicies();
   }, [accessToken, canViewPolicies]);
 
-  const handleOk = () => {
-    setIsTeamModalVisible(false);
-    form.resetFields();
+  const resetCreateForm = () => {
+    form.reset(EMPTY_TEAM_CREATE_VALUES);
+    setAdditionalSettingsOpen(false);
+    setMcpSettingsOpen(false);
+    setAgentSettingsOpen(false);
+    setSearchToolSettingsOpen(false);
     setLoggingSettings([]);
     setModelAliases({});
     setRouterSettings(null);
     setRouterSettingsKey((prev) => prev + 1);
   };
 
+  const handleOk = () => {
+    setIsTeamModalVisible(false);
+    resetCreateForm();
+  };
+
   const handleCancel = () => {
     setIsTeamModalVisible(false);
-    form.resetFields();
-    setLoggingSettings([]);
-    setModelAliases({});
-    setRouterSettings(null);
-    setRouterSettingsKey((prev) => prev + 1);
+    resetCreateForm();
   };
 
   const handleDelete = async (team: Team) => {
@@ -378,11 +511,7 @@ const Teams: React.FC<TeamProps> = ({ accessToken, userID, userRole, premiumUser
         await teamCreateCall(accessToken, { ...formValues, models: normalizeTeamModelSelection(formValues.models) });
         toast.success("Team created");
         await refreshTeams();
-        form.resetFields();
-        setLoggingSettings([]);
-        setModelAliases({});
-        setRouterSettings(null);
-        setRouterSettingsKey((prev) => prev + 1);
+        resetCreateForm();
         setIsTeamModalVisible(false);
       }
     } catch (error) {
@@ -391,6 +520,19 @@ const Teams: React.FC<TeamProps> = ({ accessToken, userID, userRole, premiumUser
     }
   };
 
+  const mountedCreateValues = (values: TeamCreateFormValues): Record<string, unknown> => {
+    const unmounted = new Set<string>([
+      ...(additionalSettingsOpen ? [] : ADDITIONAL_SETTINGS_FIELDS),
+      ...(additionalSettingsOpen && canViewPolicies ? [] : ["policies"]),
+      ...(mcpSettingsOpen ? [] : MCP_SETTINGS_FIELDS),
+      ...(agentSettingsOpen ? [] : AGENT_SETTINGS_FIELDS),
+      ...(searchToolSettingsOpen ? [] : SEARCH_TOOL_SETTINGS_FIELDS),
+    ]);
+    return Object.fromEntries(Object.entries(values).filter(([key]) => !unmounted.has(key)));
+  };
+
+  const onCreateSubmit = (values: TeamCreateFormValues) => handleCreate(mountedCreateValues(values));
+
   const is_team_admin = (team: any) => {
     if (team == null || team.members_with_roles == null) {
       return false;
@@ -405,7 +547,6 @@ const Teams: React.FC<TeamProps> = ({ accessToken, userID, userRole, premiumUser
   };
 
   const { token } = theme.useToken();
-  const { Text } = Typography;
   const { Content } = Layout;
 
   const tabItems = [
@@ -531,556 +672,538 @@ const Teams: React.FC<TeamProps> = ({ accessToken, userID, userRole, premiumUser
           onCancel={handleCancel}
           destroyOnHidden
         >
-          <Form form={form} onFinish={handleCreate} labelCol={{ span: 8 }} wrapperCol={{ span: 16 }} labelAlign="left">
-            <>
-              <Form.Item
-                label="Team Name"
-                name="team_alias"
-                rules={[
-                  {
-                    required: true,
-                    message: "Please input a team name",
-                  },
-                ]}
-              >
-                <UIInput data-testid="team-name-input" />
-              </Form.Item>
-              {(() => {
-                const adminOrgs = getAdminOrganizations(userRole, userID, organizations);
-                const isOrgAdmin = userRole !== "Admin";
-                const isSingleOrg = adminOrgs.length === 1;
-                const hasNoOrgs = adminOrgs.length === 0;
-
-                return (
-                  <>
-                    <Form.Item
-                      label={
-                        <span>
-                          Organization{" "}
-                          <Tooltip
-                            title={
-                              <span>
-                                Organizations can have multiple teams. Learn more about{" "}
-                                <a
-                                  href="https://docs.litellm.ai/docs/proxy/user_management_heirarchy"
-                                  target="_blank"
-                                  rel="noopener noreferrer"
-                                  style={{
-                                    color: "#1890ff",
-                                    textDecoration: "underline",
-                                  }}
-                                  onClick={(e) => e.stopPropagation()}
-                                >
-                                  user management hierarchy
-                                </a>
-                              </span>
-                            }
-                          >
-                            <InfoCircleOutlined style={{ marginLeft: "4px" }} />
-                          </Tooltip>
-                        </span>
-                      }
-                      name="organization_id"
-                      initialValue={currentOrg ? currentOrg.organization_id : null}
-                      className="mt-8"
-                      rules={
-                        isOrgAdmin
-                          ? [
-                              {
-                                required: true,
-                                message: "Please select an organization",
-                              },
-                            ]
-                          : []
-                      }
-                      help={
-                        isOrgAdmin && isSingleOrg
-                          ? "You can only create teams within this organization"
-                          : isOrgAdmin
-                            ? "required"
-                            : ""
-                      }
-                    >
-                      <Select
-                        showSearch
-                        allowClear={!isOrgAdmin}
-                        disabled={isOrgAdmin && isSingleOrg}
-                        placeholder={hasNoOrgs ? "No organizations available" : "Search or select an Organization"}
-                        onChange={(value) => {
-                          form.setFieldValue("organization_id", value);
-                          setCurrentOrgForCreateTeam(adminOrgs?.find((org) => org.organization_id === value) || null);
-                        }}
-                        filterOption={(input, option) => {
-                          if (!option) return false;
-                          const optionValue = option.children?.toString() || "";
-                          return optionValue.toLowerCase().includes(input.toLowerCase());
-                        }}
-                        optionFilterProp="children"
-                      >
-                        {adminOrgs?.map((org) => (
-                          <Select.Option key={org.organization_id} value={org.organization_id}>
-                            <span className="font-medium">{org.organization_alias}</span>{" "}
-                            <span className="text-gray-500">({org.organization_id})</span>
-                          </Select.Option>
-                        ))}
-                      </Select>
-                    </Form.Item>
-
-                    {/* Show message when org admin needs to select organization */}
-                    {isOrgAdmin && !isSingleOrg && adminOrgs.length > 1 && (
-                      <div className="mb-8 p-4 bg-blue-50 border border-blue-200 rounded-md">
-                        <Text style={{ color: "#1e40af", fontSize: 14 }}>
-                          Please select an organization to create a team for. You can only create teams within
-                          organizations where you are an admin.
-                        </Text>
-                      </div>
-                    )}
-                  </>
-                );
-              })()}
-              <Form.Item
-                label={
-                  <span>
-                    Models{" "}
-                    <Tooltip title="These are the models that your selected team has access to. Leave empty to grant no models directly, e.g. when the team gets its models from access groups">
-                      <InfoCircleOutlined style={{ marginLeft: "4px" }} />
-                    </Tooltip>
-                  </span>
-                }
-                name="models"
-              >
-                <ModelSelect
-                  value={form.getFieldValue("models") || []}
-                  onChange={(values) => form.setFieldValue("models", values)}
-                  organizationID={form.getFieldValue("organization_id")}
-                  options={{
-                    includeSpecialOptions: true,
-                    showAllProxyModelsOverride: !form.getFieldValue("organization_id"),
-                  }}
-                  context="team"
-                  dataTestId="create-team-models-select"
-                />
-              </Form.Item>
-
-              <Form.Item label="Max Budget (USD)" name="max_budget">
-                <NumericalInput step={0.01} precision={2} width={200} />
-              </Form.Item>
-              <Form.Item className="mt-8" label="Reset Budget" name="budget_duration">
-                <BudgetDurationDropdown showNeverResets placeholder={budgetDurationPlaceholder} />
-              </Form.Item>
-              <Form.Item label="Tokens per minute Limit (TPM)" name="tpm_limit">
-                <NumericalInput step={1} width={400} />
-              </Form.Item>
-              <Form.Item label="Requests per minute Limit (RPM)" name="rpm_limit">
-                <NumericalInput step={1} width={400} />
-              </Form.Item>
-              <Form.Item
-                label="Metadata"
-                help='Values are saved as text. Enter JSON for typed values, e.g. 3, true, or {"region": "us"}.'
-              >
-                <MetadataKeyValueFields
-                  form={form}
-                  schemaFields={teamMetadataSchemaFields}
-                  schemaLoading={isTeamMetadataSchemaLoading}
-                />
-              </Form.Item>
-
-              <Collapsible className="mt-20 mb-8 overflow-hidden rounded-lg border">
-                <CollapsibleTrigger className="group/section flex w-full items-center justify-between px-4 py-3 text-left">
-                  <b>Additional Settings</b>
-                  <ChevronDown className="size-5 shrink-0 text-gray-500 transition-transform group-data-[panel-open]/section:rotate-180" />
-                </CollapsibleTrigger>
-                <CollapsibleContent className="px-4 pb-3">
-                  <Form.Item
-                    label="Team ID"
-                    name="team_id"
-                    help="ID of the team you want to create. If not provided, it will be generated automatically."
-                  >
-                    <UIInput
-                      onChange={(e) => {
-                        e.target.value = e.target.value.trim();
-                      }}
-                    />
-                  </Form.Item>
-                  <Form.Item
-                    label="Team Member Budget (USD)"
-                    name="team_member_budget"
-                    normalize={(value) => (value ? Number(value) : undefined)}
-                    tooltip="This is the individual budget for a user in the team."
-                  >
-                    <NumericalInput step={0.01} precision={2} width={200} />
-                  </Form.Item>
-                  <Form.Item
-                    label="Team Member Key Duration (eg: 1d, 1mo)"
-                    name="team_member_key_duration"
-                    tooltip="Set a limit to the duration of a team member's key. Format: 30s (seconds), 30m (minutes), 30h (hours), 30d (days), 1mo (month)"
-                  >
-                    <UIInput placeholder="e.g., 30d" />
-                  </Form.Item>
-                  <Form.Item
-                    label="Team Member RPM Limit"
-                    name="team_member_rpm_limit"
-                    tooltip="The RPM (Requests Per Minute) limit for individual team members"
-                  >
-                    <NumericalInput step={1} width={400} />
-                  </Form.Item>
-                  <Form.Item
-                    label="Team Member TPM Limit"
-                    name="team_member_tpm_limit"
-                    tooltip="The TPM (Tokens Per Minute) limit for individual team members"
-                  >
-                    <NumericalInput step={1} width={400} />
-                  </Form.Item>
-                  <Form.Item
-                    label="Secret Manager Settings"
-                    name="secret_manager_settings"
-                    help={
-                      premiumUser
-                        ? "Enter secret manager configuration as a JSON object."
-                        : "Premium feature - Upgrade to manage secret manager settings."
-                    }
-                    rules={[
-                      {
-                        validator: async (_, value) => {
-                          if (!value) {
-                            return Promise.resolve();
-                          }
-                          try {
-                            JSON.parse(value);
-                            return Promise.resolve();
-                          } catch (error) {
-                            return Promise.reject(new Error("Please enter valid JSON"));
-                          }
-                        },
-                      },
-                    ]}
-                  >
-                    <Input.TextArea
-                      rows={4}
-                      placeholder='{"namespace": "admin", "mount": "secret", "path_prefix": "litellm"}'
-                      disabled={!premiumUser}
-                    />
-                  </Form.Item>
-                  <Form.Item
-                    label={
-                      <span>
-                        Guardrails{" "}
-                        <Tooltip title="Setup your first guardrail">
-                          <a
-                            href="https://docs.litellm.ai/docs/proxy/guardrails/quick_start"
-                            target="_blank"
-                            rel="noopener noreferrer"
-                            onClick={(e) => e.stopPropagation()}
-                          >
-                            <InfoCircleOutlined style={{ marginLeft: "4px" }} />
-                          </a>
-                        </Tooltip>
-                      </span>
-                    }
-                    name="guardrails"
-                    className="mt-8"
-                    help="Select existing guardrails or enter new ones"
-                  >
-                    <Select
-                      mode="tags"
-                      style={{ width: "100%" }}
-                      placeholder="Select or enter guardrails"
-                      options={guardrailsList.map((name) => ({
-                        value: name,
-                        label: name,
-                      }))}
-                    />
-                  </Form.Item>
-                  <Form.Item
-                    label={
-                      <span>
-                        Disable Global Guardrails{" "}
-                        <Tooltip title="When enabled, this team will bypass any guardrails configured to run on every request (global guardrails)">
-                          <InfoCircleOutlined style={{ marginLeft: "4px" }} />
-                        </Tooltip>
-                      </span>
-                    }
-                    name="disable_global_guardrails"
-                    className="mt-4"
-                    valuePropName="checked"
-                    help="Bypass global guardrails for this team"
-                  >
-                    <Switch
-                      disabled={!premiumUser}
-                      checkedChildren={
-                        premiumUser ? "Yes" : "Premium feature - Upgrade to disable global guardrails by team"
-                      }
-                      unCheckedChildren={
-                        premiumUser ? "No" : "Premium feature - Upgrade to disable global guardrails by team"
-                      }
-                    />
-                  </Form.Item>
-                  {canViewPolicies && (
-                    <Form.Item
-                      label={
-                        <span>
-                          Policies{" "}
-                          <Tooltip title="Apply policies to this team to control guardrails and other settings">
-                            <a
-                              href="https://docs.litellm.ai/docs/proxy/guardrails/guardrail_policies"
-                              target="_blank"
-                              rel="noopener noreferrer"
-                              onClick={(e) => e.stopPropagation()}
-                            >
-                              <InfoCircleOutlined style={{ marginLeft: "4px" }} />
-                            </a>
-                          </Tooltip>
-                        </span>
-                      }
-                      name="policies"
-                      className="mt-8"
-                      help="Select existing policies or enter new ones"
-                    >
-                      <Select
-                        mode="tags"
-                        style={{ width: "100%" }}
-                        placeholder="Select or enter policies"
-                        options={policiesList.map((name) => ({
-                          value: name,
-                          label: name,
-                        }))}
-                      />
-                    </Form.Item>
+          <TooltipProvider>
+            <form onSubmit={form.handleSubmit(onCreateSubmit)}>
+              <FieldGroup>
+                <FormField control={form.control} name="team_alias" label="Team Name">
+                  {({ ref, value, ...field }) => (
+                    <UIInput {...field} ref={ref} value={value ?? ""} data-testid="team-name-input" />
                   )}
-                  <Form.Item
-                    label={
-                      <span>
-                        Access Groups{" "}
-                        <Tooltip title="Assign access groups to this team. Access groups control which models, MCP servers, and agents this team can use">
-                          <InfoCircleOutlined style={{ marginLeft: "4px" }} />
-                        </Tooltip>
-                      </span>
-                    }
-                    name="access_group_ids"
-                    className="mt-8"
-                    help="Select access groups to assign to this team"
-                  >
-                    <AccessGroupSelector placeholder="Select access groups (optional)" />
-                  </Form.Item>
-                  <Form.Item
-                    label={
-                      <span>
-                        Allowed Vector Stores{" "}
-                        <Tooltip title="Select which vector stores this team can access by default. Leave empty for access to all vector stores">
-                          <InfoCircleOutlined style={{ marginLeft: "4px" }} />
-                        </Tooltip>
-                      </span>
-                    }
-                    name="allowed_vector_store_ids"
-                    className="mt-8"
-                    help="Select vector stores this team can access. Leave empty for access to all vector stores"
-                  >
-                    <VectorStoreSelector
-                      onChange={(values: string[]) => form.setFieldValue("allowed_vector_store_ids", values)}
-                      value={form.getFieldValue("allowed_vector_store_ids")}
-                      accessToken={accessToken || ""}
-                      placeholder="Select vector stores (optional)"
-                    />
-                  </Form.Item>
-                  <Form.Item
-                    label="Allowed Pass Through Routes"
-                    name="allowed_passthrough_routes"
-                    className="mt-8"
-                    tooltip={
-                      !premiumUser
-                        ? "Premium feature - Upgrade to set allowed pass through routes"
-                        : !isProxyAdminRole(userRole || "")
-                          ? "Only proxy admins can set allowed pass through routes"
-                          : undefined
-                    }
-                  >
-                    <PassThroughRoutesSelector
-                      accessToken={accessToken || ""}
-                      placeholder="Select pass through routes (optional)"
-                      disabled={!premiumUser || !isProxyAdminRole(userRole || "")}
-                    />
-                  </Form.Item>
-                </CollapsibleContent>
-              </Collapsible>
+                </FormField>
+                {(() => {
+                  const adminOrgs = getAdminOrganizations(userRole, userID, organizations);
+                  const isSingleOrg = adminOrgs.length === 1;
+                  const hasNoOrgs = adminOrgs.length === 0;
 
-              <Collapsible className="mt-8 mb-8 overflow-hidden rounded-lg border">
-                <CollapsibleTrigger className="group/section flex w-full items-center justify-between px-4 py-3 text-left">
-                  <b>MCP Settings</b>
-                  <ChevronDown className="size-5 shrink-0 text-gray-500 transition-transform group-data-[panel-open]/section:rotate-180" />
-                </CollapsibleTrigger>
-                <CollapsibleContent className="px-4 pb-3">
-                  <Form.Item
-                    label={
-                      <span>
-                        Allowed MCP Servers{" "}
-                        <Tooltip title="Select which MCP servers or access groups this team can access">
-                          <InfoCircleOutlined style={{ marginLeft: "4px" }} />
-                        </Tooltip>
-                      </span>
-                    }
-                    name="allowed_mcp_servers_and_groups"
-                    className="mt-4"
-                    help="Select MCP servers or access groups this team can access"
-                  >
-                    <MCPServerSelector
-                      onChange={(val: any) => form.setFieldValue("allowed_mcp_servers_and_groups", val)}
-                      value={form.getFieldValue("allowed_mcp_servers_and_groups")}
-                      accessToken={accessToken || ""}
-                      placeholder="Select MCP servers or access groups (optional)"
-                      allowAllProxyMcpServers={isProxyAdminRole(userRole || "")}
+                  return (
+                    <>
+                      <FormField
+                        control={form.control}
+                        name="organization_id"
+                        className="mt-8"
+                        label={labelWithDocsHint(
+                          "Organization",
+                          "Organizations can have multiple teams. Learn more about the user management hierarchy",
+                          "https://docs.litellm.ai/docs/proxy/user_management_heirarchy",
+                        )}
+                        description={
+                          isOrgAdmin && isSingleOrg
+                            ? "You can only create teams within this organization"
+                            : isOrgAdmin
+                              ? "required"
+                              : undefined
+                        }
+                      >
+                        {({ id, value, onChange }) => (
+                          <SearchSelect
+                            inputId={id}
+                            value={value ?? ""}
+                            options={adminOrgs.map((org) => ({
+                              value: org.organization_id ?? "",
+                              label: org.organization_alias ?? "",
+                              sublabel: org.organization_id ?? "",
+                            }))}
+                            disabled={isOrgAdmin && isSingleOrg}
+                            allowClear={!isOrgAdmin}
+                            placeholder={hasNoOrgs ? "No organizations available" : "Search or select an Organization"}
+                            emptyText="No organizations available"
+                            onValueChange={(next) => {
+                              onChange(next === "" ? null : next);
+                              setCurrentOrgForCreateTeam(adminOrgs.find((org) => org.organization_id === next) ?? null);
+                            }}
+                          />
+                        )}
+                      </FormField>
+
+                      {isOrgAdmin && !isSingleOrg && adminOrgs.length > 1 && (
+                        <div className="mb-8 rounded-md border border-blue-200 bg-blue-50 p-4">
+                          <span className="text-sm text-blue-800">
+                            Please select an organization to create a team for. You can only create teams within
+                            organizations where you are an admin.
+                          </span>
+                        </div>
+                      )}
+                    </>
+                  );
+                })()}
+                <FormField
+                  control={form.control}
+                  name="models"
+                  label={labelWithHint(
+                    "Models",
+                    "These are the models that your selected team has access to. Leave empty to grant no models directly, e.g. when the team gets its models from access groups",
+                  )}
+                >
+                  {({ id, value, onChange }) => (
+                    <ModelSelect
+                      id={id}
+                      value={value ?? []}
+                      onChange={onChange}
+                      organizationID={watchedOrganizationId ?? undefined}
+                      options={{
+                        includeSpecialOptions: true,
+                        showAllProxyModelsOverride: !watchedOrganizationId,
+                      }}
+                      context="team"
+                      dataTestId="create-team-models-select"
                     />
-                  </Form.Item>
+                  )}
+                </FormField>
 
-                  {/* Hidden field to register mcp_tool_permissions with the form */}
-                  <Form.Item name="mcp_tool_permissions" initialValue={{}} hidden>
-                    <Input type="hidden" />
-                  </Form.Item>
+                <FormField control={form.control} name="max_budget" label="Max Budget (USD)">
+                  {({ ref, value, ...field }) => (
+                    <NumericalInput {...field} ref={ref} value={value ?? ""} step={0.01} precision={2} width={200} />
+                  )}
+                </FormField>
+                <FormField control={form.control} name="budget_duration" className="mt-8" label="Reset Budget">
+                  {({ id, value, onChange }) => (
+                    <BudgetDurationDropdown
+                      id={id}
+                      showNeverResets
+                      placeholder={budgetDurationPlaceholder}
+                      value={value}
+                      onChange={onChange}
+                    />
+                  )}
+                </FormField>
+                <FormField control={form.control} name="tpm_limit" label="Tokens per minute Limit (TPM)">
+                  {({ ref, value, ...field }) => (
+                    <NumericalInput {...field} ref={ref} value={value ?? ""} step={1} width={400} />
+                  )}
+                </FormField>
+                <FormField control={form.control} name="rpm_limit" label="Requests per minute Limit (RPM)">
+                  {({ ref, value, ...field }) => (
+                    <NumericalInput {...field} ref={ref} value={value ?? ""} step={1} width={400} />
+                  )}
+                </FormField>
+                <Field>
+                  <FieldLabel>Metadata</FieldLabel>
+                  <MetadataKeyValueFields
+                    control={form.control}
+                    getValues={form.getValues}
+                    name="metadata"
+                    schemaFields={teamMetadataSchemaFields}
+                    schemaLoading={isTeamMetadataSchemaLoading}
+                  />
+                  <FieldDescription>
+                    Values are saved as text. Enter JSON for typed values, e.g. 3, true, or {'{"region": "us"}'}.
+                  </FieldDescription>
+                </Field>
 
-                  <Form.Item
-                    noStyle
-                    shouldUpdate={(prevValues, currentValues) =>
-                      prevValues.allowed_mcp_servers_and_groups !== currentValues.allowed_mcp_servers_and_groups ||
-                      prevValues.mcp_tool_permissions !== currentValues.mcp_tool_permissions
-                    }
-                  >
-                    {() => (
-                      <div className="mt-6">
-                        <MCPToolPermissions
+                <Collapsible
+                  open={additionalSettingsOpen}
+                  onOpenChange={setAdditionalSettingsOpen}
+                  className="mt-20 mb-8 overflow-hidden rounded-lg border"
+                >
+                  <CollapsibleTrigger className="group/section flex w-full items-center justify-between px-4 py-3 text-left">
+                    <b>Additional Settings</b>
+                    <ChevronDown className="size-5 shrink-0 text-gray-500 transition-transform group-data-[panel-open]/section:rotate-180" />
+                  </CollapsibleTrigger>
+                  <CollapsibleContent className="px-4 pb-3">
+                    <FieldGroup>
+                      <FormField
+                        control={form.control}
+                        name="team_id"
+                        label="Team ID"
+                        description="ID of the team you want to create. If not provided, it will be generated automatically."
+                      >
+                        {({ ref, value, ...field }) => <UIInput {...field} ref={ref} value={value ?? ""} />}
+                      </FormField>
+                      <FormField
+                        control={form.control}
+                        name="team_member_budget"
+                        label={labelWithHint(
+                          "Team Member Budget (USD)",
+                          "This is the individual budget for a user in the team.",
+                        )}
+                      >
+                        {({ ref, value, onChange, ...field }) => (
+                          <NumericalInput
+                            {...field}
+                            ref={ref}
+                            value={value ?? ""}
+                            onChange={(event: React.ChangeEvent<HTMLInputElement>) =>
+                              onChange(event.target.value ? Number(event.target.value) : undefined)
+                            }
+                            step={0.01}
+                            precision={2}
+                            width={200}
+                          />
+                        )}
+                      </FormField>
+                      <FormField
+                        control={form.control}
+                        name="team_member_key_duration"
+                        label={labelWithHint(
+                          "Team Member Key Duration (eg: 1d, 1mo)",
+                          "Set a limit to the duration of a team member's key. Format: 30s (seconds), 30m (minutes), 30h (hours), 30d (days), 1mo (month)",
+                        )}
+                      >
+                        {({ ref, value, ...field }) => (
+                          <UIInput {...field} ref={ref} value={value ?? ""} placeholder="e.g., 30d" />
+                        )}
+                      </FormField>
+                      <FormField
+                        control={form.control}
+                        name="team_member_rpm_limit"
+                        label={labelWithHint(
+                          "Team Member RPM Limit",
+                          "The RPM (Requests Per Minute) limit for individual team members",
+                        )}
+                      >
+                        {({ ref, value, ...field }) => (
+                          <NumericalInput {...field} ref={ref} value={value ?? ""} step={1} width={400} />
+                        )}
+                      </FormField>
+                      <FormField
+                        control={form.control}
+                        name="team_member_tpm_limit"
+                        label={labelWithHint(
+                          "Team Member TPM Limit",
+                          "The TPM (Tokens Per Minute) limit for individual team members",
+                        )}
+                      >
+                        {({ ref, value, ...field }) => (
+                          <NumericalInput {...field} ref={ref} value={value ?? ""} step={1} width={400} />
+                        )}
+                      </FormField>
+                      <FormField
+                        control={form.control}
+                        name="secret_manager_settings"
+                        label="Secret Manager Settings"
+                        description={
+                          premiumUser
+                            ? "Enter secret manager configuration as a JSON object."
+                            : "Premium feature - Upgrade to manage secret manager settings."
+                        }
+                      >
+                        {({ ref, value, ...field }) => (
+                          <Textarea
+                            {...field}
+                            ref={ref}
+                            value={value ?? ""}
+                            rows={4}
+                            placeholder='{"namespace": "admin", "mount": "secret", "path_prefix": "litellm"}'
+                            disabled={!premiumUser}
+                          />
+                        )}
+                      </FormField>
+                      <FormField
+                        control={form.control}
+                        name="guardrails"
+                        className="mt-8"
+                        label={labelWithDocsHint(
+                          "Guardrails",
+                          "Setup your first guardrail",
+                          "https://docs.litellm.ai/docs/proxy/guardrails/quick_start",
+                        )}
+                        description="Select existing guardrails or enter new ones"
+                      >
+                        {({ id, value, onChange }) => (
+                          <TagsInput
+                            id={id}
+                            value={value ?? []}
+                            onValueChange={onChange}
+                            options={guardrailsList.map((name) => ({ value: name, label: name }))}
+                            placeholder="Select or enter guardrails"
+                          />
+                        )}
+                      </FormField>
+                      <FormField
+                        control={form.control}
+                        name="disable_global_guardrails"
+                        className="mt-4"
+                        label={labelWithHint(
+                          "Disable Global Guardrails",
+                          "When enabled, this team will bypass any guardrails configured to run on every request (global guardrails)",
+                        )}
+                        description={
+                          premiumUser
+                            ? "Bypass global guardrails for this team"
+                            : "Premium feature - Upgrade to disable global guardrails by team"
+                        }
+                      >
+                        {({ id, value, onChange }) => (
+                          <Switch id={id} disabled={!premiumUser} checked={value === true} onCheckedChange={onChange} />
+                        )}
+                      </FormField>
+                      {canViewPolicies && (
+                        <FormField
+                          control={form.control}
+                          name="policies"
+                          className="mt-8"
+                          label={labelWithDocsHint(
+                            "Policies",
+                            "Apply policies to this team to control guardrails and other settings",
+                            "https://docs.litellm.ai/docs/proxy/guardrails/guardrail_policies",
+                          )}
+                          description="Select existing policies or enter new ones"
+                        >
+                          {({ id, value, onChange }) => (
+                            <TagsInput
+                              id={id}
+                              value={value ?? []}
+                              onValueChange={onChange}
+                              options={policiesList.map((name) => ({ value: name, label: name }))}
+                              placeholder="Select or enter policies"
+                            />
+                          )}
+                        </FormField>
+                      )}
+                      <FormField
+                        control={form.control}
+                        name="access_group_ids"
+                        className="mt-8"
+                        label={labelWithHint(
+                          "Access Groups",
+                          "Assign access groups to this team. Access groups control which models, MCP servers, and agents this team can use",
+                        )}
+                        description="Select access groups to assign to this team"
+                      >
+                        {({ value, onChange }) => (
+                          <AccessGroupSelector
+                            value={value}
+                            onChange={onChange}
+                            placeholder="Select access groups (optional)"
+                          />
+                        )}
+                      </FormField>
+                      <FormField
+                        control={form.control}
+                        name="allowed_vector_store_ids"
+                        className="mt-8"
+                        label={labelWithHint(
+                          "Allowed Vector Stores",
+                          "Select which vector stores this team can access by default. Leave empty for access to all vector stores",
+                        )}
+                        description="Select vector stores this team can access. Leave empty for access to all vector stores"
+                      >
+                        {({ value, onChange }) => (
+                          <VectorStoreSelector
+                            onChange={onChange}
+                            value={value}
+                            accessToken={accessToken || ""}
+                            placeholder="Select vector stores (optional)"
+                          />
+                        )}
+                      </FormField>
+                      <FormField
+                        control={form.control}
+                        name="allowed_passthrough_routes"
+                        className="mt-8"
+                        label={
+                          !premiumUser
+                            ? labelWithHint(
+                                "Allowed Pass Through Routes",
+                                "Premium feature - Upgrade to set allowed pass through routes",
+                              )
+                            : !isProxyAdminRole(userRole || "")
+                              ? labelWithHint(
+                                  "Allowed Pass Through Routes",
+                                  "Only proxy admins can set allowed pass through routes",
+                                )
+                              : "Allowed Pass Through Routes"
+                        }
+                      >
+                        {({ value, onChange }) => (
+                          <PassThroughRoutesSelector
+                            value={value}
+                            onChange={onChange}
+                            accessToken={accessToken || ""}
+                            placeholder="Select pass through routes (optional)"
+                            disabled={!premiumUser || !isProxyAdminRole(userRole || "")}
+                          />
+                        )}
+                      </FormField>
+                    </FieldGroup>
+                  </CollapsibleContent>
+                </Collapsible>
+
+                <Collapsible
+                  open={mcpSettingsOpen}
+                  onOpenChange={setMcpSettingsOpen}
+                  className="mt-8 mb-8 overflow-hidden rounded-lg border"
+                >
+                  <CollapsibleTrigger className="group/section flex w-full items-center justify-between px-4 py-3 text-left">
+                    <b>MCP Settings</b>
+                    <ChevronDown className="size-5 shrink-0 text-gray-500 transition-transform group-data-[panel-open]/section:rotate-180" />
+                  </CollapsibleTrigger>
+                  <CollapsibleContent className="px-4 pb-3">
+                    <FormField
+                      control={form.control}
+                      name="allowed_mcp_servers_and_groups"
+                      className="mt-4"
+                      label={labelWithHint(
+                        "Allowed MCP Servers",
+                        "Select which MCP servers or access groups this team can access",
+                      )}
+                      description="Select MCP servers or access groups this team can access"
+                    >
+                      {({ value, onChange }) => (
+                        <MCPServerSelector
+                          onChange={onChange}
+                          value={value}
                           accessToken={accessToken || ""}
-                          selectedServers={form.getFieldValue("allowed_mcp_servers_and_groups")?.servers || []}
-                          toolPermissions={form.getFieldValue("mcp_tool_permissions") || {}}
-                          onChange={(toolPerms) => form.setFieldsValue({ mcp_tool_permissions: toolPerms })}
+                          placeholder="Select MCP servers or access groups (optional)"
+                          allowAllProxyMcpServers={isProxyAdminRole(userRole || "")}
                         />
-                      </div>
-                    )}
-                  </Form.Item>
-                </CollapsibleContent>
-              </Collapsible>
+                      )}
+                    </FormField>
 
-              <Collapsible className="mt-8 mb-8 overflow-hidden rounded-lg border">
-                <CollapsibleTrigger className="group/section flex w-full items-center justify-between px-4 py-3 text-left">
-                  <b>Agent Settings</b>
-                  <ChevronDown className="size-5 shrink-0 text-gray-500 transition-transform group-data-[panel-open]/section:rotate-180" />
-                </CollapsibleTrigger>
-                <CollapsibleContent className="px-4 pb-3">
-                  <Form.Item
-                    label={
-                      <span>
-                        Allowed Agents{" "}
-                        <Tooltip title="Select which agents or access groups this team can access">
-                          <InfoCircleOutlined style={{ marginLeft: "4px" }} />
-                        </Tooltip>
-                      </span>
-                    }
-                    name="allowed_agents_and_groups"
-                    className="mt-4"
-                    help="Select agents or access groups this team can access"
-                  >
-                    <AgentSelector
-                      onChange={(val: any) => form.setFieldValue("allowed_agents_and_groups", val)}
-                      value={form.getFieldValue("allowed_agents_and_groups")}
-                      accessToken={accessToken || ""}
-                      placeholder="Select agents or access groups (optional)"
-                    />
-                  </Form.Item>
-                </CollapsibleContent>
-              </Collapsible>
+                    <div className="mt-6">
+                      <MCPToolPermissions
+                        accessToken={accessToken || ""}
+                        selectedServers={watchedMcpSelection?.servers || []}
+                        toolPermissions={watchedToolPermissions || {}}
+                        onChange={(toolPerms) => form.setValue("mcp_tool_permissions", toolPerms)}
+                      />
+                    </div>
+                  </CollapsibleContent>
+                </Collapsible>
 
-              <Collapsible className="mt-8 mb-8 overflow-hidden rounded-lg border">
-                <CollapsibleTrigger className="group/section flex w-full items-center justify-between px-4 py-3 text-left">
-                  <b>Search Tool Settings</b>
-                  <ChevronDown className="size-5 shrink-0 text-gray-500 transition-transform group-data-[panel-open]/section:rotate-180" />
-                </CollapsibleTrigger>
-                <CollapsibleContent className="px-4 pb-3">
-                  <Form.Item
-                    label={
-                      <span>
-                        Allowed Search Tools{" "}
-                        <Tooltip title="Select which search tools this team can access. Leave empty to allow all search tools.">
-                          <InfoCircleOutlined style={{ marginLeft: "4px" }} />
-                        </Tooltip>
-                      </span>
-                    }
-                    name="object_permission_search_tools"
-                    className="mt-4"
-                    help="Restrict which configured search tools keys on this team may call."
-                  >
-                    <SearchToolSelector
-                      onChange={(vals: string[]) => form.setFieldValue("object_permission_search_tools", vals)}
-                      value={form.getFieldValue("object_permission_search_tools")}
-                      accessToken={accessToken || ""}
-                      placeholder="Select search tools (optional, empty = all allowed)"
-                    />
-                  </Form.Item>
-                </CollapsibleContent>
-              </Collapsible>
+                <Collapsible
+                  open={agentSettingsOpen}
+                  onOpenChange={setAgentSettingsOpen}
+                  className="mt-8 mb-8 overflow-hidden rounded-lg border"
+                >
+                  <CollapsibleTrigger className="group/section flex w-full items-center justify-between px-4 py-3 text-left">
+                    <b>Agent Settings</b>
+                    <ChevronDown className="size-5 shrink-0 text-gray-500 transition-transform group-data-[panel-open]/section:rotate-180" />
+                  </CollapsibleTrigger>
+                  <CollapsibleContent className="px-4 pb-3">
+                    <FormField
+                      control={form.control}
+                      name="allowed_agents_and_groups"
+                      className="mt-4"
+                      label={labelWithHint(
+                        "Allowed Agents",
+                        "Select which agents or access groups this team can access",
+                      )}
+                      description="Select agents or access groups this team can access"
+                    >
+                      {({ value, onChange }) => (
+                        <AgentSelector
+                          onChange={onChange}
+                          value={value}
+                          accessToken={accessToken || ""}
+                          placeholder="Select agents or access groups (optional)"
+                        />
+                      )}
+                    </FormField>
+                  </CollapsibleContent>
+                </Collapsible>
 
-              <Collapsible className="mt-8 mb-8 overflow-hidden rounded-lg border">
-                <CollapsibleTrigger className="group/section flex w-full items-center justify-between px-4 py-3 text-left">
-                  <b>Logging Settings</b>
-                  <ChevronDown className="size-5 shrink-0 text-gray-500 transition-transform group-data-[panel-open]/section:rotate-180" />
-                </CollapsibleTrigger>
-                <CollapsibleContent className="px-4 pb-3">
-                  <div className="mt-4">
-                    <PremiumLoggingSettings
-                      value={loggingSettings}
-                      onChange={setLoggingSettings}
-                      premiumUser={premiumUser}
-                    />
-                  </div>
-                </CollapsibleContent>
-              </Collapsible>
+                <Collapsible
+                  open={searchToolSettingsOpen}
+                  onOpenChange={setSearchToolSettingsOpen}
+                  className="mt-8 mb-8 overflow-hidden rounded-lg border"
+                >
+                  <CollapsibleTrigger className="group/section flex w-full items-center justify-between px-4 py-3 text-left">
+                    <b>Search Tool Settings</b>
+                    <ChevronDown className="size-5 shrink-0 text-gray-500 transition-transform group-data-[panel-open]/section:rotate-180" />
+                  </CollapsibleTrigger>
+                  <CollapsibleContent className="px-4 pb-3">
+                    <FormField
+                      control={form.control}
+                      name="object_permission_search_tools"
+                      className="mt-4"
+                      label={labelWithHint(
+                        "Allowed Search Tools",
+                        "Select which search tools this team can access. Leave empty to allow all search tools.",
+                      )}
+                      description="Restrict which configured search tools keys on this team may call."
+                    >
+                      {({ value, onChange }) => (
+                        <SearchToolSelector
+                          onChange={onChange}
+                          value={value}
+                          accessToken={accessToken || ""}
+                          placeholder="Select search tools (optional, empty = all allowed)"
+                        />
+                      )}
+                    </FormField>
+                  </CollapsibleContent>
+                </Collapsible>
 
-              <Collapsible
-                key={`router-settings-accordion-${routerSettingsKey}`}
-                className="mt-8 mb-8 overflow-hidden rounded-lg border"
-              >
-                <CollapsibleTrigger className="group/section flex w-full items-center justify-between px-4 py-3 text-left">
-                  <b>Router Settings</b>
-                  <ChevronDown className="size-5 shrink-0 text-gray-500 transition-transform group-data-[panel-open]/section:rotate-180" />
-                </CollapsibleTrigger>
-                <CollapsibleContent className="px-4 pb-3">
-                  <div className="mt-4 w-full">
-                    <RouterSettingsAccordion
-                      key={routerSettingsKey}
-                      accessToken={accessToken || ""}
-                      value={routerSettings || undefined}
-                      onChange={setRouterSettings}
-                      modelData={
-                        userModels.length > 0 ? { data: userModels.map((model) => ({ model_name: model })) } : undefined
-                      }
-                    />
-                  </div>
-                </CollapsibleContent>
-              </Collapsible>
+                <Collapsible className="mt-8 mb-8 overflow-hidden rounded-lg border">
+                  <CollapsibleTrigger className="group/section flex w-full items-center justify-between px-4 py-3 text-left">
+                    <b>Logging Settings</b>
+                    <ChevronDown className="size-5 shrink-0 text-gray-500 transition-transform group-data-[panel-open]/section:rotate-180" />
+                  </CollapsibleTrigger>
+                  <CollapsibleContent className="px-4 pb-3">
+                    <div className="mt-4">
+                      <PremiumLoggingSettings
+                        value={loggingSettings}
+                        onChange={setLoggingSettings}
+                        premiumUser={premiumUser}
+                      />
+                    </div>
+                  </CollapsibleContent>
+                </Collapsible>
 
-              <Collapsible className="mt-8 mb-8 overflow-hidden rounded-lg border">
-                <CollapsibleTrigger className="group/section flex w-full items-center justify-between px-4 py-3 text-left">
-                  <b>Model Aliases</b>
-                  <ChevronDown className="size-5 shrink-0 text-gray-500 transition-transform group-data-[panel-open]/section:rotate-180" />
-                </CollapsibleTrigger>
-                <CollapsibleContent className="px-4 pb-3">
-                  <div className="mt-4">
-                    <Text type="secondary" style={{ fontSize: 14, marginBottom: 16, display: "block" }}>
-                      Create custom aliases for models that can be used by team members in API calls. This allows you to
-                      create shortcuts for specific models.
-                    </Text>
-                    <ModelAliasManager
-                      accessToken={accessToken || ""}
-                      initialModelAliases={modelAliases}
-                      onAliasUpdate={setModelAliases}
-                      showExampleConfig={false}
-                    />
-                  </div>
-                </CollapsibleContent>
-              </Collapsible>
-            </>
-            <div style={{ textAlign: "right", marginTop: "10px" }}>
-              <Button htmlType="submit" data-testid="create-team-submit">
-                Create Team
-              </Button>
-            </div>
-          </Form>
+                <Collapsible
+                  key={`router-settings-accordion-${routerSettingsKey}`}
+                  className="mt-8 mb-8 overflow-hidden rounded-lg border"
+                >
+                  <CollapsibleTrigger className="group/section flex w-full items-center justify-between px-4 py-3 text-left">
+                    <b>Router Settings</b>
+                    <ChevronDown className="size-5 shrink-0 text-gray-500 transition-transform group-data-[panel-open]/section:rotate-180" />
+                  </CollapsibleTrigger>
+                  <CollapsibleContent className="px-4 pb-3">
+                    <div className="mt-4 w-full">
+                      <RouterSettingsAccordion
+                        key={routerSettingsKey}
+                        accessToken={accessToken || ""}
+                        value={routerSettings || undefined}
+                        onChange={setRouterSettings}
+                        modelData={
+                          userModels.length > 0
+                            ? { data: userModels.map((model) => ({ model_name: model })) }
+                            : undefined
+                        }
+                      />
+                    </div>
+                  </CollapsibleContent>
+                </Collapsible>
+
+                <Collapsible className="mt-8 mb-8 overflow-hidden rounded-lg border">
+                  <CollapsibleTrigger className="group/section flex w-full items-center justify-between px-4 py-3 text-left">
+                    <b>Model Aliases</b>
+                    <ChevronDown className="size-5 shrink-0 text-gray-500 transition-transform group-data-[panel-open]/section:rotate-180" />
+                  </CollapsibleTrigger>
+                  <CollapsibleContent className="px-4 pb-3">
+                    <div className="mt-4">
+                      <p className="mb-4 block text-sm text-muted-foreground">
+                        Create custom aliases for models that can be used by team members in API calls. This allows you
+                        to create shortcuts for specific models.
+                      </p>
+                      <ModelAliasManager
+                        accessToken={accessToken || ""}
+                        initialModelAliases={modelAliases}
+                        onAliasUpdate={setModelAliases}
+                        showExampleConfig={false}
+                      />
+                    </div>
+                  </CollapsibleContent>
+                </Collapsible>
+              </FieldGroup>
+              <div className="mt-[10px] text-right">
+                <UIButton type="submit" data-testid="create-team-submit">
+                  Create Team
+                </UIButton>
+              </div>
+            </form>
+          </TooltipProvider>
         </Modal>
       )}
     </Content>
diff --git a/ui/litellm-dashboard/src/components/UsagePage/components/EntityUsage/TopKeyView.tsx b/ui/litellm-dashboard/src/components/UsagePage/components/EntityUsage/TopKeyView.tsx
index 2993f549c65..b3c1be62e88 100644
--- a/ui/litellm-dashboard/src/components/UsagePage/components/EntityUsage/TopKeyView.tsx
+++ b/ui/litellm-dashboard/src/components/UsagePage/components/EntityUsage/TopKeyView.tsx
@@ -3,7 +3,8 @@ import { BarChart } from "@/components/shared/charts";
 import { DataTable } from "@/components/shared/DataTable";
 import { IdCell, MoneyCell } from "@/components/shared/table_cells";
 import { ChevronDownIcon, ChevronUpIcon } from "@heroicons/react/outline";
-import { Segmented, Tooltip } from "antd";
+import { SimpleTooltip } from "@/components/ui/tooltip";
+import { Segmented } from "antd";
 import React, { useState } from "react";
 import { formatNumberWithCommas } from "../../../../utils/dataUtils";
 import { transformKeyInfo } from "../../../key_team_helpers/transform_key_info";
@@ -113,9 +114,9 @@ const TopKeyView: React.FC<TopKeyViewProps> = ({ topKeys, teams, showTags = fals
         <div className="overflow-hidden">
           <div className="flex flex-wrap items-center gap-1">
             {displayTags.map((tag, index) => (
-              <Tooltip
+              <SimpleTooltip
                 key={index}
-                title={
+                content={
                   <div>
                     <div>
                       <span className="text-gray-300">Tag Name:</span> {tag.tag}
@@ -128,7 +129,7 @@ const TopKeyView: React.FC<TopKeyViewProps> = ({ topKeys, teams, showTags = fals
                 }
               >
                 <span className="px-2 py-1 bg-gray-100 rounded-full text-xs">{tag.tag.slice(0, 7)}...</span>
-              </Tooltip>
+              </SimpleTooltip>
             ))}
             {hasMoreTags && (
               <button
diff --git a/ui/litellm-dashboard/src/components/add_model/AddModelForm.test.tsx b/ui/litellm-dashboard/src/components/add_model/AddModelForm.test.tsx
index 040ea2cb440..26bd9af94a8 100644
--- a/ui/litellm-dashboard/src/components/add_model/AddModelForm.test.tsx
+++ b/ui/litellm-dashboard/src/components/add_model/AddModelForm.test.tsx
@@ -1,11 +1,12 @@
 import { renderHook, screen, waitFor, renderWithProviders } from "../../../tests/test-utils";
-import userEvent from "@testing-library/user-event";
-import { Form } from "antd";
+import userEvent, { PointerEventsCheckLevel } from "@testing-library/user-event";
 import type { UploadProps } from "antd/es/upload";
 import { describe, expect, it, vi } from "vitest";
 import type { Team } from "../key_team_helpers/key_list";
 import type { CredentialItem } from "../networking";
 import { Providers } from "../provider_info_helpers";
+import { projectMountedValues, useMountRegistry, type MountedFormValues } from "../common_components/MountedFormField";
+import { useForm } from "react-hook-form";
 import AddModelForm from "./AddModelForm";
 
 vi.mock("../molecules/models/ProviderLogo", () => ({
@@ -131,8 +132,12 @@ const testTeam: Team = {
 };
 
 const createTestProps = (userRole = "proxy_admin", userId = "user-1", isTeamAdmin = false) => {
-  const { result } = renderHook(() => Form.useForm());
-  const [form] = result.current;
+  const { result } = renderHook(() => {
+    const form = useForm<MountedFormValues>({ mode: "onChange" });
+    const registry = useMountRegistry();
+    return { form, registry };
+  });
+  const { form, registry } = result.current;
 
   const teams = [
     {
@@ -159,7 +164,9 @@ const createTestProps = (userRole = "proxy_admin", userId = "user-1", isTeamAdmi
 
   return {
     form,
-    handleOk: vi.fn(),
+    registry,
+    mountedValues: () => projectMountedValues(registry, form.getValues),
+    handleOk: vi.fn().mockResolvedValue(true),
     setSelectedProvider: vi.fn(),
     setProviderModelsFn: vi.fn(),
     getPlaceholder: vi.fn((provider: Providers) => `Enter ${provider} model name`),
@@ -310,4 +317,81 @@ describe("AddModelForm", () => {
     expect((await screen.findAllByRole("button", { name: "Test Connect" })).length).toBeGreaterThan(0);
     expect(await screen.findByRole("button", { name: "Add Model" })).toBeInTheDocument();
   });
+
+  describe("cache control bindings reach the parent form store", () => {
+    const renderWithForm = async () => {
+      const mockUseAuthorized = vi.mocked(await import("@/app/(dashboard)/hooks/useAuthorized"));
+      mockUseAuthorized.default.mockReturnValue(mockAuthorizedUser("proxy_admin", "user-1", true));
+      const props = createTestProps();
+      const user = userEvent.setup({ pointerEventsCheck: PointerEventsCheckLevel.Never });
+      renderWithProviders(<AddModelForm {...props} />);
+      await screen.findByText("Provider");
+
+      return {
+        user,
+        openCacheControl: async () => {
+          await user.click(await screen.findByText("Advanced Settings"));
+          await user.click(screen.getByLabelText("Cache Control Injection Points"));
+          await screen.findByText("Add Injection Point");
+        },
+        closeCacheControl: async () => {
+          await user.click(screen.getByLabelText("Cache Control Injection Points"));
+          await waitFor(() => expect(screen.queryByText("Add Injection Point")).not.toBeInTheDocument());
+        },
+        mountedValues: async (): Promise<Record<string, unknown>> => props.mountedValues(),
+      };
+    };
+
+    it("omits both cache control keys while the section is untouched", async () => {
+      const { mountedValues } = await renderWithForm();
+      const values = await mountedValues();
+      expect(values).not.toHaveProperty("cache_control_injection_points");
+      expect(values.cache_control).toBeUndefined();
+    });
+
+    it("sends the seeded injection point once the toggle is on", async () => {
+      const { openCacheControl, mountedValues } = await renderWithForm();
+      await openCacheControl();
+      const values = await mountedValues();
+      expect(values.cache_control).toBe(true);
+      expect(values.cache_control_injection_points).toEqual([{ location: "message" }]);
+    });
+
+    it("carries an edited role and keeps the index a string, as the antd control did", async () => {
+      const { user, openCacheControl, mountedValues } = await renderWithForm();
+      await openCacheControl();
+
+      await user.click(screen.getByText("Select a role"));
+      await user.click(await screen.findByText("System"));
+      await user.type(screen.getByPlaceholderText("Optional"), "3");
+
+      const values = await mountedValues();
+      expect(values.cache_control_injection_points).toEqual([{ location: "message", role: "system", index: "3" }]);
+    });
+
+    it("adds a second injection point row", async () => {
+      const { user, openCacheControl, mountedValues } = await renderWithForm();
+      await openCacheControl();
+
+      await user.click(screen.getByText("Add Injection Point"));
+      await waitFor(() => expect(screen.getAllByPlaceholderText("Optional")).toHaveLength(2));
+      await user.type(screen.getAllByPlaceholderText("Optional")[1], "7");
+
+      const values = await mountedValues();
+      expect(values.cache_control_injection_points).toEqual([
+        { location: "message" },
+        { location: "message", index: "7" },
+      ]);
+    });
+
+    it("drops the injection points again when the toggle goes back off", async () => {
+      const { openCacheControl, closeCacheControl, mountedValues } = await renderWithForm();
+      await openCacheControl();
+      await closeCacheControl();
+
+      const values = await mountedValues();
+      expect(values.cache_control).toBe(false);
+      expect(values).not.toHaveProperty("cache_control_injection_points");
+    });
+  });
 });
diff --git a/ui/litellm-dashboard/src/components/add_model/AddModelForm.tsx b/ui/litellm-dashboard/src/components/add_model/AddModelForm.tsx
index de159207078..4d339737ab0 100644
--- a/ui/litellm-dashboard/src/components/add_model/AddModelForm.tsx
+++ b/ui/litellm-dashboard/src/components/add_model/AddModelForm.tsx
@@ -4,11 +4,20 @@ import { useTags } from "@/app/(dashboard)/hooks/tags/useTags";
 import { all_admin_roles, isUserTeamAdminForAnyTeam } from "@/utils/roles";
 import { modelCreationScope } from "@/utils/modelPermissions";
 import { Switch } from "@/components/ui/switch";
-import type { FormInstance } from "antd";
-import { Select as AntdSelect, Button, Card, Col, Form, Modal, Row, Tooltip, Typography, Alert } from "antd";
+import { Field, FieldLabel } from "@/components/shared/form/field";
+import { Select as AntdSelect, Button, Card, Col, Modal, Row, Tooltip, Typography, Alert } from "antd";
 import type { UploadProps } from "antd/es/upload";
 import React, { useEffect, useMemo, useState } from "react";
+import { FormProvider, useWatch, type UseFormReturn } from "react-hook-form";
 import TeamDropdown from "../common_components/team_dropdown";
+import { antdRequired } from "../common_components/antdFormRules";
+import { labelWithHint } from "@/components/shared/form/LabelWithHint";
+import {
+  MountedFormField,
+  MountedFormProvider,
+  type MountRegistry,
+  type MountedFormValues,
+} from "../common_components/MountedFormField";
 import type { Team } from "../key_team_helpers/key_list";
 import { type CredentialItem, type ProviderCreateInfo, modelAvailableCall } from "../networking";
 import { Providers } from "../provider_info_helpers";
@@ -22,8 +31,10 @@ import { TEST_MODES } from "./add_model_modes";
 import useAuthorized from "@/app/(dashboard)/hooks/useAuthorized";
 
 interface AddModelFormProps {
-  form: FormInstance; // For the Add Model tab
-  handleOk: () => Promise<void>;
+  form: UseFormReturn<MountedFormValues>; // For the Add Model tab
+  registry: MountRegistry;
+  mountedValues: () => MountedFormValues;
+  handleOk: () => Promise<boolean>;
   selectedProvider: Providers;
   setSelectedProvider: (provider: Providers) => void;
   providerModels: string[];
@@ -36,10 +47,20 @@ interface AddModelFormProps {
   credentials: CredentialItem[];
 }
 
+const connectionTestModelName = (values: MountedFormValues): string | undefined => {
+  const named = values.model_name || values.model;
+  if (Array.isArray(named)) {
+    return named.join(", ");
+  }
+  return typeof named === "string" ? named : undefined;
+};
+
 const { Title, Link } = Typography;
 
 const AddModelForm: React.FC<AddModelFormProps> = ({
   form,
+  registry,
+  mountedValues,
   handleOk,
   selectedProvider,
   setSelectedProvider,
@@ -67,6 +88,7 @@ const AddModelForm: React.FC<AddModelFormProps> = ({
   const { data: guardrailsData } = useGuardrails();
   const guardrailsList = guardrailsData?.guardrails.map((g) => g.guardrail_name);
   const { data: tagsList } = useTags();
+  const selectedCredentialName = useWatch({ control: form.control, name: "litellm_credential_name" });
 
   const handleTestConnection = async () => {
     setIsTestingConnection(true);
@@ -112,274 +134,302 @@ const AddModelForm: React.FC<AddModelFormProps> = ({
       <Title level={2}>Add Model</Title>
 
       <Card>
-        <Form
-          form={form}
-          onFinish={async (values) => {
-            await handleOk().then(() => {
-              setTeamAdminSelectedTeam(null);
-            });
-          }}
-          onFinishFailed={(errorInfo) => {}}
-          labelCol={{ span: 10 }}
-          wrapperCol={{ span: 16 }}
-          labelAlign="left"
-        >
-          <>
-            {requiresTeamScope && (
-              <>
-                <Form.Item
-                  label="Select Team"
-                  name="team_id"
-                  rules={[{ required: true, message: "Please select a team to continue" }]}
-                  tooltip="Select the team for which you want to add this model"
-                >
-                  <TeamDropdown
-                    onChange={(value) => {
-                      setTeamAdminSelectedTeam(value);
-                    }}
-                  />
-                </Form.Item>
-                {!teamAdminSelectedTeam && (
-                  <Alert
-                    message="Team Selection Required"
-                    description="As a team admin, you need to select your team first before adding models."
-                    type="info"
-                    showIcon
-                    className="mb-4"
-                  />
-                )}
-              </>
-            )}
-            {(isAdmin || (isTeamAdmin && teamAdminSelectedTeam)) && (
-              <>
-                <Form.Item
-                  rules={[{ required: true, message: "Required" }]}
-                  label="Provider:"
-                  name="custom_llm_provider"
-                  tooltip="E.g. OpenAI, Azure OpenAI, Anthropic, Bedrock, etc."
-                  labelCol={{ span: 10 }}
-                  labelAlign="left"
-                >
-                  <AntdSelect
-                    virtual={false}
-                    showSearch
-                    loading={isProviderMetadataLoading}
-                    placeholder={isProviderMetadataLoading ? "Loading providers..." : "Select a provider"}
-                    optionFilterProp="data-label"
-                    onChange={(value) => {
-                      setSelectedProvider(value as Providers);
-                      setProviderModelsFn(value as Providers);
-                      form.setFieldsValue({
-                        custom_llm_provider: value,
-                      });
-                      form.setFieldsValue({
-                        model: [],
-                        model_name: undefined,
-                      });
-                    }}
-                  >
-                    {providerMetadataErrorText && sortedProviderMetadata.length === 0 && (
-                      <AntdSelect.Option key="__error" value="">
-                        {providerMetadataErrorText}
-                      </AntdSelect.Option>
-                    )}
-                    {sortedProviderMetadata.map((providerInfo) => {
-                      const displayName = providerInfo.provider_display_name;
-                      const providerKey = providerInfo.provider;
-
-                      return (
-                        <AntdSelect.Option key={providerKey} value={providerKey} data-label={displayName}>
-                          <div className="flex items-center space-x-2">
-                            <ProviderLogo provider={providerKey} className="w-5 h-5" />
-                            <span>{displayName}</span>
-                          </div>
-                        </AntdSelect.Option>
-                      );
-                    })}
-                  </AntdSelect>
-                </Form.Item>
-                <LiteLLMModelNameField
-                  selectedProvider={selectedProvider}
-                  providerModels={providerModels}
-                  getPlaceholder={getPlaceholder}
-                />
-
-                {/* Conditionally Render "Public Model Name" */}
-                <ConditionalPublicModelName />
-
-                {/* Select Mode */}
-                <Form.Item label="Mode" name="mode" className="mb-1">
-                  <AntdSelect
-                    style={{ width: "100%" }}
-                    value={testMode}
-                    onChange={(value) => setTestMode(value)}
-                    options={TEST_MODES}
-                  />
-                </Form.Item>
-                <Row>
-                  <Col span={10}></Col>
-                  <Col span={10}>
-                    <p className="text-sm mb-5 mt-1">
-                      <strong>Optional</strong> - LiteLLM endpoint to use when health checking this model{" "}
-                      <Link href="https://docs.litellm.ai/docs/proxy/health#health" target="_blank">
-                        Learn more
-                      </Link>
-                    </p>
-                  </Col>
-                </Row>
-
-                {/* Credentials */}
-                <div className="mb-4">
-                  <Typography.Text className="text-sm text-gray-500 mb-2">
-                    Either select existing credentials OR enter new provider credentials below
-                  </Typography.Text>
-                </div>
-
-                <Form.Item label="Existing Credentials" name="litellm_credential_name" initialValue={null}>
-                  <AntdSelect
-                    showSearch
-                    placeholder="Select or search for existing credentials"
-                    optionFilterProp="children"
-                    filterOption={(input, option) => (option?.label ?? "").toLowerCase().includes(input.toLowerCase())}
-                    options={[
-                      { value: null, label: "None" },
-                      ...credentials.map((credential) => ({
-                        value: credential.credential_name,
-                        label: credential.credential_name,
-                      })),
-                    ]}
-                    allowClear
-                  />
-                </Form.Item>
-
-                <Form.Item
-                  noStyle
-                  shouldUpdate={(prevValues, currentValues) =>
-                    prevValues.litellm_credential_name !== currentValues.litellm_credential_name ||
-                    prevValues.provider !== currentValues.provider
+        <FormProvider {...form}>
+          <MountedFormProvider value={{ control: form.control, registry }}>
+            <form
+              onSubmit={(event) => {
+                event.preventDefault();
+                void handleOk().then((submitted) => {
+                  if (submitted) {
+                    setTeamAdminSelectedTeam(null);
                   }
-                >
-                  {({ getFieldValue }) => {
-                    const credentialName = getFieldValue("litellm_credential_name");
-                    // Only show provider specific fields if no credentials selected
-                    if (!credentialName) {
-                      return (
-                        <>
-                          <div className="flex items-center my-4">
-                            <div className="grow border-t border-gray-200"></div>
-                            <span className="px-4 text-gray-500 text-sm">OR</span>
-                            <div className="grow border-t border-gray-200"></div>
-                          </div>
-                          <ProviderSpecificFields selectedProvider={selectedProvider} uploadProps={uploadProps} />
-                        </>
-                      );
-                    }
-                    return null;
-                  }}
-                </Form.Item>
-                <div className="flex items-center my-4">
-                  <div className="grow border-t border-gray-200"></div>
-                  <span className="px-4 text-gray-500 text-sm">Additional Model Info Settings</span>
-                  <div className="grow border-t border-gray-200"></div>
-                </div>
-                {/* Team-only Model Switch - Only show for proxy admins, not team admins */}
-                {(isAdmin || !isTeamAdmin) && (
-                  <Form.Item
-                    label="Team-BYOK Model"
-                    tooltip="Only use this model + credential combination for this team. Useful when teams want to onboard their own OpenAI keys."
-                    className="mb-4"
-                  >
-                    <Tooltip
-                      title={
-                        !premiumUser
-                          ? "This is an enterprise-only feature. Upgrade to premium to restrict model+credential combinations to a specific team."
-                          : ""
-                      }
-                      placement="top"
-                    >
-                      <span className="inline-flex">
-                        <Switch
-                          checked={isTeamOnly}
-                          onCheckedChange={(checked) => {
-                            setIsTeamOnly(checked);
-                            if (!checked) {
-                              form.setFieldValue("team_id", undefined);
-                            }
-                          }}
-                          disabled={!premiumUser}
-                          aria-label="Team-BYOK Model"
-                        />
-                      </span>
-                    </Tooltip>
-                  </Form.Item>
-                )}
-
-                {/* Conditional Team Selection */}
-                {isTeamOnly && !requiresTeamScope && (
-                  <Form.Item
-                    label="Select Team"
-                    name="team_id"
-                    className="mb-4"
-                    tooltip="Only keys for this team will be able to call this model."
-                    rules={[
-                      {
-                        required: isTeamOnly && !isAdmin,
-                        message: "Please select a team.",
-                      },
-                    ]}
-                  >
-                    <TeamDropdown disabled={!premiumUser} />
-                  </Form.Item>
-                )}
-                {isAdmin && (
+                });
+              }}
+            >
+              <>
+                {requiresTeamScope && (
                   <>
-                    <Form.Item
-                      label="Model Access Group"
-                      name="model_access_group"
+                    <MountedFormField
+                      label={labelWithHint("Select Team", "Select the team for which you want to add this model")}
+                      name="team_id"
+                      required
+                      rules={{ validate: { required: antdRequired("Please select a team to continue") } }}
                       className="mb-4"
-                      tooltip="Use model access groups to give users access to select models, and add new ones to the group over time."
                     >
-                      <AntdSelect
-                        mode="tags"
-                        showSearch
-                        placeholder="Select existing groups or type to create new ones"
-                        optionFilterProp="children"
-                        tokenSeparators={[","]}
-                        options={modelAccessGroups.map((group) => ({
-                          value: group,
-                          label: group,
-                        }))}
-                        maxTagCount="responsive"
-                        allowClear
+                      {(control) => (
+                        <TeamDropdown
+                          value={control.value as string | undefined}
+                          onChange={(value) => {
+                            control.onChange(value);
+                            setTeamAdminSelectedTeam(value);
+                          }}
+                        />
+                      )}
+                    </MountedFormField>
+                    {!teamAdminSelectedTeam && (
+                      <Alert
+                        message="Team Selection Required"
+                        description="As a team admin, you need to select your team first before adding models."
+                        type="info"
+                        showIcon
+                        className="mb-4"
                       />
-                    </Form.Item>
+                    )}
                   </>
                 )}
-                <AdvancedSettings
-                  showAdvancedSettings={showAdvancedSettings}
-                  setShowAdvancedSettings={setShowAdvancedSettings}
-                  teams={teams}
-                  guardrailsList={guardrailsList || []}
-                  tagsList={tagsList || {}}
-                  accessToken={accessToken || ""}
-                />
+                {(isAdmin || (isTeamAdmin && teamAdminSelectedTeam)) && (
+                  <>
+                    <MountedFormField
+                      label={labelWithHint("Provider", "E.g. OpenAI, Azure OpenAI, Anthropic, Bedrock, etc.")}
+                      name="custom_llm_provider"
+                      required
+                      rules={{ validate: { required: antdRequired("Required") } }}
+                      className="mb-4"
+                    >
+                      {(control) => (
+                        <AntdSelect
+                          id={control.id}
+                          virtual={false}
+                          showSearch
+                          loading={isProviderMetadataLoading}
+                          placeholder={isProviderMetadataLoading ? "Loading providers..." : "Select a provider"}
+                          optionFilterProp="data-label"
+                          value={control.value as string | undefined}
+                          onBlur={control.onBlur}
+                          onChange={(value) => {
+                            control.onChange(value);
+                            setSelectedProvider(value as Providers);
+                            setProviderModelsFn(value as Providers);
+                            form.setValue("model", []);
+                            form.setValue("model_name", undefined);
+                          }}
+                        >
+                          {providerMetadataErrorText && sortedProviderMetadata.length === 0 && (
+                            <AntdSelect.Option key="__error" value="">
+                              {providerMetadataErrorText}
+                            </AntdSelect.Option>
+                          )}
+                          {sortedProviderMetadata.map((providerInfo) => {
+                            const displayName = providerInfo.provider_display_name;
+                            const providerKey = providerInfo.provider;
+
+                            return (
+                              <AntdSelect.Option key={providerKey} value={providerKey} data-label={displayName}>
+                                <div className="flex items-center space-x-2">
+                                  <ProviderLogo provider={providerKey} className="w-5 h-5" />
+                                  <span>{displayName}</span>
+                                </div>
+                              </AntdSelect.Option>
+                            );
+                          })}
+                        </AntdSelect>
+                      )}
+                    </MountedFormField>
+                    <LiteLLMModelNameField
+                      selectedProvider={selectedProvider}
+                      providerModels={providerModels}
+                      getPlaceholder={getPlaceholder}
+                    />
+
+                    {/* Conditionally Render "Public Model Name" */}
+                    <ConditionalPublicModelName />
+
+                    {/* Select Mode */}
+                    <MountedFormField label="Mode" name="mode" className="mb-1">
+                      {(control) => (
+                        <AntdSelect
+                          id={control.id}
+                          style={{ width: "100%" }}
+                          value={control.value as string | undefined}
+                          onBlur={control.onBlur}
+                          onChange={(value) => {
+                            control.onChange(value);
+                            setTestMode(value);
+                          }}
+                          options={TEST_MODES}
+                        />
+                      )}
+                    </MountedFormField>
+                    <Row>
+                      <Col span={10}></Col>
+                      <Col span={10}>
+                        <p className="text-sm mb-5 mt-1">
+                          <strong>Optional</strong> - LiteLLM endpoint to use when health checking this model{" "}
+                          <Link href="https://docs.litellm.ai/docs/proxy/health#health" target="_blank">
+                            Learn more
+                          </Link>
+                        </p>
+                      </Col>
+                    </Row>
+
+                    {/* Credentials */}
+                    <div className="mb-4">
+                      <Typography.Text className="text-sm text-muted-foreground mb-2">
+                        Either select existing credentials OR enter new provider credentials below
+                      </Typography.Text>
+                    </div>
+
+                    <MountedFormField
+                      label="Existing Credentials"
+                      name="litellm_credential_name"
+                      defaultValue={null}
+                      className="mb-4"
+                    >
+                      {(control) => (
+                        <AntdSelect
+                          id={control.id}
+                          showSearch
+                          placeholder="Select or search for existing credentials"
+                          optionFilterProp="children"
+                          filterOption={(input, option) =>
+                            (option?.label ?? "").toLowerCase().includes(input.toLowerCase())
+                          }
+                          value={control.value as string | null | undefined}
+                          onChange={control.onChange}
+                          onBlur={control.onBlur}
+                          options={[
+                            { value: null, label: "None" },
+                            ...credentials.map((credential) => ({
+                              value: credential.credential_name,
+                              label: credential.credential_name,
+                            })),
+                          ]}
+                          allowClear
+                        />
+                      )}
+                    </MountedFormField>
+
+                    {/* Only show provider specific fields if no credentials selected */}
+                    {!selectedCredentialName && (
+                      <>
+                        <div className="flex items-center my-4">
+                          <div className="grow border-t border-border"></div>
+                          <span className="px-4 text-muted-foreground text-sm">OR</span>
+                          <div className="grow border-t border-border"></div>
+                        </div>
+                        <ProviderSpecificFields selectedProvider={selectedProvider} uploadProps={uploadProps} />
+                      </>
+                    )}
+                    <div className="flex items-center my-4">
+                      <div className="grow border-t border-border"></div>
+                      <span className="px-4 text-muted-foreground text-sm">Additional Model Info Settings</span>
+                      <div className="grow border-t border-border"></div>
+                    </div>
+                    {/* Team-only Model Switch - Only show for proxy admins, not team admins */}
+                    {(isAdmin || !isTeamAdmin) && (
+                      <Field className="mb-4">
+                        <FieldLabel>
+                          {labelWithHint(
+                            "Team-BYOK Model",
+                            "Only use this model + credential combination for this team. Useful when teams want to onboard their own OpenAI keys.",
+                          )}
+                        </FieldLabel>
+                        <Tooltip
+                          title={
+                            !premiumUser
+                              ? "This is an enterprise-only feature. Upgrade to premium to restrict model+credential combinations to a specific team."
+                              : ""
+                          }
+                          placement="top"
+                        >
+                          <span className="inline-flex">
+                            <Switch
+                              checked={isTeamOnly}
+                              onCheckedChange={(checked) => {
+                                setIsTeamOnly(checked);
+                                if (!checked) {
+                                  form.setValue("team_id", undefined);
+                                }
+                              }}
+                              disabled={!premiumUser}
+                              aria-label="Team-BYOK Model"
+                            />
+                          </span>
+                        </Tooltip>
+                      </Field>
+                    )}
+
+                    {/* Conditional Team Selection */}
+                    {isTeamOnly && !requiresTeamScope && (
+                      <MountedFormField
+                        label={labelWithHint("Select Team", "Only keys for this team will be able to call this model.")}
+                        name="team_id"
+                        className="mb-4"
+                        required={isTeamOnly && !isAdmin}
+                        rules={
+                          isTeamOnly && !isAdmin
+                            ? { validate: { required: antdRequired("Please select a team.") } }
+                            : undefined
+                        }
+                      >
+                        {(control) => (
+                          <TeamDropdown
+                            value={control.value as string | undefined}
+                            onChange={control.onChange}
+                            disabled={!premiumUser}
+                          />
+                        )}
+                      </MountedFormField>
+                    )}
+                    {isAdmin && (
+                      <>
+                        <MountedFormField
+                          label={labelWithHint(
+                            "Model Access Group",
+                            "Use model access groups to give users access to select models, and add new ones to the group over time.",
+                          )}
+                          name="model_access_group"
+                          className="mb-4"
+                        >
+                          {(control) => (
+                            <AntdSelect
+                              id={control.id}
+                              mode="tags"
+                              showSearch
+                              placeholder="Select existing groups or type to create new ones"
+                              optionFilterProp="children"
+                              tokenSeparators={[","]}
+                              value={control.value as string[] | undefined}
+                              onChange={control.onChange}
+                              onBlur={control.onBlur}
+                              options={modelAccessGroups.map((group) => ({
+                                value: group,
+                                label: group,
+                              }))}
+                              maxTagCount="responsive"
+                              allowClear
+                            />
+                          )}
+                        </MountedFormField>
+                      </>
+                    )}
+                    <AdvancedSettings
+                      showAdvancedSettings={showAdvancedSettings}
+                      setShowAdvancedSettings={setShowAdvancedSettings}
+                      teams={teams}
+                      guardrailsList={guardrailsList || []}
+                      tagsList={tagsList || {}}
+                      accessToken={accessToken || ""}
+                    />
+                  </>
+                )}
+                <div className="flex justify-between items-center mb-4">
+                  <Tooltip title="Get help on our github">
+                    <Typography.Link href="https://github.com/BerriAI/litellm/issues">Need Help?</Typography.Link>
+                  </Tooltip>
+                  <div className="space-x-2">
+                    <Button data-testid="test-connect-btn" onClick={handleTestConnection} loading={isTestingConnection}>
+                      Test Connect
+                    </Button>
+                    <Button data-testid="add-model-btn" htmlType="submit">
+                      Add Model
+                    </Button>
+                  </div>
+                </div>
               </>
-            )}
-            <div className="flex justify-between items-center mb-4">
-              <Tooltip title="Get help on our github">
-                <Typography.Link href="https://github.com/BerriAI/litellm/issues">Need Help?</Typography.Link>
-              </Tooltip>
-              <div className="space-x-2">
-                <Button data-testid="test-connect-btn" onClick={handleTestConnection} loading={isTestingConnection}>
-                  Test Connect
-                </Button>
-                <Button data-testid="add-model-btn" htmlType="submit">
-                  Add Model
-                </Button>
-              </div>
-            </div>
-          </>
-        </Form>
+            </form>
+          </MountedFormProvider>
+        </FormProvider>
       </Card>
 
       {/* Test Connection Results Modal */}
@@ -408,10 +458,10 @@ const AddModelForm: React.FC<AddModelFormProps> = ({
           <ConnectionErrorDisplay
             // The key prop tells React to create a fresh component instance when it changes
             key={connectionTestId}
-            formValues={form.getFieldsValue()}
+            formValues={mountedValues()}
             accessToken={accessToken}
             testMode={testMode}
-            modelName={form.getFieldValue("model_name") || form.getFieldValue("model")}
+            modelName={connectionTestModelName(form.getValues())}
             onClose={() => {
               setIsResultModalVisible(false);
               setIsTestingConnection(false);
diff --git a/ui/litellm-dashboard/src/components/add_model/ClassificationMethodConfig.tsx b/ui/litellm-dashboard/src/components/add_model/ClassificationMethodConfig.tsx
index 03d8fbc2394..8d42b34a14b 100644
--- a/ui/litellm-dashboard/src/components/add_model/ClassificationMethodConfig.tsx
+++ b/ui/litellm-dashboard/src/components/add_model/ClassificationMethodConfig.tsx
@@ -1,5 +1,6 @@
 import { InfoCircleOutlined } from "@ant-design/icons";
-import { Select as AntdSelect, Card, InputNumber, Radio, Space, Switch, Tooltip, Typography } from "antd";
+import { SimpleTooltip } from "@/components/ui/tooltip";
+import { Select as AntdSelect, Card, InputNumber, Radio, Space, Switch, Typography } from "antd";
 import React from "react";
 import ClassifierPromptEditor from "./ClassifierPromptEditor";
 import HeuristicScoringConfig from "./HeuristicScoringConfig";
@@ -286,11 +287,14 @@ const ClassificationMethodConfig: React.FC<ClassificationMethodConfigProps> = ({
           <div>
             <div className="flex items-center gap-2 mb-1">
               <Text strong>Classification Rubric</Text>
-              <Tooltip title="Every rubric uses the same four tiers and the same tier definitions. They differ only in the worked examples that show the classifier where the boundary between tiers sits.">
+              <SimpleTooltip content="Every rubric uses the same four tiers and the same tier definitions. They differ only in the worked examples that show the classifier where the boundary between tiers sits.">
                 <InfoCircleOutlined className="text-gray-400" />
-              </Tooltip>
+              </SimpleTooltip>
             </div>
-            <Tooltip title={usesCustomPrompt ? "Your custom prompt replaces the built-in rubric entirely" : undefined}>
+            <SimpleTooltip
+              content={usesCustomPrompt ? "Your custom prompt replaces the built-in rubric entirely" : undefined}
+              className="w-full"
+            >
               <AntdSelect
                 value={classificationRubric}
                 onChange={handleClassificationRubricChange}
@@ -302,7 +306,7 @@ const ClassificationMethodConfig: React.FC<ClassificationMethodConfigProps> = ({
                   label: CLASSIFICATION_RUBRIC_DESCRIPTIONS[preset].label,
                 }))}
               />
-            </Tooltip>
+            </SimpleTooltip>
             <Text type="secondary" style={{ display: "block", fontSize: 12 }}>
               {usesCustomPrompt
                 ? "Not in use: the custom prompt below is the classifier's entire rubric."
@@ -335,8 +339,8 @@ const ClassificationMethodConfig: React.FC<ClassificationMethodConfigProps> = ({
                   <Text type="secondary">— right when the classifier grades complexity too</Text>
                 </Radio>
                 <Radio value="default_model" disabled={!hasDefaultModel}>
-                  <Tooltip
-                    title={
+                  <SimpleTooltip
+                    content={
                       hasDefaultModel
                         ? "Change it from the Default Model select."
                         : "Set a default model on this router to use this option"
@@ -346,7 +350,7 @@ const ClassificationMethodConfig: React.FC<ClassificationMethodConfigProps> = ({
                       <Text>Route to the default model{defaultModel ? ` (${defaultModel})` : ""}</Text>{" "}
                       <Text type="secondary">— right when your prompt grades something other than complexity</Text>
                     </span>
-                  </Tooltip>
+                  </SimpleTooltip>
                 </Radio>
               </Space>
             </Radio.Group>
@@ -393,9 +397,9 @@ const ClassificationMethodConfig: React.FC<ClassificationMethodConfigProps> = ({
                 aria-label="Include Assistant Turns"
               />
               <Text strong>Include Assistant Turns</Text>
-              <Tooltip title="Off by default. Enabling it changes tier decisions, and therefore spend, for an existing router, and sends assistant text to the classifier model, which may be a different provider than the routed model.">
+              <SimpleTooltip content="Off by default. Enabling it changes tier decisions, and therefore spend, for an existing router, and sends assistant text to the classifier model, which may be a different provider than the routed model.">
                 <InfoCircleOutlined className="text-gray-400" />
-              </Tooltip>
+              </SimpleTooltip>
             </div>
             <Text type="secondary" style={{ fontSize: 12 }}>
               Let the classifier read the assistant&apos;s replies, so difficulty the model stated rather than the user
@@ -411,9 +415,9 @@ const ClassificationMethodConfig: React.FC<ClassificationMethodConfigProps> = ({
         <div className="mt-4">
           <div className="flex items-center gap-2 mb-1">
             <Text strong>Custom Technical Keywords</Text>
-            <Tooltip title="Domain-specific terms appended to the built-in technical keyword list. Prompts containing these terms score higher on the technical dimension and route to more capable models.">
+            <SimpleTooltip content="Domain-specific terms appended to the built-in technical keyword list. Prompts containing these terms score higher on the technical dimension and route to more capable models.">
               <InfoCircleOutlined className="text-gray-400" />
-            </Tooltip>
+            </SimpleTooltip>
           </div>
           <Text type="secondary" style={{ display: "block", marginBottom: 8, fontSize: 12 }}>
             Optional: Add terms to the built-in list to improve classification accuracy on the technical dimension.
diff --git a/ui/litellm-dashboard/src/components/add_model/ComplexityRouterConfig.tsx b/ui/litellm-dashboard/src/components/add_model/ComplexityRouterConfig.tsx
index 3d4845ecf39..9f1108639ac 100644
--- a/ui/litellm-dashboard/src/components/add_model/ComplexityRouterConfig.tsx
+++ b/ui/litellm-dashboard/src/components/add_model/ComplexityRouterConfig.tsx
@@ -1,5 +1,6 @@
 import { InfoCircleOutlined } from "@ant-design/icons";
-import { Select as AntdSelect, Card, Collapse, Divider, Input, Space, Switch, Tooltip, Typography } from "antd";
+import { SimpleTooltip } from "@/components/ui/tooltip";
+import { Select as AntdSelect, Card, Collapse, Divider, Input, Space, Switch, Typography } from "antd";
 import React from "react";
 import { ModelGroup } from "@/components/llm_calls/fetch_models";
 import AdaptiveRoutingConfig from "./AdaptiveRoutingConfig";
@@ -249,9 +250,9 @@ const ComplexityRouterConfig: React.FC<ComplexityRouterConfigProps> = ({
         <Typography.Title level={4} style={{ margin: 0 }}>
           Complexity Tier Configuration
         </Typography.Title>
-        <Tooltip title="Map each complexity tier to one or more models. Simple queries use cheaper/faster models, complex queries use more capable models.">
+        <SimpleTooltip content="Map each complexity tier to one or more models. Simple queries use cheaper/faster models, complex queries use more capable models.">
           <InfoCircleOutlined className="text-gray-400" />
-        </Tooltip>
+        </SimpleTooltip>
       </Space>
 
       <Text type="secondary" style={{ display: "block", marginBottom: 24 }}>
@@ -279,9 +280,9 @@ const ComplexityRouterConfig: React.FC<ComplexityRouterConfigProps> = ({
                   <Text strong style={{ fontSize: 16 }}>
                     {label} Tier
                   </Text>
-                  <Tooltip title={tierInfo.description}>
+                  <SimpleTooltip content={tierInfo.description}>
                     <InfoCircleOutlined className="text-gray-400" />
-                  </Tooltip>
+                  </SimpleTooltip>
                   <Text type="secondary" style={{ fontSize: 12 }}>
                     Tier {index + 1} of {TIER_KEYS.length} &middot; {tier}
                   </Text>
@@ -329,9 +330,9 @@ const ComplexityRouterConfig: React.FC<ComplexityRouterConfigProps> = ({
             <Text strong style={{ fontSize: 16 }}>
               Default Model
             </Text>
-            <Tooltip title="Leave empty to follow the tiers. A model chosen here is pinned: it stays the default however the tiers change.">
+            <SimpleTooltip content="Leave empty to follow the tiers. A model chosen here is pinned: it stays the default however the tiers change.">
               <InfoCircleOutlined className="text-gray-400" />
-            </Tooltip>
+            </SimpleTooltip>
           </div>
           <AntdSelect
             value={value.default_model || undefined}
diff --git a/ui/litellm-dashboard/src/components/add_model/EscalationKeywords.tsx b/ui/litellm-dashboard/src/components/add_model/EscalationKeywords.tsx
index c232eb4c801..5d5e2c7b02d 100644
--- a/ui/litellm-dashboard/src/components/add_model/EscalationKeywords.tsx
+++ b/ui/litellm-dashboard/src/components/add_model/EscalationKeywords.tsx
@@ -1,5 +1,6 @@
 import { InfoCircleOutlined } from "@ant-design/icons";
-import { Select as AntdSelect, Tooltip, Typography } from "antd";
+import { SimpleTooltip } from "@/components/ui/tooltip";
+import { Select as AntdSelect, Typography } from "antd";
 import React from "react";
 
 const { Text } = Typography;
@@ -18,9 +19,9 @@ const EscalationKeywords: React.FC<EscalationKeywordsProps> = ({ keywords, onCha
         <Typography.Title level={4} style={{ margin: 0 }}>
           Escalation Keywords
         </Typography.Title>
-        <Tooltip title="Case-sensitive phrases a user can include in their message to force a bump to the next-higher complexity tier when they aren't happy with results. They can force a stronger model, but not choose which one.">
+        <SimpleTooltip content="Case-sensitive phrases a user can include in their message to force a bump to the next-higher complexity tier when they aren't happy with results. They can force a stronger model, but not choose which one.">
           <InfoCircleOutlined className="text-gray-400" />
-        </Tooltip>
+        </SimpleTooltip>
       </div>
       <Text type="secondary" style={{ display: "block", marginBottom: 8, fontSize: 12 }}>
         Optional: when a user message contains one of these phrases, the request is bumped one tier higher than it would
diff --git a/ui/litellm-dashboard/src/components/add_model/KeywordTierRules.tsx b/ui/litellm-dashboard/src/components/add_model/KeywordTierRules.tsx
index 72d6e9f4fef..49fea3d30e7 100644
--- a/ui/litellm-dashboard/src/components/add_model/KeywordTierRules.tsx
+++ b/ui/litellm-dashboard/src/components/add_model/KeywordTierRules.tsx
@@ -1,5 +1,6 @@
 import { DeleteOutlined, InfoCircleOutlined, PlusOutlined } from "@ant-design/icons";
-import { Button, Card, Empty, Select as AntdSelect, Tooltip, Typography } from "antd";
+import { SimpleTooltip } from "@/components/ui/tooltip";
+import { Button, Card, Empty, Select as AntdSelect, Typography } from "antd";
 import React from "react";
 
 import { emptyKeywordTierRuleIndexes } from "./complexity_router_keywords";
@@ -70,9 +71,9 @@ const KeywordTierRules: React.FC<KeywordTierRulesProps> = ({ rules, onChange, ti
           <Typography.Title level={4} style={{ margin: 0 }}>
             Keyword Tier Overrides
           </Typography.Title>
-          <Tooltip title="Match known terms and force the request straight to a chosen complexity tier, bypassing rule-based scoring.">
+          <SimpleTooltip content="Match known terms and force the request straight to a chosen complexity tier, bypassing rule-based scoring.">
             <InfoCircleOutlined className="text-gray-400" />
-          </Tooltip>
+          </SimpleTooltip>
         </div>
         <Button icon={<PlusOutlined />} onClick={addRule}>
           Add keyword rule
diff --git a/ui/litellm-dashboard/src/components/add_model/SemanticKeywordMatching.tsx b/ui/litellm-dashboard/src/components/add_model/SemanticKeywordMatching.tsx
index c2252843b29..867f6a901e8 100644
--- a/ui/litellm-dashboard/src/components/add_model/SemanticKeywordMatching.tsx
+++ b/ui/litellm-dashboard/src/components/add_model/SemanticKeywordMatching.tsx
@@ -1,5 +1,6 @@
 import { InfoCircleOutlined } from "@ant-design/icons";
-import { InputNumber, Select as AntdSelect, Switch, Tooltip, Typography } from "antd";
+import { SimpleTooltip } from "@/components/ui/tooltip";
+import { InputNumber, Select as AntdSelect, Switch, Typography } from "antd";
 import React from "react";
 import { ModelGroup } from "@/components/llm_calls/fetch_models";
 
@@ -41,9 +42,9 @@ const SemanticKeywordMatching: React.FC<SemanticKeywordMatchingProps> = ({
         <div>
           <div className="flex items-center gap-2">
             <Text className="font-medium">Semantic keyword matching</Text>
-            <Tooltip title="Recognize related phrasing beyond exact keyword matches by comparing embeddings instead of plain text. Overrides direct keyword matching">
+            <SimpleTooltip content="Recognize related phrasing beyond exact keyword matches by comparing embeddings instead of plain text. Overrides direct keyword matching">
               <InfoCircleOutlined className="text-gray-400" />
-            </Tooltip>
+            </SimpleTooltip>
           </div>
           <Text className="text-gray-500 text-sm">
             Uses same keyword-tier pairs as above and overrides direct keyword matching. Adds latency based on embedding
diff --git a/ui/litellm-dashboard/src/components/add_model/advanced_settings.test.tsx b/ui/litellm-dashboard/src/components/add_model/advanced_settings.test.tsx
index 4e5c5f25374..01e00d903aa 100644
--- a/ui/litellm-dashboard/src/components/add_model/advanced_settings.test.tsx
+++ b/ui/litellm-dashboard/src/components/add_model/advanced_settings.test.tsx
@@ -1,5 +1,6 @@
 import { act, fireEvent, render, waitFor } from "@testing-library/react";
 import { beforeEach, describe, expect, it, vi } from "vitest";
+import { MountedFormHost } from "../../../tests/mounted-form-host";
 import AdvancedSettings from "./advanced_settings";
 
 const mockUsePtuCostAttributionEnabled = vi.fn();
@@ -12,13 +13,15 @@ const PTU_LABELS = ["PTU Count", "Calculated Cost per PTU / Hour (USD)", "PTU Ef
 
 const renderAdvancedSettings = () =>
   render(
-    <AdvancedSettings
-      showAdvancedSettings={true}
-      setShowAdvancedSettings={() => {}}
-      guardrailsList={[]}
-      tagsList={{}}
-      accessToken="test-token"
-    />,
+    <MountedFormHost>
+      <AdvancedSettings
+        showAdvancedSettings={true}
+        setShowAdvancedSettings={() => {}}
+        guardrailsList={[]}
+        tagsList={{}}
+        accessToken="test-token"
+      />
+    </MountedFormHost>,
   );
 
 describe("AdvancedSettings", () => {
diff --git a/ui/litellm-dashboard/src/components/add_model/advanced_settings.tsx b/ui/litellm-dashboard/src/components/add_model/advanced_settings.tsx
index 00b4c000a43..140b4363327 100644
--- a/ui/litellm-dashboard/src/components/add_model/advanced_settings.tsx
+++ b/ui/litellm-dashboard/src/components/add_model/advanced_settings.tsx
@@ -1,5 +1,5 @@
 import React from "react";
-import { Form, Switch, Select, Tooltip, DatePicker } from "antd";
+import { Switch, Select, Tooltip, DatePicker } from "antd";
 import { ChevronDown } from "lucide-react";
 import { Collapsible, CollapsibleContent, CollapsibleTrigger } from "@/components/ui/collapsible";
 import { Input } from "@/components/ui/input";
@@ -7,7 +7,14 @@ import { Row, Col, Typography } from "antd";
 import TextArea from "antd/es/input/TextArea";
 import { InfoCircleOutlined } from "@ant-design/icons";
 import { Team } from "../key_team_helpers/key_list";
-import CacheControlSettings from "./cache_control_settings";
+import { antdRules } from "../common_components/antdFormRules";
+import { labelWithHint } from "@/components/shared/form/LabelWithHint";
+import { MountedFormField } from "../common_components/MountedFormField";
+import CacheControlInjectionPoints, {
+  CACHE_CONTROL_LABEL,
+  CACHE_CONTROL_TOOLTIP,
+  NEW_CACHE_CONTROL_POINT,
+} from "./cache_control_settings";
 import VectorStoreSelector from "../vector_store_management/VectorStoreSelector";
 import { Tag } from "../tag_management/types";
 import { formItemValidateJSON } from "../../utils/textUtils";
@@ -35,6 +42,31 @@ interface AdvancedSettingsProps {
   accessToken: string;
 }
 
+const USAGE_COST_FIELDS = [
+  "input_cost_per_token",
+  "output_cost_per_token",
+  "cache_read_input_token_cost",
+  "cache_creation_input_token_cost",
+  "input_cost_per_second",
+];
+
+const REVALIDATED_WHEN_PTU_COUNT_CHANGES = [PTU_RATE_FIELD, PTU_START_FIELD, ...USAGE_COST_FIELDS];
+
+const validateNumber = (_: unknown, value: unknown) => {
+  if (!value) {
+    return Promise.resolve();
+  }
+  if (isNaN(Number(value)) || Number(value) < 0) {
+    return Promise.reject("Please enter a valid positive number");
+  }
+  return Promise.resolve();
+};
+
+const usageCostRules = {
+  deps: [PTU_COUNT_FIELD],
+  validate: antdRules({ validator: validateNumber }, ptuNoUsageCostRule(PTU_COUNT_FIELD)),
+};
+
 const AdvancedSettings: React.FC<AdvancedSettingsProps> = ({
   showAdvancedSettings,
   setShowAdvancedSettings,
@@ -43,95 +75,36 @@ const AdvancedSettings: React.FC<AdvancedSettingsProps> = ({
   tagsList,
   accessToken,
 }) => {
-  const [form] = Form.useForm();
   const [customPricing, setCustomPricing] = React.useState(false);
   const [pricingModel, setPricingModel] = React.useState<"per_token" | "per_second">("per_token");
   const [showCacheControl, setShowCacheControl] = React.useState(false);
   const ptuCostAttributionEnabled = usePtuCostAttributionEnabled();
 
-  // Add validation function for numbers
-  const validateNumber = (_: any, value: string) => {
-    if (!value) {
-      return Promise.resolve();
-    }
-    if (isNaN(Number(value)) || Number(value) < 0) {
-      return Promise.reject("Please enter a valid positive number");
-    }
-    return Promise.resolve();
-  };
-
-  // Handle custom pricing changes
-  const handleCustomPricingChange = (checked: boolean) => {
-    setCustomPricing(checked);
-    if (!checked) {
-      // Clear pricing fields when disabled
-      form.setFieldsValue({
-        input_cost_per_token: undefined,
-        output_cost_per_token: undefined,
-        cache_read_input_token_cost: undefined,
-        cache_creation_input_token_cost: undefined,
-        input_cost_per_second: undefined,
-      });
-    }
-  };
-
-  const handlePassThroughChange = (checked: boolean) => {
-    const currentParams = form.getFieldValue("litellm_extra_params");
-    try {
-      let paramsObj = currentParams ? JSON.parse(currentParams) : {};
-      if (checked) {
-        paramsObj.use_in_pass_through = true;
-      } else {
-        delete paramsObj.use_in_pass_through;
-      }
-      // Only set the field value if there are remaining parameters
-      if (Object.keys(paramsObj).length > 0) {
-        form.setFieldValue("litellm_extra_params", JSON.stringify(paramsObj, null, 2));
-      } else {
-        form.setFieldValue("litellm_extra_params", "");
-      }
-    } catch (error) {
-      // If JSON parsing fails, only create new object if checked is true
-      if (checked) {
-        form.setFieldValue("litellm_extra_params", JSON.stringify({ use_in_pass_through: true }, null, 2));
-      } else {
-        form.setFieldValue("litellm_extra_params", "");
-      }
-    }
-  };
-
-  const handleCacheControlChange = (checked: boolean) => {
-    setShowCacheControl(checked);
-    if (!checked) {
-      const currentParams = form.getFieldValue("litellm_extra_params");
-      try {
-        let paramsObj = currentParams ? JSON.parse(currentParams) : {};
-        delete paramsObj.cache_control_injection_points;
-        if (Object.keys(paramsObj).length > 0) {
-          form.setFieldValue("litellm_extra_params", JSON.stringify(paramsObj, null, 2));
-        } else {
-          form.setFieldValue("litellm_extra_params", "");
-        }
-      } catch (error) {
-        form.setFieldValue("litellm_extra_params", "");
-      }
-    }
-  };
-
   return (
     <>
       <Collapsible className="mt-2 mb-4 overflow-hidden rounded-lg border">
         <CollapsibleTrigger className="group/section flex w-full items-center justify-between px-4 py-3 text-left">
           <b>Advanced Settings</b>
-          <ChevronDown className="size-5 shrink-0 text-gray-500 transition-transform group-data-[panel-open]/section:rotate-180" />
+          <ChevronDown className="size-5 shrink-0 text-muted-foreground transition-transform group-data-[panel-open]/section:rotate-180" />
         </CollapsibleTrigger>
         <CollapsibleContent className="px-4 pb-3">
-          <div className="bg-white rounded-lg">
-            <Form.Item label="Custom Pricing" name="custom_pricing" valuePropName="checked" className="mb-4">
-              <Switch onChange={handleCustomPricingChange} className="bg-gray-600" />
-            </Form.Item>
+          <div className="rounded-lg">
+            <MountedFormField name="custom_pricing" label="Custom Pricing" className="mb-4">
+              {(control) => (
+                <Switch
+                  id={control.id}
+                  checked={control.value === true}
+                  onChange={(checked) => {
+                    control.onChange(checked);
+                    setCustomPricing(checked);
+                  }}
+                  className="bg-gray-600"
+                />
+              )}
+            </MountedFormField>
 
-            <Form.Item
+            <MountedFormField
+              name="vector_store_ids"
               label={
                 <span>
                   Attached Knowledge Bases (RAG){" "}
@@ -147,18 +120,21 @@ const AdvancedSettings: React.FC<AdvancedSettingsProps> = ({
                   </Tooltip>
                 </span>
               }
-              name="vector_store_ids"
               className="mt-4"
               help="Select vector stores to attach. Requests to this model will automatically use these for RAG. Set up vector stores in Tools > Vector Stores."
             >
-              <VectorStoreSelector
-                onChange={() => {}}
-                accessToken={accessToken}
-                placeholder="Select knowledge bases (optional)"
-              />
-            </Form.Item>
+              {(control) => (
+                <VectorStoreSelector
+                  onChange={control.onChange}
+                  value={control.value as string[] | undefined}
+                  accessToken={accessToken}
+                  placeholder="Select knowledge bases (optional)"
+                />
+              )}
+            </MountedFormField>
 
-            <Form.Item
+            <MountedFormField
+              name="guardrails"
               label={
                 <span>
                   Guardrails{" "}
@@ -174,189 +150,331 @@ const AdvancedSettings: React.FC<AdvancedSettingsProps> = ({
                   </Tooltip>
                 </span>
               }
-              name="guardrails"
               className="mt-4"
               help="Select existing guardrails. Go to 'Guardrails' tab to create new guardrails."
             >
-              <Select
-                mode="tags"
-                style={{ width: "100%" }}
-                placeholder="Select or enter guardrails"
-                options={guardrailsList.map((name) => ({ value: name, label: name }))}
-              />
-            </Form.Item>
+              {(control) => (
+                <Select
+                  id={control.id}
+                  mode="tags"
+                  style={{ width: "100%" }}
+                  placeholder="Select or enter guardrails"
+                  value={control.value as string[] | undefined}
+                  onChange={control.onChange}
+                  onBlur={control.onBlur}
+                  options={guardrailsList.map((name) => ({ value: name, label: name }))}
+                />
+              )}
+            </MountedFormField>
 
-            <Form.Item label="Tags" name="tags" className="mb-4">
-              <Select
-                mode="tags"
-                style={{ width: "100%" }}
-                placeholder="Select or enter tags"
-                options={Object.values(tagsList).map((tag) => ({
-                  value: tag.name,
-                  label: tag.name,
-                  title: tag.description || tag.name,
-                }))}
-              />
-            </Form.Item>
+            <MountedFormField name="tags" label="Tags" className="mb-4">
+              {(control) => (
+                <Select
+                  id={control.id}
+                  mode="tags"
+                  style={{ width: "100%" }}
+                  placeholder="Select or enter tags"
+                  value={control.value as string[] | undefined}
+                  onChange={control.onChange}
+                  onBlur={control.onBlur}
+                  options={Object.values(tagsList).map((tag) => ({
+                    value: tag.name,
+                    label: tag.name,
+                    title: tag.description || tag.name,
+                  }))}
+                />
+              )}
+            </MountedFormField>
 
             {ptuCostAttributionEnabled && (
               <>
-                <Form.Item
-                  label="PTU Count"
+                <MountedFormField
                   name={PTU_COUNT_FIELD}
-                  dependencies={[PTU_RATE_FIELD]}
-                  rules={[{ validator: validateNumber }, ...ptuCountRules, ptuPairRule(PTU_RATE_FIELD)]}
-                  tooltip="Provisioned throughput units for this deployment. Set together with Cost per PTU / Hour and a Team to attribute a flat daily cost."
+                  label={labelWithHint(
+                    "PTU Count",
+                    "Provisioned throughput units for this deployment. Set together with Cost per PTU / Hour and a Team to attribute a flat daily cost.",
+                  )}
+                  rules={{
+                    deps: REVALIDATED_WHEN_PTU_COUNT_CHANGES,
+                    validate: antdRules({ validator: validateNumber }, ...ptuCountRules, ptuPairRule(PTU_RATE_FIELD)),
+                  }}
                   className="mb-4"
                 >
-                  <Input placeholder="e.g. 15" />
-                </Form.Item>
+                  {(control) => (
+                    <Input
+                      id={control.id}
+                      value={(control.value as string | undefined) ?? ""}
+                      onChange={control.onChange}
+                      onBlur={control.onBlur}
+                      placeholder="e.g. 15"
+                    />
+                  )}
+                </MountedFormField>
 
-                <Form.Item
-                  label="Calculated Cost per PTU / Hour (USD)"
+                <MountedFormField
                   name={PTU_RATE_FIELD}
-                  dependencies={[PTU_COUNT_FIELD]}
-                  rules={[{ validator: validateNumber }, ...ptuRateRules, ptuPairRule(PTU_COUNT_FIELD)]}
-                  tooltip="Flat cost = PTU count * this rate * active hours, attributed to the deployment's team."
+                  label={labelWithHint(
+                    "Calculated Cost per PTU / Hour (USD)",
+                    "Flat cost = PTU count * this rate * active hours, attributed to the deployment's team.",
+                  )}
+                  rules={{
+                    deps: [PTU_COUNT_FIELD],
+                    validate: antdRules({ validator: validateNumber }, ...ptuRateRules, ptuPairRule(PTU_COUNT_FIELD)),
+                  }}
                   className="mb-4"
                 >
-                  <Input placeholder="e.g. 2.00" />
-                </Form.Item>
+                  {(control) => (
+                    <Input
+                      id={control.id}
+                      value={(control.value as string | undefined) ?? ""}
+                      onChange={control.onChange}
+                      onBlur={control.onBlur}
+                      placeholder="e.g. 2.00"
+                    />
+                  )}
+                </MountedFormField>
 
-                <Form.Item
-                  label="PTU Effective From (UTC)"
+                <MountedFormField
                   name={PTU_START_FIELD}
-                  dependencies={[PTU_COUNT_FIELD, PTU_END_FIELD]}
-                  rules={[ptuStartRequiredRule(PTU_COUNT_FIELD), ptuWindowOrderRule(PTU_END_FIELD, "start")]}
-                  tooltip="Start of the PTU window, required when PTU Count is set. Flat cost accrues by the hour within the window; a window opening at 23:00 charges one hour that day."
+                  label={labelWithHint(
+                    "PTU Effective From (UTC)",
+                    "Start of the PTU window, required when PTU Count is set. Flat cost accrues by the hour within the window; a window opening at 23:00 charges one hour that day.",
+                  )}
+                  rules={{
+                    deps: [PTU_END_FIELD],
+                    validate: antdRules(
+                      ptuStartRequiredRule(PTU_COUNT_FIELD),
+                      ptuWindowOrderRule(PTU_END_FIELD, "start"),
+                    ),
+                  }}
                   className="mb-4"
                 >
-                  <DatePicker showTime style={{ width: "100%" }} />
-                </Form.Item>
+                  {(control) => (
+                    <DatePicker
+                      id={control.id}
+                      showTime
+                      style={{ width: "100%" }}
+                      value={control.value as never}
+                      onChange={control.onChange}
+                      onBlur={control.onBlur}
+                    />
+                  )}
+                </MountedFormField>
 
-                <Form.Item
-                  label="PTU Effective To (UTC)"
+                <MountedFormField
                   name={PTU_END_FIELD}
-                  dependencies={[PTU_START_FIELD]}
-                  rules={[ptuWindowOrderRule(PTU_START_FIELD, "end")]}
-                  tooltip="Optional end of the PTU window (exclusive). Leave blank for open-ended."
+                  label={labelWithHint(
+                    "PTU Effective To (UTC)",
+                    "Optional end of the PTU window (exclusive). Leave blank for open-ended.",
+                  )}
+                  rules={{
+                    deps: [PTU_START_FIELD],
+                    validate: antdRules(ptuWindowOrderRule(PTU_START_FIELD, "end")),
+                  }}
                   className="mb-4"
                 >
-                  <DatePicker showTime style={{ width: "100%" }} />
-                </Form.Item>
+                  {(control) => (
+                    <DatePicker
+                      id={control.id}
+                      showTime
+                      style={{ width: "100%" }}
+                      value={control.value as never}
+                      onChange={control.onChange}
+                      onBlur={control.onBlur}
+                    />
+                  )}
+                </MountedFormField>
               </>
             )}
 
             {customPricing && (
-              <div className="ml-6 pl-4 border-l-2 border-gray-200">
-                <Form.Item label="Pricing Model" name="pricing_model" className="mb-4">
-                  <Select
-                    defaultValue="per_token"
-                    onChange={(value: "per_token" | "per_second") => setPricingModel(value)}
-                    options={[
-                      { value: "per_token", label: "Per Million Tokens" },
-                      { value: "per_second", label: "Per Second" },
-                    ]}
-                  />
-                </Form.Item>
+              <div className="ml-6 pl-4 border-l-2 border-border">
+                <MountedFormField name="pricing_model" label="Pricing Model" className="mb-4">
+                  {(control) => (
+                    <Select
+                      id={control.id}
+                      defaultValue="per_token"
+                      value={control.value as "per_token" | "per_second" | undefined}
+                      onBlur={control.onBlur}
+                      onChange={(value: "per_token" | "per_second") => {
+                        control.onChange(value);
+                        setPricingModel(value);
+                      }}
+                      options={[
+                        { value: "per_token", label: "Per Million Tokens" },
+                        { value: "per_second", label: "Per Second" },
+                      ]}
+                    />
+                  )}
+                </MountedFormField>
 
                 {pricingModel === "per_token" ? (
                   <>
-                    <Form.Item
-                      label="Input Cost (per 1M tokens)"
+                    <MountedFormField
                       name="input_cost_per_token"
-                      dependencies={[PTU_COUNT_FIELD]}
-                      rules={[{ validator: validateNumber }, ptuNoUsageCostRule(PTU_COUNT_FIELD)]}
+                      label="Input Cost (per 1M tokens)"
+                      rules={usageCostRules}
                       className="mb-4"
                     >
-                      <Input />
-                    </Form.Item>
-                    <Form.Item
-                      label="Output Cost (per 1M tokens)"
+                      {(control) => (
+                        <Input
+                          id={control.id}
+                          value={(control.value as string | undefined) ?? ""}
+                          onChange={control.onChange}
+                          onBlur={control.onBlur}
+                        />
+                      )}
+                    </MountedFormField>
+                    <MountedFormField
                       name="output_cost_per_token"
-                      dependencies={[PTU_COUNT_FIELD]}
-                      rules={[{ validator: validateNumber }, ptuNoUsageCostRule(PTU_COUNT_FIELD)]}
+                      label="Output Cost (per 1M tokens)"
+                      rules={usageCostRules}
                       className="mb-4"
                     >
-                      <Input />
-                    </Form.Item>
-                    <Form.Item
-                      label="Cache Read Cost (per 1M tokens)"
+                      {(control) => (
+                        <Input
+                          id={control.id}
+                          value={(control.value as string | undefined) ?? ""}
+                          onChange={control.onChange}
+                          onBlur={control.onBlur}
+                        />
+                      )}
+                    </MountedFormField>
+                    <MountedFormField
                       name="cache_read_input_token_cost"
-                      dependencies={[PTU_COUNT_FIELD]}
-                      rules={[{ validator: validateNumber }, ptuNoUsageCostRule(PTU_COUNT_FIELD)]}
-                      tooltip="If left blank, defaults to Input Cost."
+                      label={labelWithHint("Cache Read Cost (per 1M tokens)", "If left blank, defaults to Input Cost.")}
+                      rules={usageCostRules}
                       className="mb-4"
                     >
-                      <Input placeholder="Defaults to Input Cost if blank" />
-                    </Form.Item>
-                    <Form.Item
-                      label="Cache Write Cost (per 1M tokens)"
+                      {(control) => (
+                        <Input
+                          id={control.id}
+                          value={(control.value as string | undefined) ?? ""}
+                          onChange={control.onChange}
+                          onBlur={control.onBlur}
+                          placeholder="Defaults to Input Cost if blank"
+                        />
+                      )}
+                    </MountedFormField>
+                    <MountedFormField
                       name="cache_creation_input_token_cost"
-                      dependencies={[PTU_COUNT_FIELD]}
-                      rules={[{ validator: validateNumber }, ptuNoUsageCostRule(PTU_COUNT_FIELD)]}
-                      tooltip="If left blank, defaults to Input Cost (the backend falls back to input_cost_per_token when no cache-write rate is set)."
+                      label={labelWithHint(
+                        "Cache Write Cost (per 1M tokens)",
+                        "If left blank, defaults to Input Cost (the backend falls back to input_cost_per_token when no cache-write rate is set).",
+                      )}
+                      rules={usageCostRules}
                       className="mb-4"
                     >
-                      <Input placeholder="Defaults to Input Cost if blank" />
-                    </Form.Item>
+                      {(control) => (
+                        <Input
+                          id={control.id}
+                          value={(control.value as string | undefined) ?? ""}
+                          onChange={control.onChange}
+                          onBlur={control.onBlur}
+                          placeholder="Defaults to Input Cost if blank"
+                        />
+                      )}
+                    </MountedFormField>
                   </>
                 ) : (
-                  <Form.Item
-                    label="Cost Per Second"
+                  <MountedFormField
                     name="input_cost_per_second"
-                    dependencies={[PTU_COUNT_FIELD]}
-                    rules={[{ validator: validateNumber }, ptuNoUsageCostRule(PTU_COUNT_FIELD)]}
+                    label="Cost Per Second"
+                    rules={usageCostRules}
                     className="mb-4"
                   >
-                    <Input />
-                  </Form.Item>
+                    {(control) => (
+                      <Input
+                        id={control.id}
+                        value={(control.value as string | undefined) ?? ""}
+                        onChange={control.onChange}
+                        onBlur={control.onBlur}
+                      />
+                    )}
+                  </MountedFormField>
                 )}
               </div>
             )}
 
-            <Form.Item
-              label="Use in pass through routes"
+            <MountedFormField
               name="use_in_pass_through"
-              valuePropName="checked"
-              className="mb-4 mt-4"
-              tooltip={
+              label={labelWithHint(
+                "Use in pass through routes",
                 <span>
                   Allow using these credentials in pass through routes.{" "}
                   <Link href="https://docs.litellm.ai/docs/pass_through/vertex_ai" target="_blank">
                     Learn more
                   </Link>
-                </span>
-              }
-            >
-              <Switch onChange={handlePassThroughChange} className="bg-gray-600" />
-            </Form.Item>
-
-            <CacheControlSettings
-              form={form}
-              showCacheControl={showCacheControl}
-              onCacheControlChange={handleCacheControlChange}
-            />
-            <Form.Item
-              label="LiteLLM Params"
-              name="litellm_extra_params"
-              tooltip="Optional litellm params used for making a litellm.completion() call."
+                </span>,
+              )}
               className="mb-4 mt-4"
-              rules={[{ validator: formItemValidateJSON }]}
             >
-              <TextArea
-                rows={4}
-                placeholder='{
+              {(control) => (
+                <Switch
+                  id={control.id}
+                  checked={control.value === true}
+                  onChange={control.onChange}
+                  className="bg-gray-600"
+                />
+              )}
+            </MountedFormField>
+
+            <MountedFormField
+              name="cache_control"
+              label={labelWithHint(CACHE_CONTROL_LABEL, CACHE_CONTROL_TOOLTIP)}
+              className="mb-4"
+            >
+              {(control) => (
+                <Switch
+                  id={control.id}
+                  checked={control.value === true}
+                  onChange={(checked) => {
+                    control.onChange(checked);
+                    setShowCacheControl(checked);
+                  }}
+                  className="bg-gray-600"
+                />
+              )}
+            </MountedFormField>
+
+            {showCacheControl && (
+              <MountedFormField name="cache_control_injection_points" defaultValue={[NEW_CACHE_CONTROL_POINT]} bare>
+                {(control) => (
+                  <CacheControlInjectionPoints
+                    value={control.value as React.ComponentProps<typeof CacheControlInjectionPoints>["value"]}
+                    onChange={control.onChange}
+                  />
+                )}
+              </MountedFormField>
+            )}
+            <MountedFormField
+              name="litellm_extra_params"
+              label={labelWithHint(
+                "LiteLLM Params",
+                "Optional litellm params used for making a litellm.completion() call.",
+              )}
+              className="mb-4 mt-4"
+              rules={{ validate: antdRules({ validator: formItemValidateJSON }) }}
+            >
+              {(control) => (
+                <TextArea
+                  id={control.id}
+                  value={(control.value as string | undefined) ?? ""}
+                  onChange={control.onChange}
+                  onBlur={control.onBlur}
+                  rows={4}
+                  placeholder='{
                   "rpm": 100,
                   "timeout": 0,
                   "stream_timeout": 0
                 }'
-              />
-            </Form.Item>
+                />
+              )}
+            </MountedFormField>
             <Row className="mb-4">
               <Col span={10}></Col>
               <Col span={10}>
-                <p className="text-gray-600 text-sm">
+                <p className="text-muted-foreground text-sm">
                   Pass JSON of litellm supported params{" "}
                   <Link href="https://docs.litellm.ai/docs/completion/input" target="_blank">
                     litellm.completion() call
@@ -364,20 +482,28 @@ const AdvancedSettings: React.FC<AdvancedSettingsProps> = ({
                 </p>
               </Col>
             </Row>
-            <Form.Item
-              label="Model Info"
+            <MountedFormField
               name="model_info_params"
-              tooltip="Optional model info params. Returned when calling `/model/info` endpoint."
+              label={labelWithHint(
+                "Model Info",
+                "Optional model info params. Returned when calling `/model/info` endpoint.",
+              )}
               className="mb-0"
-              rules={[{ validator: formItemValidateJSON }]}
+              rules={{ validate: antdRules({ validator: formItemValidateJSON }) }}
             >
-              <TextArea
-                rows={4}
-                placeholder='{
+              {(control) => (
+                <TextArea
+                  id={control.id}
+                  value={(control.value as string | undefined) ?? ""}
+                  onChange={control.onChange}
+                  onBlur={control.onBlur}
+                  rows={4}
+                  placeholder='{
                   "mode": "chat"
                 }'
-              />
-            </Form.Item>
+                />
+              )}
+            </MountedFormField>
           </div>
         </CollapsibleContent>
       </Collapsible>
diff --git a/ui/litellm-dashboard/src/components/add_model/cache_control_settings.test.tsx b/ui/litellm-dashboard/src/components/add_model/cache_control_settings.test.tsx
new file mode 100644
index 00000000000..2c403f7d8b2
--- /dev/null
+++ b/ui/litellm-dashboard/src/components/add_model/cache_control_settings.test.tsx
@@ -0,0 +1,83 @@
+import { render, screen } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { describe, expect, it, vi } from "vitest";
+import CacheControlInjectionPoints, { type CacheControlInjectionPoint } from "./cache_control_settings";
+
+const ROLE_HINT = "LiteLLM will mark all messages of this role as cacheable";
+const INDEX_HINT = "(Optional) If set litellm will mark the message at this index as cacheable";
+
+const ONE_POINT: CacheControlInjectionPoint[] = [{ location: "message" }];
+
+const tabTo = async (user: ReturnType<typeof userEvent.setup>, name: string): Promise<void> => {
+  for (let step = 0; step < 8; step++) {
+    await user.tab();
+    if (document.activeElement === screen.getByRole("button", { name })) {
+      return;
+    }
+  }
+  throw new Error(`${name} is not reachable by keyboard`);
+};
+
+describe("CacheControlInjectionPoints field hints", () => {
+  it("explains on the Role field that the role marks every message of that role cacheable", async () => {
+    const user = userEvent.setup();
+    render(<CacheControlInjectionPoints value={ONE_POINT} onChange={vi.fn()} />);
+
+    await user.hover(screen.getByRole("button", { name: "Role help" }));
+
+    expect(await screen.findByText(ROLE_HINT)).toBeInTheDocument();
+  });
+
+  it("explains on the Index field that it is optional and marks that message cacheable", async () => {
+    const user = userEvent.setup();
+    render(<CacheControlInjectionPoints value={ONE_POINT} onChange={vi.fn()} />);
+
+    await user.hover(screen.getByRole("button", { name: "Index help" }));
+
+    expect(await screen.findByText(INDEX_HINT)).toBeInTheDocument();
+  });
+
+  it("reveals the Role hint on keyboard focus, so it is reachable without a pointer", async () => {
+    const user = userEvent.setup();
+    render(<CacheControlInjectionPoints value={ONE_POINT} onChange={vi.fn()} />);
+
+    await tabTo(user, "Role help");
+
+    expect(await screen.findByText(ROLE_HINT)).toBeInTheDocument();
+  });
+
+  it("reveals the Index hint on keyboard focus, so it is reachable without a pointer", async () => {
+    const user = userEvent.setup();
+    render(<CacheControlInjectionPoints value={ONE_POINT} onChange={vi.fn()} />);
+
+    await tabTo(user, "Index help");
+
+    expect(await screen.findByText(INDEX_HINT)).toBeInTheDocument();
+  });
+
+  it("keeps both hints behind a hover or a focus rather than rendering them inline", () => {
+    render(<CacheControlInjectionPoints value={ONE_POINT} onChange={vi.fn()} />);
+
+    expect(screen.queryByText(ROLE_HINT)).not.toBeInTheDocument();
+    expect(screen.queryByText(INDEX_HINT)).not.toBeInTheDocument();
+  });
+
+  it("gives every row its own pair of hints", () => {
+    render(
+      <CacheControlInjectionPoints value={[{ location: "message" }, { location: "message" }]} onChange={vi.fn()} />,
+    );
+
+    expect(screen.getAllByRole("button", { name: "Role help" })).toHaveLength(2);
+    expect(screen.getAllByRole("button", { name: "Index help" })).toHaveLength(2);
+  });
+
+  it("still reports a typed index as a string through onChange", async () => {
+    const user = userEvent.setup();
+    const onChange = vi.fn();
+    render(<CacheControlInjectionPoints value={ONE_POINT} onChange={onChange} />);
+
+    await user.type(screen.getByPlaceholderText("Optional"), "3");
+
+    expect(onChange).toHaveBeenLastCalledWith([{ location: "message", index: "3" }]);
+  });
+});
diff --git a/ui/litellm-dashboard/src/components/add_model/cache_control_settings.tsx b/ui/litellm-dashboard/src/components/add_model/cache_control_settings.tsx
index 3691f888a91..5b672595dcc 100644
--- a/ui/litellm-dashboard/src/components/add_model/cache_control_settings.tsx
+++ b/ui/litellm-dashboard/src/components/add_model/cache_control_settings.tsx
@@ -1,155 +1,168 @@
+import { CircleHelp, Minus, Plus } from "lucide-react";
 import React from "react";
-import { Form, Switch, Select, Typography } from "antd";
-import { PlusOutlined, MinusCircleOutlined } from "@ant-design/icons";
+
+import { Button } from "@/components/ui/button";
+import { Label } from "@/components/ui/label";
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from "@/components/ui/select";
+import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from "@/components/ui/tooltip";
+
 import NumericalInput from "../shared/numerical_input";
 
-const { Text } = Typography;
+export const CACHE_CONTROL_LABEL = "Cache Control Injection Points";
 
-interface CacheControlInjectionPoint {
+export const CACHE_CONTROL_TOOLTIP =
+  "Tell litellm where to inject cache control checkpoints. You can specify either by role (to apply to all messages of that role) or by specific message index.";
+
+export const CACHE_CONTROL_DESCRIPTION =
+  "Providers like Anthropic, Bedrock API require users to specify where to inject cache control checkpoints, litellm can automatically add them for you as a cost saving feature.";
+
+export const CACHE_CONTROL_ROLE_HINT = "LiteLLM will mark all messages of this role as cacheable";
+
+export const CACHE_CONTROL_INDEX_HINT = "(Optional) If set litellm will mark the message at this index as cacheable";
+
+export type CacheControlRole = "user" | "system" | "assistant";
+
+export interface CacheControlInjectionPoint {
   location: "message";
-  role?: "user" | "system" | "assistant";
-  index?: number;
+  role?: CacheControlRole;
+  index?: string | number;
 }
 
-interface CacheControlSettingsProps {
-  form: any; // Form instance from parent
-  showCacheControl: boolean;
-  onCacheControlChange: (checked: boolean) => void;
+export const NEW_CACHE_CONTROL_POINT: CacheControlInjectionPoint = { location: "message" };
+
+const LOCATION_ITEMS = [{ value: "message", label: "Message" }] as const;
+
+const ROLE_ITEMS = [
+  { value: "user", label: "User" },
+  { value: "system", label: "System" },
+  { value: "assistant", label: "Assistant" },
+] as const;
+
+const LabelWithHint: React.FC<{ label: string; hint: string }> = ({ label, hint }) => (
+  <div className="flex items-center">
+    <Label>{label}</Label>
+    <TooltipProvider>
+      <Tooltip>
+        <TooltipTrigger
+          render={
+            <button
+              type="button"
+              aria-label={`${label} help`}
+              className="ml-1 inline-flex cursor-help items-center rounded-sm text-muted-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
+            />
+          }
+        >
+          <CircleHelp aria-hidden className="size-4" />
+        </TooltipTrigger>
+        <TooltipContent className="max-w-xs whitespace-normal">{hint}</TooltipContent>
+      </Tooltip>
+    </TooltipProvider>
+  </div>
+);
+
+interface CacheControlInjectionPointsProps {
+  value?: CacheControlInjectionPoint[];
+  onChange?: (points: CacheControlInjectionPoint[]) => void;
 }
 
-const CacheControlSettings: React.FC<CacheControlSettingsProps> = ({
-  form,
-  showCacheControl,
-  onCacheControlChange,
-}) => {
-  const updateCacheControlPoints = (injectionPoints: CacheControlInjectionPoint[]) => {
-    const currentParams = form.getFieldValue("litellm_extra_params");
-    try {
-      let paramsObj = currentParams ? JSON.parse(currentParams) : {};
-      if (injectionPoints.length > 0) {
-        paramsObj.cache_control_injection_points = injectionPoints;
-      } else {
-        delete paramsObj.cache_control_injection_points;
-      }
-      if (Object.keys(paramsObj).length > 0) {
-        form.setFieldValue("litellm_extra_params", JSON.stringify(paramsObj, null, 2));
-      } else {
-        form.setFieldValue("litellm_extra_params", "");
-      }
-    } catch (error) {
-      console.error("Error updating cache control points:", error);
-    }
-  };
+/**
+ * Editor for `cache_control_injection_points`. It holds no form state of its own so that an antd
+ * `Form.Item` and a react-hook-form `FormField` can each host it while their pages migrate
+ * independently; both hand a child exactly `value` and `onChange`.
+ */
+const CacheControlInjectionPoints: React.FC<CacheControlInjectionPointsProps> = ({ value, onChange }) => {
+  const points = value ?? [];
+
+  const replaceAt = (index: number, point: CacheControlInjectionPoint) =>
+    onChange?.(points.map((existing, position) => (position === index ? point : existing)));
 
   return (
-    <>
-      <Form.Item
-        label="Cache Control Injection Points"
-        name="cache_control"
-        valuePropName="checked"
-        className="mb-4"
-        tooltip="Tell litellm where to inject cache control checkpoints. You can specify either by role (to apply to all messages of that role) or by specific message index."
-      >
-        <Switch onChange={onCacheControlChange} className="bg-gray-600" />
-      </Form.Item>
+    <div className="ml-6 border-l-2 border-border pl-4">
+      <p className="mb-4 block text-sm text-muted-foreground">{CACHE_CONTROL_DESCRIPTION}</p>
 
-      {showCacheControl && (
-        <div className="ml-6 pl-4 border-l-2 border-gray-200">
-          <Text className="text-sm text-gray-500 block mb-4">
-            Providers like Anthropic, Bedrock API require users to specify where to inject cache control checkpoints,
-            litellm can automatically add them for you as a cost saving feature.
-          </Text>
-
-          <Form.List name="cache_control_injection_points" initialValue={[{ location: "message" }]}>
-            {(fields, { add, remove }) => (
-              <>
-                {fields.map((field, index) => (
-                  <div key={field.key} className="flex items-center mb-4 gap-4">
-                    <Form.Item
-                      {...field}
-                      label="Type"
-                      name={[field.name, "location"]}
-                      initialValue="message"
-                      className="mb-0"
-                      style={{ width: "180px" }}
-                    >
-                      <Select disabled options={[{ value: "message", label: "Message" }]} />
-                    </Form.Item>
-
-                    <Form.Item
-                      {...field}
-                      label="Role"
-                      name={[field.name, "role"]}
-                      className="mb-0"
-                      style={{ width: "180px" }}
-                      tooltip="LiteLLM will mark all messages of this role as cacheable"
-                    >
-                      <Select
-                        placeholder="Select a role"
-                        allowClear
-                        options={[
-                          { value: "user", label: "User" },
-                          { value: "system", label: "System" },
-                          { value: "assistant", label: "Assistant" },
-                        ]}
-                        onChange={() => {
-                          const values = form.getFieldValue("cache_control_points");
-                          updateCacheControlPoints(values);
-                        }}
-                      />
-                    </Form.Item>
-
-                    <Form.Item
-                      {...field}
-                      label="Index"
-                      name={[field.name, "index"]}
-                      className="mb-0"
-                      style={{ width: "180px" }}
-                      tooltip="(Optional) If set litellm will mark the message at this index as cacheable"
-                    >
-                      <NumericalInput
-                        type="number"
-                        placeholder="Optional"
-                        step={1}
-                        onChange={() => {
-                          const values = form.getFieldValue("cache_control_points");
-                          updateCacheControlPoints(values);
-                        }}
-                      />
-                    </Form.Item>
-
-                    {fields.length > 1 && (
-                      <MinusCircleOutlined
-                        className="text-red-500 cursor-pointer text-lg ml-12"
-                        onClick={() => {
-                          remove(field.name);
-                          setTimeout(() => {
-                            const values = form.getFieldValue("cache_control_points");
-                            updateCacheControlPoints(values);
-                          }, 0);
-                        }}
-                      />
-                    )}
-                  </div>
+      {points.map((point, index) => (
+        <div key={index} className="mb-4 flex items-end gap-4">
+          <div className="w-[180px] space-y-1">
+            <Label>Type</Label>
+            <Select items={LOCATION_ITEMS} value={point.location} disabled>
+              <SelectTrigger className="w-full">
+                <SelectValue />
+              </SelectTrigger>
+              <SelectContent>
+                {LOCATION_ITEMS.map((item) => (
+                  <SelectItem key={item.value} value={item.value}>
+                    {item.label}
+                  </SelectItem>
                 ))}
+              </SelectContent>
+            </Select>
+          </div>
 
-                <Form.Item>
-                  <button
-                    type="button"
-                    className="flex items-center justify-center w-full border border-dashed border-gray-300 py-2 px-4 text-gray-600 hover:text-blue-600 hover:border-blue-300 transition-all rounded-sm"
-                    onClick={() => add()}
-                  >
-                    <PlusOutlined className="mr-2" />
-                    Add Injection Point
-                  </button>
-                </Form.Item>
-              </>
-            )}
-          </Form.List>
+          <div className="w-[180px] space-y-1">
+            <LabelWithHint label="Role" hint={CACHE_CONTROL_ROLE_HINT} />
+            <Select
+              items={ROLE_ITEMS}
+              value={point.role ?? null}
+              onValueChange={(selected) =>
+                replaceAt(index, { ...point, role: (selected as CacheControlRole | null) ?? undefined })
+              }
+            >
+              <SelectTrigger className="w-full">
+                <SelectValue placeholder="Select a role" />
+              </SelectTrigger>
+              <SelectContent>
+                <SelectItem value={null}>None</SelectItem>
+                {ROLE_ITEMS.map((item) => (
+                  <SelectItem key={item.value} value={item.value}>
+                    {item.label}
+                  </SelectItem>
+                ))}
+              </SelectContent>
+            </Select>
+          </div>
+
+          <div className="w-[180px] space-y-1">
+            <LabelWithHint label="Index" hint={CACHE_CONTROL_INDEX_HINT} />
+            <NumericalInput
+              type="number"
+              placeholder="Optional"
+              step={1}
+              value={point.index ?? ""}
+              onChange={(event: React.ChangeEvent<HTMLInputElement>) =>
+                replaceAt(index, {
+                  ...point,
+                  index: event.target.value === "" ? undefined : event.target.value,
+                })
+              }
+            />
+          </div>
+
+          {points.length > 1 && (
+            <Button
+              type="button"
+              variant="ghost"
+              size="icon"
+              aria-label={`Remove injection point ${index + 1}`}
+              className="text-destructive"
+              onClick={() => onChange?.(points.filter((_, position) => position !== index))}
+            >
+              <Minus className="size-4" />
+            </Button>
+          )}
         </div>
-      )}
-    </>
+      ))}
+
+      <Button
+        type="button"
+        variant="outline"
+        className="w-full border-dashed"
+        onClick={() => onChange?.([...points, NEW_CACHE_CONTROL_POINT])}
+      >
+        <Plus className="mr-2 size-4" />
+        Add Injection Point
+      </Button>
+    </div>
   );
 };
 
-export default CacheControlSettings;
+export default CacheControlInjectionPoints;
diff --git a/ui/litellm-dashboard/src/components/add_model/conditional_public_model_name.test.tsx b/ui/litellm-dashboard/src/components/add_model/conditional_public_model_name.test.tsx
index 81633bd7a8a..967fc9c458a 100644
--- a/ui/litellm-dashboard/src/components/add_model/conditional_public_model_name.test.tsx
+++ b/ui/litellm-dashboard/src/components/add_model/conditional_public_model_name.test.tsx
@@ -1,13 +1,13 @@
 import { render, screen } from "@testing-library/react";
-import { Form } from "antd";
 import { describe, expect, it } from "vitest";
+import { MountedFormHost } from "../../../tests/mounted-form-host";
 import ConditionalPublicModelName from "./conditional_public_model_name";
 
 describe("ConditionalPublicModelName", () => {
   it("should render", () => {
     render(
-      <Form
-        initialValues={{
+      <MountedFormHost
+        defaultValues={{
           model: ["gpt-4"],
           model_mappings: [
             {
@@ -18,7 +18,7 @@ describe("ConditionalPublicModelName", () => {
         }}
       >
         <ConditionalPublicModelName />
-      </Form>,
+      </MountedFormHost>,
     );
 
     expect(screen.getByText("Model Mappings")).toBeInTheDocument();
diff --git a/ui/litellm-dashboard/src/components/add_model/conditional_public_model_name.tsx b/ui/litellm-dashboard/src/components/add_model/conditional_public_model_name.tsx
index 8f95973b558..ff165415105 100644
--- a/ui/litellm-dashboard/src/components/add_model/conditional_public_model_name.tsx
+++ b/ui/litellm-dashboard/src/components/add_model/conditional_public_model_name.tsx
@@ -1,24 +1,46 @@
 import React, { useEffect, useState } from "react";
-import { Form, Table } from "antd";
+import { Table } from "antd";
+import { useFormContext, useWatch } from "react-hook-form";
 import { Input } from "@/components/ui/input";
-import { Tooltip } from "../atoms/index";
+import { SimpleTooltip } from "@/components/ui/tooltip";
+import { antdRules } from "../common_components/antdFormRules";
+import { MountedFormField, type MountedFormValues } from "../common_components/MountedFormField";
 import { Providers } from "../provider_info_helpers";
 
+interface ModelMapping {
+  public_name: string;
+  litellm_model: string;
+}
+
+const modelMappingsRule = {
+  validator: async (_: unknown, value: unknown) => {
+    if (!value || (value as ModelMapping[]).length === 0) {
+      throw new Error("At least one model mapping is required");
+    }
+    const invalidMappings = (value as ModelMapping[]).filter(
+      (mapping) => !mapping.public_name || mapping.public_name.trim() === "",
+    );
+    if (invalidMappings.length > 0) {
+      throw new Error("All model mappings must have valid public names");
+    }
+  },
+};
+
 const ConditionalPublicModelName: React.FC = () => {
-  const form = Form.useFormInstance();
+  const form = useFormContext<MountedFormValues>();
   const [tableKey, setTableKey] = useState(0); // Add a key to force table re-render
 
   // Watch the 'model' field for changes and ensure it's always an array
-  const modelValue = Form.useWatch("model", form) || [];
+  const modelValue = useWatch({ control: form.control, name: "model" }) || [];
   const selectedModels = Array.isArray(modelValue) ? modelValue : [modelValue];
-  const customModelName = Form.useWatch("custom_model_name", form);
+  const customModelName = useWatch({ control: form.control, name: "custom_model_name" }) as string | undefined;
   const showPublicModelName = !selectedModels.includes("all-wildcard");
-  const selectedProvider = Form.useWatch("custom_llm_provider", form);
+  const selectedProvider = useWatch({ control: form.control, name: "custom_llm_provider" });
   // Force table to re-render when custom model name changes
   useEffect(() => {
     if (customModelName && selectedModels.includes("custom")) {
-      const currentMappings = form.getFieldValue("model_mappings") || [];
-      const updatedMappings = currentMappings.map((mapping: any) => {
+      const currentMappings = (form.getValues("model_mappings") as ModelMapping[]) || [];
+      const updatedMappings = currentMappings.map((mapping) => {
         if (mapping.public_name === "custom" || mapping.litellm_model === "custom") {
           if (selectedProvider === Providers.Azure) {
             return {
@@ -33,7 +55,7 @@ const ConditionalPublicModelName: React.FC = () => {
         }
         return mapping;
       });
-      form.setFieldValue("model_mappings", updatedMappings);
+      form.setValue("model_mappings", updatedMappings);
       setTableKey((prev) => prev + 1); // Force table re-render
     }
   }, [customModelName, selectedModels, selectedProvider, form]);
@@ -42,13 +64,13 @@ const ConditionalPublicModelName: React.FC = () => {
   useEffect(() => {
     if (selectedModels.length > 0 && !selectedModels.includes("all-wildcard")) {
       // Check if we already have mappings that match the selected models
-      const currentMappings = form.getFieldValue("model_mappings") || [];
+      const currentMappings = (form.getValues("model_mappings") as ModelMapping[]) || [];
 
       // Only update if the mappings don't exist or don't match the selected models
       const shouldUpdateMappings =
         currentMappings.length !== selectedModels.length ||
         !selectedModels.every((model) =>
-          currentMappings.some((mapping: { public_name: string; litellm_model: string }) => {
+          currentMappings.some((mapping) => {
             if (model === "custom") {
               return mapping.litellm_model === "custom" || mapping.litellm_model === customModelName;
             }
@@ -85,7 +107,7 @@ const ConditionalPublicModelName: React.FC = () => {
           };
         });
 
-        form.setFieldValue("model_mappings", mappings);
+        form.setValue("model_mappings", mappings);
         setTableKey((prev) => prev + 1); // Force table re-render
       }
     }
@@ -98,16 +120,16 @@ const ConditionalPublicModelName: React.FC = () => {
       <div className="mb-2 font-normal">The name you specify in your API calls to LiteLLM Proxy</div>
       <div className="mb-2 font-normal">
         <strong>Example:</strong> If you name your public model{" "}
-        <code className="bg-gray-700 px-1 py-0.5 rounded-sm text-xs">example-name</code>, and choose{" "}
-        <code className="bg-gray-700 px-1 py-0.5 rounded-sm text-xs">openai/qwen-plus-latest</code> as the LiteLLM model
+        <code className="bg-muted px-1 py-0.5 rounded-sm text-xs">example-name</code>, and choose{" "}
+        <code className="bg-muted px-1 py-0.5 rounded-sm text-xs">openai/qwen-plus-latest</code> as the LiteLLM model
       </div>
       <div className="mb-2 font-normal">
         <strong>Usage:</strong> You make an API call to the LiteLLM proxy with{" "}
-        <code className="bg-gray-700 px-1 py-0.5 rounded-sm text-xs">model = &quot;example-name&quot;</code>
+        <code className="bg-muted px-1 py-0.5 rounded-sm text-xs">model = &quot;example-name&quot;</code>
       </div>
       <div className="font-normal">
         <strong>Result:</strong> LiteLLM sends{" "}
-        <code className="bg-gray-700 px-1 py-0.5 rounded-sm text-xs">qwen-plus-latest</code> to the provider
+        <code className="bg-muted px-1 py-0.5 rounded-sm text-xs">qwen-plus-latest</code> to the provider
       </div>
     </>
   );
@@ -119,7 +141,7 @@ const ConditionalPublicModelName: React.FC = () => {
       title: (
         <span className="flex items-center">
           Public Model Name
-          <Tooltip content={publicNameTooltipContent} width="500px" />
+          <SimpleTooltip content={publicNameTooltipContent} width="500px" />
         </span>
       ),
       dataIndex: "public_name",
@@ -130,12 +152,12 @@ const ConditionalPublicModelName: React.FC = () => {
             value={text}
             onChange={(e) => {
               const newValue = e.target.value;
-              const newMappings = [...form.getFieldValue("model_mappings")];
+              const newMappings = [...((form.getValues("model_mappings") as ModelMapping[]) ?? [])];
 
               // Check conditions for Anthropic -1m suffix handling
               const isAnthropic = selectedProvider === Providers.Anthropic;
               const endsWith1m = newValue.endsWith("-1m");
-              const litellmParams = form.getFieldValue("litellm_extra_params");
+              const litellmParams = form.getValues("litellm_extra_params") as string | undefined;
               const isLitellmParamsEmpty = !litellmParams || litellmParams.trim() === "";
 
               let finalPublicName = newValue;
@@ -147,14 +169,14 @@ const ConditionalPublicModelName: React.FC = () => {
                   null,
                   2,
                 );
-                form.setFieldValue("litellm_extra_params", litellmParamsValue);
+                form.setValue("litellm_extra_params", litellmParamsValue);
 
                 // Remove -1m suffix from public_name
                 finalPublicName = newValue.slice(0, -3); // Remove "-1m" (3 characters)
               }
 
               newMappings[index].public_name = finalPublicName;
-              form.setFieldValue("model_mappings", newMappings);
+              form.setValue("model_mappings", newMappings);
             }}
           />
         );
@@ -164,7 +186,7 @@ const ConditionalPublicModelName: React.FC = () => {
       title: (
         <span className="flex items-center">
           LiteLLM Model Name
-          <Tooltip content={liteLLMModelTooltipContent} width="360px" />
+          <SimpleTooltip content={liteLLMModelTooltipContent} width="360px" />
         </span>
       ),
       dataIndex: "litellm_model",
@@ -173,41 +195,28 @@ const ConditionalPublicModelName: React.FC = () => {
   ];
 
   return (
-    <>
-      <Form.Item
-        label="Model Mappings"
-        name="model_mappings"
-        tooltip="Map public model names to LiteLLM model names for load balancing"
-        labelCol={{ span: 10 }}
-        wrapperCol={{ span: 16 }}
-        labelAlign="left"
-        rules={[
-          {
-            required: true,
-            validator: async (_, value) => {
-              if (!value || value.length === 0) {
-                throw new Error("At least one model mapping is required");
-              }
-              // Check if all mappings have valid public names
-              const invalidMappings = value.filter(
-                (mapping: any) => !mapping.public_name || mapping.public_name.trim() === "",
-              );
-              if (invalidMappings.length > 0) {
-                throw new Error("All model mappings must have valid public names");
-              }
-            },
-          },
-        ]}
-      >
+    <MountedFormField
+      name="model_mappings"
+      label={
+        <span className="flex items-center">
+          Model Mappings
+          <SimpleTooltip content="Map public model names to LiteLLM model names for load balancing" />
+        </span>
+      }
+      required
+      rules={{ validate: antdRules(modelMappingsRule) }}
+      className="mb-4"
+    >
+      {(control) => (
         <Table
           key={tableKey} // Add key to force re-render
-          dataSource={form.getFieldValue("model_mappings")}
+          dataSource={control.value as ModelMapping[] | undefined}
           columns={columns}
           pagination={false}
           size="small"
         />
-      </Form.Item>
-    </>
+      )}
+    </MountedFormField>
   );
 };
 
diff --git a/ui/litellm-dashboard/src/components/add_model/litellm_model_name.test.tsx b/ui/litellm-dashboard/src/components/add_model/litellm_model_name.test.tsx
index 37eecec1f3f..64074481603 100644
--- a/ui/litellm-dashboard/src/components/add_model/litellm_model_name.test.tsx
+++ b/ui/litellm-dashboard/src/components/add_model/litellm_model_name.test.tsx
@@ -1,28 +1,28 @@
 import { render } from "@testing-library/react";
-import { Form } from "antd";
 import { describe, expect, it } from "vitest";
 import { getPlaceholder, Providers } from "../provider_info_helpers";
+import { MountedFormHost } from "../../../tests/mounted-form-host";
 import LiteLLMModelNameField from "./litellm_model_name";
 
 describe("LitellmModelNameField", () => {
   it("should render", () => {
     const { getByText } = render(
-      <Form>
+      <MountedFormHost>
         <LiteLLMModelNameField
           selectedProvider={Providers.OpenAI}
           providerModels={[]}
           getPlaceholder={getPlaceholder}
         />
-      </Form>,
+      </MountedFormHost>,
     );
     expect(getByText("LiteLLM Model Name(s)")).toBeInTheDocument();
   });
 
   it("should show Azure placeholder as 'my-deployment'", () => {
     const { getByPlaceholderText, queryByPlaceholderText } = render(
-      <Form>
+      <MountedFormHost>
         <LiteLLMModelNameField selectedProvider={Providers.Azure} providerModels={[]} getPlaceholder={getPlaceholder} />
-      </Form>,
+      </MountedFormHost>,
     );
     expect(getByPlaceholderText("my-deployment")).toBeInTheDocument();
     expect(queryByPlaceholderText("gpt-3.5-turbo")).not.toBeInTheDocument();
diff --git a/ui/litellm-dashboard/src/components/add_model/litellm_model_name.tsx b/ui/litellm-dashboard/src/components/add_model/litellm_model_name.tsx
index 86167a8902e..0af21b2adf6 100644
--- a/ui/litellm-dashboard/src/components/add_model/litellm_model_name.tsx
+++ b/ui/litellm-dashboard/src/components/add_model/litellm_model_name.tsx
@@ -1,7 +1,11 @@
 import React from "react";
-import { Form, Select as AntSelect } from "antd";
+import { Select as AntSelect } from "antd";
+import { useFormContext, useWatch } from "react-hook-form";
 import { Input } from "@/components/ui/input";
 import { Row, Col } from "antd";
+import { antdRequired } from "../common_components/antdFormRules";
+import { labelWithHint } from "@/components/shared/form/LabelWithHint";
+import { MountedFormField, type MountedFormValues } from "../common_components/MountedFormField";
 import { Providers } from "../provider_info_helpers";
 
 interface LiteLLMModelNameFieldProps {
@@ -15,7 +19,9 @@ const LiteLLMModelNameField: React.FC<LiteLLMModelNameFieldProps> = ({
   providerModels,
   getPlaceholder,
 }) => {
-  const form = Form.useFormInstance();
+  const form = useFormContext<MountedFormValues>();
+  const modelValue = useWatch({ control: form.control, name: "model" });
+  const selectedModels = Array.isArray(modelValue) ? modelValue : [modelValue];
 
   const handleModelChange = (value: string | string[]) => {
     // Ensure value is always treated as an array
@@ -23,10 +29,11 @@ const LiteLLMModelNameField: React.FC<LiteLLMModelNameFieldProps> = ({
 
     // If "all-wildcard" is selected, clear the model_name field
     if (values.includes("all-wildcard")) {
-      form.setFieldsValue({ model_name: undefined, model_mappings: [] });
+      form.setValue("model_name", undefined);
+      form.setValue("model_mappings", []);
     } else {
       // Get current model value to check if we need to update
-      const currentModel = form.getFieldValue("model");
+      const currentModel = form.getValues("model");
 
       // Only update if the value has actually changed
       if (JSON.stringify(currentModel) !== JSON.stringify(values)) {
@@ -45,10 +52,8 @@ const LiteLLMModelNameField: React.FC<LiteLLMModelNameFieldProps> = ({
         });
 
         // Update both fields in one call to reduce re-renders
-        form.setFieldsValue({
-          model: values,
-          model_mappings: mappings,
-        });
+        form.setValue("model", values);
+        form.setValue("model_mappings", mappings);
       }
     }
   };
@@ -67,10 +72,8 @@ const LiteLLMModelNameField: React.FC<LiteLLMModelNameFieldProps> = ({
       : [];
 
     // Update both fields
-    form.setFieldsValue({
-      model: deploymentName,
-      model_mappings: mappings,
-    });
+    form.setValue("model", deploymentName);
+    form.setValue("model_mappings", mappings);
   };
 
   // Handle custom model name changes
@@ -78,7 +81,7 @@ const LiteLLMModelNameField: React.FC<LiteLLMModelNameFieldProps> = ({
     const customName = e.target.value;
 
     // Immediately update the model mappings
-    const currentMappings = form.getFieldValue("model_mappings") || [];
+    const currentMappings = (form.getValues("model_mappings") as any[]) || [];
     const updatedMappings = currentMappings.map((mapping: any) => {
       if (mapping.public_name === "custom" || mapping.litellm_model === "custom") {
         if (selectedProvider === Providers.Azure) {
@@ -95,43 +98,54 @@ const LiteLLMModelNameField: React.FC<LiteLLMModelNameFieldProps> = ({
       return mapping;
     });
 
-    form.setFieldsValue({ model_mappings: updatedMappings });
+    form.setValue("model_mappings", updatedMappings);
   };
 
   return (
     <>
-      <Form.Item
-        label="LiteLLM Model Name(s)"
-        tooltip="The model name LiteLLM will send to the LLM API"
+      <MountedFormField
+        name="model"
+        label={labelWithHint("LiteLLM Model Name(s)", "The model name LiteLLM will send to the LLM API")}
+        required
+        rules={{
+          validate: {
+            required: antdRequired(
+              `Please enter ${selectedProvider === Providers.Azure ? "a deployment name" : "at least one model"}.`,
+            ),
+          },
+        }}
         className="mb-0"
       >
-        <Form.Item
-          name="model"
-          rules={[
-            {
-              required: true,
-              message: `Please enter ${selectedProvider === Providers.Azure ? "a deployment name" : "at least one model"}.`,
-            },
-          ]}
-          noStyle
-        >
-          {selectedProvider === Providers.Azure ||
+        {(control) =>
+          selectedProvider === Providers.Azure ||
           selectedProvider === Providers.OpenAI_Compatible ||
           selectedProvider === Providers.Ollama ? (
-            <>
-              <Input
-                placeholder={getPlaceholder(selectedProvider)}
-                onChange={selectedProvider === Providers.Azure ? handleAzureDeploymentNameChange : undefined}
-              />
-            </>
+            <Input
+              id={control.id}
+              value={(control.value as string | undefined) ?? ""}
+              onBlur={control.onBlur}
+              placeholder={getPlaceholder(selectedProvider)}
+              onChange={(event) => {
+                control.onChange(event);
+                if (selectedProvider === Providers.Azure) {
+                  handleAzureDeploymentNameChange(event);
+                }
+              }}
+            />
           ) : providerModels.length > 0 ? (
             <AntSelect
+              id={control.id}
               data-testid="model-name-select"
               mode="multiple"
               allowClear
               showSearch
               placeholder="Select models"
-              onChange={handleModelChange}
+              value={control.value as string[] | undefined}
+              onBlur={control.onBlur}
+              onChange={(value) => {
+                control.onChange(value);
+                handleModelChange(value);
+              }}
               optionFilterProp="children"
               filterOption={(input, option) => (option?.label ?? "").toLowerCase().includes(input.toLowerCase())}
               options={[
@@ -151,34 +165,40 @@ const LiteLLMModelNameField: React.FC<LiteLLMModelNameFieldProps> = ({
               style={{ width: "100%" }}
             />
           ) : (
-            <Input placeholder={getPlaceholder(selectedProvider)} />
-          )}
-        </Form.Item>
+            <Input
+              id={control.id}
+              value={(control.value as string | undefined) ?? ""}
+              onChange={control.onChange}
+              onBlur={control.onBlur}
+              placeholder={getPlaceholder(selectedProvider)}
+            />
+          )
+        }
+      </MountedFormField>
 
-        {/* Custom Model Name field */}
-        <Form.Item noStyle shouldUpdate={(prevValues, currentValues) => prevValues.model !== currentValues.model}>
-          {({ getFieldValue }) => {
-            const selectedModels = getFieldValue("model") || [];
-            const modelArray = Array.isArray(selectedModels) ? selectedModels : [selectedModels];
-            return (
-              modelArray.includes("custom") && (
-                <Form.Item
-                  name="custom_model_name"
-                  rules={[{ required: true, message: "Please enter a custom model name." }]}
-                  className="mt-2"
-                >
-                  <Input
-                    placeholder={
-                      selectedProvider === Providers.Azure ? "Enter Azure deployment name" : "Enter custom model name"
-                    }
-                    onChange={handleCustomModelNameChange}
-                  />
-                </Form.Item>
-              )
-            );
-          }}
-        </Form.Item>
-      </Form.Item>
+      {selectedModels.includes("custom") && (
+        <MountedFormField
+          name="custom_model_name"
+          required
+          rules={{ validate: { required: antdRequired("Please enter a custom model name.") } }}
+          className="mt-2"
+        >
+          {(control) => (
+            <Input
+              id={control.id}
+              value={(control.value as string | undefined) ?? ""}
+              onBlur={control.onBlur}
+              placeholder={
+                selectedProvider === Providers.Azure ? "Enter Azure deployment name" : "Enter custom model name"
+              }
+              onChange={(event) => {
+                control.onChange(event);
+                handleCustomModelNameChange(event);
+              }}
+            />
+          )}
+        </MountedFormField>
+      )}
       <Row>
         <Col span={10}></Col>
         <Col span={14}>
diff --git a/ui/litellm-dashboard/src/components/add_model/provider_specific_fields.test.tsx b/ui/litellm-dashboard/src/components/add_model/provider_specific_fields.test.tsx
index 351b0db0b4b..c3e8accae0a 100644
--- a/ui/litellm-dashboard/src/components/add_model/provider_specific_fields.test.tsx
+++ b/ui/litellm-dashboard/src/components/add_model/provider_specific_fields.test.tsx
@@ -1,8 +1,8 @@
 import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
 import { fireEvent, render, screen, waitFor } from "@testing-library/react";
-import { Form } from "antd";
 import { beforeAll, describe, expect, it, vi } from "vitest";
 import { Providers } from "../provider_info_helpers";
+import { MountedFormHost } from "../../../tests/mounted-form-host";
 import ProviderSpecificFields from "./provider_specific_fields";
 
 vi.mock("../networking", async () => {
@@ -129,9 +129,9 @@ describe("ProviderSpecificFields", () => {
     const queryClient = createQueryClient();
     render(
       <QueryClientProvider client={queryClient}>
-        <Form>
+        <MountedFormHost>
           <ProviderSpecificFields selectedProvider={Providers.OpenAI} />
-        </Form>
+        </MountedFormHost>
       </QueryClientProvider>,
     );
 
@@ -144,9 +144,9 @@ describe("ProviderSpecificFields", () => {
     const queryClient = createQueryClient();
     render(
       <QueryClientProvider client={queryClient}>
-        <Form>
+        <MountedFormHost>
           <ProviderSpecificFields selectedProvider={Providers.OpenAI} />
-        </Form>
+        </MountedFormHost>
       </QueryClientProvider>,
     );
 
@@ -165,9 +165,9 @@ describe("ProviderSpecificFields", () => {
     const queryClient = createQueryClient();
     render(
       <QueryClientProvider client={queryClient}>
-        <Form>
+        <MountedFormHost>
           <ProviderSpecificFields selectedProvider={Providers.OpenAI} />
-        </Form>
+        </MountedFormHost>
       </QueryClientProvider>,
     );
 
@@ -182,9 +182,9 @@ describe("ProviderSpecificFields", () => {
     const queryClient = createQueryClient();
     render(
       <QueryClientProvider client={queryClient}>
-        <Form>
+        <MountedFormHost>
           <ProviderSpecificFields selectedProvider={"Hosted_Vllm" as Providers} />
-        </Form>
+        </MountedFormHost>
       </QueryClientProvider>,
     );
 
@@ -200,9 +200,9 @@ describe("ProviderSpecificFields", () => {
     const queryClient = createQueryClient();
     render(
       <QueryClientProvider client={queryClient}>
-        <Form>
+        <MountedFormHost>
           <ProviderSpecificFields selectedProvider={Providers.Azure} />
-        </Form>
+        </MountedFormHost>
       </QueryClientProvider>,
     );
 
@@ -231,9 +231,9 @@ describe("ProviderSpecificFields", () => {
     const queryClient = createQueryClient();
     render(
       <QueryClientProvider client={queryClient}>
-        <Form>
+        <MountedFormHost>
           <ProviderSpecificFields selectedProvider={Providers.Azure} />
-        </Form>
+        </MountedFormHost>
       </QueryClientProvider>,
     );
 
@@ -256,9 +256,9 @@ describe("ProviderSpecificFields", () => {
     const queryClient = createQueryClient();
     render(
       <QueryClientProvider client={queryClient}>
-        <Form>
+        <MountedFormHost>
           <ProviderSpecificFields selectedProvider={Providers.Azure} />
-        </Form>
+        </MountedFormHost>
       </QueryClientProvider>,
     );
 
@@ -281,9 +281,9 @@ describe("ProviderSpecificFields", () => {
     const queryClient = createQueryClient();
     render(
       <QueryClientProvider client={queryClient}>
-        <Form>
+        <MountedFormHost>
           <ProviderSpecificFields selectedProvider={Providers.Azure} />
-        </Form>
+        </MountedFormHost>
       </QueryClientProvider>,
     );
 
@@ -316,9 +316,9 @@ describe("ProviderSpecificFields", () => {
     const queryClient = createQueryClient();
     render(
       <QueryClientProvider client={queryClient}>
-        <Form>
+        <MountedFormHost>
           <ProviderSpecificFields selectedProvider={Providers.Azure} />
-        </Form>
+        </MountedFormHost>
       </QueryClientProvider>,
     );
 
diff --git a/ui/litellm-dashboard/src/components/add_model/provider_specific_fields.tsx b/ui/litellm-dashboard/src/components/add_model/provider_specific_fields.tsx
index 2bbf2b0cfa5..955167c4351 100644
--- a/ui/litellm-dashboard/src/components/add_model/provider_specific_fields.tsx
+++ b/ui/litellm-dashboard/src/components/add_model/provider_specific_fields.tsx
@@ -1,10 +1,18 @@
 import { useProviderFields } from "@/app/(dashboard)/hooks/providers/useProviderFields";
 import { UploadOutlined } from "@ant-design/icons";
 import { Input } from "@/components/ui/input";
-import { Button as Button2, Col, Form, Input as AntdInput, Row, Select, Typography, Upload, UploadProps } from "antd";
+import { Button as Button2, Col, Input as AntdInput, Row, Select, Typography, Upload, UploadProps } from "antd";
 import React from "react";
+import { useFormContext } from "react-hook-form";
+import { antdRequired } from "../common_components/antdFormRules";
+import {
+  MountedFormField,
+  type MountedFieldControlProps,
+  type MountedFormValues,
+} from "../common_components/MountedFormField";
 import { CredentialItem, ProviderCredentialFieldMetadata } from "../networking";
 import { provider_map, Providers } from "../provider_info_helpers";
+import { labelWithHint } from "@/components/shared/form/LabelWithHint";
 const { Link } = Typography;
 
 interface ProviderSpecificFieldsProps {
@@ -100,7 +108,7 @@ export const createCredentialFromModel = (provider: string, modelData: any): Cre
 
 const ProviderSpecificFields: React.FC<ProviderSpecificFieldsProps> = ({ selectedProvider, uploadProps }) => {
   const selectedProviderEnum = Providers[selectedProvider as keyof typeof Providers] as Providers;
-  const form = Form.useFormInstance(); // Get form instance from context
+  const form = useFormContext<MountedFormValues>();
 
   const { data: providerMetadata, isLoading, error: loadError } = useProviderFields();
 
@@ -185,12 +193,12 @@ const ProviderSpecificFields: React.FC<ProviderSpecificFieldsProps> = ({ selecte
       const apiVersion = getApiVersionFromApiBase(event.target.value);
       if (apiVersion) {
         lastInferredApiVersionRef.current = apiVersion;
-        form.setFieldsValue({ api_version: apiVersion });
+        form.setValue("api_version", apiVersion);
         return;
       }
 
-      if (form.getFieldValue("api_version") === lastInferredApiVersionRef.current) {
-        form.setFieldsValue({ api_version: "" });
+      if (form.getValues("api_version") === lastInferredApiVersionRef.current) {
+        form.setValue("api_version", "");
       }
       lastInferredApiVersionRef.current = null;
     },
@@ -206,7 +214,7 @@ const ProviderSpecificFields: React.FC<ProviderSpecificFieldsProps> = ({ selecte
         reader.onload = (e) => {
           if (e.target) {
             const jsonStr = e.target.result as string;
-            form.setFieldsValue({ vertex_credentials: jsonStr });
+            form.setValue("vertex_credentials", jsonStr);
           }
         };
         reader.readAsText(file);
@@ -216,10 +224,17 @@ const ProviderSpecificFields: React.FC<ProviderSpecificFieldsProps> = ({ selecte
     },
   };
 
-  const renderFieldControl = (field: ProviderCredentialField) => {
+  const renderFieldControl = (field: ProviderCredentialField, control: MountedFieldControlProps) => {
     if (field.type === "select") {
       return (
-        <Select placeholder={field.placeholder} defaultValue={field.defaultValue}>
+        <Select
+          id={control.id}
+          value={control.value as string | undefined}
+          onChange={control.onChange}
+          onBlur={control.onBlur}
+          placeholder={field.placeholder}
+          defaultValue={field.defaultValue}
+        >
           {field.options?.map((option) => (
             <Select.Option key={option} value={option}>
               {option}
@@ -234,6 +249,7 @@ const ProviderSpecificFields: React.FC<ProviderSpecificFieldsProps> = ({ selecte
         <Upload
           {...handleUpload}
           onChange={(info) => {
+            control.onChange(info);
             if (uploadProps?.onChange) {
               uploadProps.onChange(info);
             }
@@ -247,6 +263,10 @@ const ProviderSpecificFields: React.FC<ProviderSpecificFieldsProps> = ({ selecte
     if (field.type === "textarea") {
       return (
         <AntdInput.TextArea
+          id={control.id}
+          value={control.value as string | undefined}
+          onChange={control.onChange}
+          onBlur={control.onBlur}
           placeholder={field.placeholder}
           defaultValue={field.defaultValue}
           rows={6}
@@ -256,15 +276,32 @@ const ProviderSpecificFields: React.FC<ProviderSpecificFieldsProps> = ({ selecte
     }
 
     if (field.type === "password") {
-      return <AntdInput.Password placeholder={field.placeholder} defaultValue={field.defaultValue} />;
+      return (
+        <AntdInput.Password
+          id={control.id}
+          value={control.value as string | undefined}
+          onChange={control.onChange}
+          onBlur={control.onBlur}
+          placeholder={field.placeholder}
+          defaultValue={field.defaultValue}
+        />
+      );
     }
 
     return (
       <Input
+        id={control.id}
+        value={(control.value as string | undefined) ?? undefined}
+        onBlur={control.onBlur}
         placeholder={field.placeholder}
         type="text"
         defaultValue={field.defaultValue}
-        onChange={field.key === "api_base" ? handleApiBaseChange : undefined}
+        onChange={(event) => {
+          control.onChange(event);
+          if (field.key === "api_base") {
+            handleApiBaseChange(event);
+          }
+        }}
       />
     );
   };
@@ -281,7 +318,7 @@ const ProviderSpecificFields: React.FC<ProviderSpecificFieldsProps> = ({ selecte
       {loadError && allFields.length === 0 && (
         <Row>
           <Col span={24}>
-            <p className="text-sm mb-2 text-red-500">
+            <p className="text-sm mb-2 text-destructive">
               {loadError instanceof Error ? loadError.message : "Failed to load provider credential fields"}
             </p>
           </Col>
@@ -289,15 +326,15 @@ const ProviderSpecificFields: React.FC<ProviderSpecificFieldsProps> = ({ selecte
       )}
       {allFields.map((field) => (
         <React.Fragment key={field.key}>
-          <Form.Item
-            label={field.label}
+          <MountedFormField
+            label={field.tooltip ? labelWithHint(field.label, field.tooltip) : field.label}
             name={field.key}
-            rules={field.required ? [{ required: true, message: "Required" }] : undefined}
-            tooltip={field.tooltip}
-            className={field.key === "vertex_credentials" ? "mb-0" : undefined}
+            required={field.required}
+            rules={field.required ? { validate: { required: antdRequired("Required") } } : undefined}
+            className={field.key === "vertex_credentials" ? "mb-0" : "mb-4"}
           >
-            {renderFieldControl(field)}
-          </Form.Item>
+            {(control) => renderFieldControl(field, control)}
+          </MountedFormField>
 
           {/* Special case for Vertex Credentials help text */}
           {field.key === "vertex_credentials" && (
diff --git a/ui/litellm-dashboard/src/components/atoms/Tooltip.tsx b/ui/litellm-dashboard/src/components/atoms/Tooltip.tsx
deleted file mode 100644
index 02b03b518bf..00000000000
--- a/ui/litellm-dashboard/src/components/atoms/Tooltip.tsx
+++ /dev/null
@@ -1,40 +0,0 @@
-import React from "react";
-import { CircleHelp } from "lucide-react";
-
-import { Tooltip as ShadcnTooltip, TooltipContent, TooltipProvider, TooltipTrigger } from "@/components/ui/tooltip";
-import { cn } from "@/lib/cva.config";
-
-interface TooltipProps {
-  content: React.ReactNode;
-  children?: React.ReactNode;
-  width?: string;
-  className?: string;
-}
-
-const widthClassNames: Record<string, string> = {
-  "360px": "max-w-[360px]",
-  "500px": "max-w-[500px]",
-  auto: "max-w-xs",
-};
-
-export const Tooltip: React.FC<TooltipProps> = ({ content, children, width = "auto", className }) => (
-  <TooltipProvider>
-    <ShadcnTooltip>
-      <TooltipTrigger
-        render={
-          <span
-            className={cn(
-              "inline-flex cursor-help items-center rounded-sm focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring",
-              className,
-            )}
-          />
-        }
-      >
-        {children ?? <CircleHelp aria-label="question-circle" className="ml-1 size-4 text-muted-foreground" />}
-      </TooltipTrigger>
-      <TooltipContent className={cn("whitespace-normal", widthClassNames[width] ?? "max-w-xs")}>
-        {content}
-      </TooltipContent>
-    </ShadcnTooltip>
-  </TooltipProvider>
-);
diff --git a/ui/litellm-dashboard/src/components/atoms/index.ts b/ui/litellm-dashboard/src/components/atoms/index.ts
deleted file mode 100644
index 4b0a2f8749b..00000000000
--- a/ui/litellm-dashboard/src/components/atoms/index.ts
+++ /dev/null
@@ -1 +0,0 @@
-export { Tooltip } from "./Tooltip";
diff --git a/ui/litellm-dashboard/src/components/common_components/KeyLifecycleSettings.test.tsx b/ui/litellm-dashboard/src/components/common_components/KeyLifecycleSettings.test.tsx
index cfcbd841f63..d23e9da703a 100644
--- a/ui/litellm-dashboard/src/components/common_components/KeyLifecycleSettings.test.tsx
+++ b/ui/litellm-dashboard/src/components/common_components/KeyLifecycleSettings.test.tsx
@@ -1,6 +1,5 @@
 import React, { useState } from "react";
-// eslint-disable-next-line no-restricted-imports -- exercising KeyLifecycleSettings requires hosting it in a real antd Form (the component it's built on)
-import { Form } from "antd";
+import { Controller, useForm } from "react-hook-form";
 import userEvent, { PointerEventsCheckLevel } from "@testing-library/user-event";
 import { describe, expect, it, vi, beforeEach } from "vitest";
 import { renderWithProviders, screen, waitFor } from "../../../tests/test-utils";
@@ -15,30 +14,37 @@ interface HarnessProps {
 }
 
 const Harness: React.FC<HarnessProps> = ({ isCreateMode = true, onFinish = () => {} }) => {
-  const [form] = Form.useForm();
+  const form = useForm<{ duration: string }>({ defaultValues: { duration: "" } });
   const [autoRotationEnabled, setAutoRotationEnabled] = useState(false);
   const [rotationInterval, setRotationInterval] = useState("");
   const [neverExpire, setNeverExpire] = useState(false);
 
   return (
-    <Form form={form} onFinish={onFinish}>
-      <Form.Item name="duration" initialValue="" noStyle>
-        <KeyLifecycleSettings
-          autoRotationEnabled={autoRotationEnabled}
-          onAutoRotationChange={setAutoRotationEnabled}
-          rotationInterval={rotationInterval}
-          onRotationIntervalChange={setRotationInterval}
-          isCreateMode={isCreateMode}
-          neverExpire={neverExpire}
-          onNeverExpireChange={setNeverExpire}
-        />
-      </Form.Item>
+    <form onSubmit={form.handleSubmit(onFinish)}>
+      <Controller
+        control={form.control}
+        name="duration"
+        render={({ field }) => (
+          <KeyLifecycleSettings
+            id={field.name}
+            value={field.value}
+            onChange={field.onChange}
+            autoRotationEnabled={autoRotationEnabled}
+            onAutoRotationChange={setAutoRotationEnabled}
+            rotationInterval={rotationInterval}
+            onRotationIntervalChange={setRotationInterval}
+            isCreateMode={isCreateMode}
+            neverExpire={neverExpire}
+            onNeverExpireChange={setNeverExpire}
+          />
+        )}
+      />
       <button type="submit">submit</button>
-      <button type="button" onClick={() => form.resetFields()}>
+      <button type="button" onClick={() => form.reset()}>
         reset
       </button>
       <span data-testid="rotation-interval-value">{rotationInterval}</span>
-    </Form>
+    </form>
   );
 };
 
@@ -169,7 +175,7 @@ describe("KeyLifecycleSettings", () => {
     });
 
     it("shows the custom interval input when Custom interval is selected, without propagating yet", async () => {
-      const user = userEvent.setup();
+      const user = userEvent.setup({ pointerEventsCheck: PointerEventsCheckLevel.Never });
       renderWithProviders(<Harness />);
 
       await user.click(screen.getByRole("switch"));
@@ -184,7 +190,7 @@ describe("KeyLifecycleSettings", () => {
     });
 
     it("propagates a typed custom interval to the parent", async () => {
-      const user = userEvent.setup();
+      const user = userEvent.setup({ pointerEventsCheck: PointerEventsCheckLevel.Never });
       renderWithProviders(<Harness />);
 
       await user.click(screen.getByRole("switch"));
diff --git a/ui/litellm-dashboard/src/components/common_components/MemberTable.tsx b/ui/litellm-dashboard/src/components/common_components/MemberTable.tsx
index 19c2377bafe..2622c037558 100644
--- a/ui/litellm-dashboard/src/components/common_components/MemberTable.tsx
+++ b/ui/litellm-dashboard/src/components/common_components/MemberTable.tsx
@@ -1,4 +1,4 @@
-import { Tooltip } from "@/components/atoms/Tooltip";
+import { SimpleTooltip } from "@/components/ui/tooltip";
 import { Member } from "@/components/networking";
 import { StatusBadge } from "@/components/shared/table_cells";
 import { Button } from "@/components/ui/button";
@@ -60,9 +60,9 @@ export default function MemberTable({
               {roleTooltip ? (
                 <span className="inline-flex items-center gap-2">
                   {roleColumnTitle}
-                  <Tooltip content={roleTooltip}>
+                  <SimpleTooltip content={roleTooltip}>
                     <Info className="size-3.5" />
-                  </Tooltip>
+                  </SimpleTooltip>
                 </span>
               ) : (
                 roleColumnTitle
diff --git a/ui/litellm-dashboard/src/components/common_components/MetadataKeyValueFields.test.tsx b/ui/litellm-dashboard/src/components/common_components/MetadataKeyValueFields.test.tsx
index 365cc8bbff5..073b11947a5 100644
--- a/ui/litellm-dashboard/src/components/common_components/MetadataKeyValueFields.test.tsx
+++ b/ui/litellm-dashboard/src/components/common_components/MetadataKeyValueFields.test.tsx
@@ -1,12 +1,14 @@
 import { render, screen, waitFor } from "@testing-library/react";
 import userEvent from "@testing-library/user-event";
-import { Form } from "antd";
 import React from "react";
 import { describe, expect, it, vi } from "vitest";
+import { z } from "zod/v4";
 import { TeamMetadataField } from "@/app/(dashboard)/hooks/teams/useTeamMetadataSchema";
+import { useZodForm } from "@/lib/forms/useZodForm";
 import MetadataKeyValueFields, {
   MetadataPair,
   metadataObjectToPairs,
+  metadataPairsSchema,
   metadataPairsToObject,
 } from "./MetadataKeyValueFields";
 
@@ -95,13 +97,21 @@ interface HarnessProps {
   schemaLoading?: boolean;
 }
 
+const harnessSchema = z.object({ metadata: metadataPairsSchema });
+
 const Harness: React.FC<HarnessProps> = ({ onFinish, initialMetadata, schemaFields, schemaLoading }) => {
-  const [form] = Form.useForm();
+  const form = useZodForm(harnessSchema, { defaultValues: { metadata: initialMetadata ?? [] } });
   return (
-    <Form form={form} onFinish={onFinish} initialValues={{ metadata: initialMetadata }}>
-      <MetadataKeyValueFields form={form} schemaFields={schemaFields} schemaLoading={schemaLoading} />
+    <form onSubmit={form.handleSubmit((values) => onFinish(values))}>
+      <MetadataKeyValueFields
+        control={form.control}
+        getValues={form.getValues}
+        name="metadata"
+        schemaFields={schemaFields}
+        schemaLoading={schemaLoading}
+      />
       <button type="submit">Save</button>
-    </Form>
+    </form>
   );
 };
 
diff --git a/ui/litellm-dashboard/src/components/common_components/MetadataKeyValueFields.tsx b/ui/litellm-dashboard/src/components/common_components/MetadataKeyValueFields.tsx
index da085f95ad8..1c67d48128f 100644
--- a/ui/litellm-dashboard/src/components/common_components/MetadataKeyValueFields.tsx
+++ b/ui/litellm-dashboard/src/components/common_components/MetadataKeyValueFields.tsx
@@ -1,14 +1,36 @@
-import { MinusCircleOutlined, PlusOutlined } from "@ant-design/icons";
-import { Button, Form, FormInstance, Input, Skeleton, Space } from "antd";
+import { CircleMinus, Plus } from "lucide-react";
 import React, { useEffect, useRef } from "react";
+import {
+  useFieldArray,
+  type Control,
+  type FieldArrayPath,
+  type FieldPath,
+  type FieldValues,
+  type UseFormGetValues,
+} from "react-hook-form";
+import { z } from "zod/v4";
 
 import { TeamMetadataField } from "@/app/(dashboard)/hooks/teams/useTeamMetadataSchema";
+import { FormField } from "@/components/shared/form/FormField";
+import { Button } from "@/components/ui/button";
+import { Input } from "@/components/ui/input";
+import { Skeleton } from "@/components/ui/skeleton";
 
 export interface MetadataPair {
   key: string;
   value: string;
 }
 
+export const metadataPairsSchema = z
+  .array(z.object({ key: z.string().min(1, "Missing key"), value: z.string().optional() }))
+  .superRefine((pairs, ctx) => {
+    pairs.forEach((pair, index) => {
+      if (pair.key && pairs.filter((other) => other.key === pair.key).length > 1) {
+        ctx.addIssue({ code: "custom", message: "Duplicate key", path: [index, "key"] });
+      }
+    });
+  });
+
 function formatMetadataValue(value: unknown): string {
   if (typeof value !== "string") {
     return JSON.stringify(value) ?? "";
@@ -48,87 +70,82 @@ export function metadataPairsToObject(
   );
 }
 
-interface MetadataKeyValueFieldsProps {
-  form: FormInstance;
-  name?: string;
+interface MetadataKeyValueFieldsProps<TFieldValues extends FieldValues> {
+  control: Control<TFieldValues>;
+  getValues: UseFormGetValues<TFieldValues>;
+  name: FieldArrayPath<TFieldValues>;
   schemaFields?: readonly TeamMetadataField[];
   schemaLoading?: boolean;
 }
 
-const MetadataKeyValueFields: React.FC<MetadataKeyValueFieldsProps> = ({
-  form,
-  name = "metadata",
+const MetadataKeyValueFields = <TFieldValues extends FieldValues>({
+  control,
+  getValues,
+  name,
   schemaFields = [],
   schemaLoading = false,
-}) => {
+}: MetadataKeyValueFieldsProps<TFieldValues>) => {
+  const { fields, append, remove } = useFieldArray({ control, name });
   const seededRef = useRef(false);
 
   useEffect(() => {
     if (seededRef.current || schemaLoading || schemaFields.length === 0) return;
     seededRef.current = true;
-    const pairs: (Partial<MetadataPair> | undefined)[] = form.getFieldValue(name) ?? [];
+    const pairs: (Partial<MetadataPair> | undefined)[] = getValues(name as unknown as FieldPath<TFieldValues>) ?? [];
     if (!Array.isArray(pairs)) return;
     const existingKeys = new Set(pairs.map((pair) => pair?.key).filter(Boolean));
     const seeded = schemaFields
       .filter((field) => !existingKeys.has(field.key))
       .map((field) => ({ key: field.key, value: "" }));
     if (seeded.length > 0) {
-      form.setFieldValue(name, [...pairs, ...seeded]);
+      append(seeded as never, { shouldFocus: false });
     }
-  }, [form, name, schemaFields, schemaLoading]);
+  }, [append, getValues, name, schemaFields, schemaLoading]);
 
   if (schemaLoading) {
     return (
-      <div data-testid="metadata-schema-skeleton">
-        <Skeleton active title={false} paragraph={{ rows: 3 }} />
+      <div data-testid="metadata-schema-skeleton" className="space-y-2">
+        <Skeleton className="h-4 w-full" />
+        <Skeleton className="h-4 w-full" />
+        <Skeleton className="h-4 w-2/3" />
       </div>
     );
   }
 
   return (
-    <Form.List name={name}>
-      {(fields, { add, remove }) => (
-        <>
-          {fields.map(({ key, name: fieldName, ...restField }) => (
-            <Space key={key} style={{ display: "flex", marginBottom: 8 }} align="baseline">
-              <Form.Item
-                {...restField}
-                name={[fieldName, "key"]}
-                rules={[
-                  { required: true, message: "Missing key" },
-                  {
-                    validator: (_, value) => {
-                      if (!value) return Promise.resolve();
-                      const all: (Partial<MetadataPair> | undefined)[] = form.getFieldValue(name) ?? [];
-                      const dupes = all.filter((entry) => entry?.key === value);
-                      if (dupes.length > 1) {
-                        return Promise.reject(new Error("Duplicate key"));
-                      }
-                      return Promise.resolve();
-                    },
-                  },
-                ]}
-              >
-                <Input placeholder="Key" />
-              </Form.Item>
-              <Form.Item {...restField} name={[fieldName, "value"]}>
-                <Input placeholder="Value" />
-              </Form.Item>
-              <MinusCircleOutlined
-                aria-label="Remove key-value pair"
-                onClick={() => remove(fieldName)}
-                style={{ color: "#ef4444" }}
-              />
-            </Space>
-          ))}
-          <Form.Item style={{ marginBottom: 0 }}>
-            <Button type="dashed" onClick={() => add()} block icon={<PlusOutlined />}>
-              Add Key-Value Pair
-            </Button>
-          </Form.Item>
-        </>
-      )}
-    </Form.List>
+    <>
+      {fields.map((field, index) => (
+        <div key={field.id} className="mb-2 flex items-start gap-2">
+          <FormField control={control} name={`${name}.${index}.key` as FieldPath<TFieldValues>}>
+            {({ ref, value, ...rest }) => (
+              <Input {...rest} ref={ref} value={(value as string) ?? ""} placeholder="Key" />
+            )}
+          </FormField>
+          <FormField control={control} name={`${name}.${index}.value` as FieldPath<TFieldValues>}>
+            {({ ref, value, ...rest }) => (
+              <Input {...rest} ref={ref} value={(value as string) ?? ""} placeholder="Value" />
+            )}
+          </FormField>
+          <Button
+            variant="ghost"
+            size="icon"
+            aria-label="Remove key-value pair"
+            className="mt-1 text-destructive"
+            onClick={() => remove(index)}
+          >
+            <CircleMinus className="size-4" />
+          </Button>
+        </div>
+      ))}
+      <Button
+        variant="outline"
+        className="w-full border-dashed"
+        onClick={() => append({ key: "", value: "" } as never, { shouldFocus: false })}
+      >
+        <Plus className="size-4" />
+        Add Key-Value Pair
+      </Button>
+    </>
   );
 };
 
diff --git a/ui/litellm-dashboard/src/components/common_components/MountedFormField.test.tsx b/ui/litellm-dashboard/src/components/common_components/MountedFormField.test.tsx
new file mode 100644
index 00000000000..62cdd935131
--- /dev/null
+++ b/ui/litellm-dashboard/src/components/common_components/MountedFormField.test.tsx
@@ -0,0 +1,187 @@
+import React from "react";
+import { render, renderHook, screen, waitFor } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { describe, expect, it, vi } from "vitest";
+import { useForm } from "react-hook-form";
+import type { UseFormGetValues } from "react-hook-form";
+
+import {
+  MountedFormField,
+  MountedFormProvider,
+  projectMountedValues,
+  useMountRegistry,
+  type MountedFieldName,
+  type MountedFormValues,
+  type MountRegistry,
+} from "./MountedFormField";
+
+const registryOf = (names: readonly MountedFieldName[]): MountRegistry => ({
+  register: () => () => undefined,
+  mountedNames: () => names,
+});
+
+const getValuesOf = (store: Readonly<Record<string, unknown>>): UseFormGetValues<MountedFormValues> =>
+  ((names: readonly string[]) => names.map((name) => store[name])) as unknown as UseFormGetValues<MountedFormValues>;
+
+const project = (store: Readonly<Record<string, unknown>>) =>
+  projectMountedValues(registryOf(Object.keys(store)), getValuesOf(store));
+
+const projectPaths = (entries: readonly (readonly [MountedFieldName, unknown])[]) => {
+  const store = Object.fromEntries(
+    entries.map(([name, value]) => [Array.isArray(name) ? name.join(".") : (name as string), value]),
+  );
+  return projectMountedValues(registryOf(entries.map(([name]) => name)), getValuesOf(store));
+};
+
+describe("projectMountedValues", () => {
+  it("keeps a flat name flat", () => {
+    expect(project({ server_name: "s1", transport: "http" })).toStrictEqual({ server_name: "s1", transport: "http" });
+  });
+
+  it("nests an ARRAY name into a credentials object", () => {
+    expect(
+      projectPaths([
+        [["credentials", "aws_region_name"], "us-east-1"],
+        [["credentials", "aws_access_key_id"], "AKIA"],
+      ]),
+    ).toStrictEqual({ credentials: { aws_region_name: "us-east-1", aws_access_key_id: "AKIA" } });
+  });
+
+  it("keeps a literal dotted STRING name flat, matching antd getNamePath toArray", () => {
+    expect(projectPaths([["a.b", 1]])).toStrictEqual({ "a.b": 1 });
+    expect(projectPaths([["schema.property.with.dots", "v"]])).toStrictEqual({ "schema.property.with.dots": "v" });
+  });
+
+  it("rebuilds Form.List rows as an array, not an object keyed by digits", () => {
+    const projected = projectPaths([
+      [["env_vars", "0", "name"], "API_KEY"],
+      [["env_vars", "0", "description"], "the key"],
+      [["env_vars", "1", "name"], "REGION"],
+    ]);
+    expect(projected).toStrictEqual({
+      env_vars: [{ name: "API_KEY", description: "the key" }, { name: "REGION" }],
+    });
+    expect(Array.isArray(projected.env_vars)).toBe(true);
+  });
+
+  it("rebuilds static_headers rows, the second Form.List site", () => {
+    expect(
+      projectPaths([
+        [["static_headers", "0", "key"], "X-Tenant"],
+        [["static_headers", "0", "value"], "acme"],
+      ]),
+    ).toStrictEqual({
+      static_headers: [{ key: "X-Tenant", value: "acme" }],
+    });
+  });
+
+  it("emits a mounted-but-unset field as a key holding undefined, matching antd onFinish", () => {
+    const projected = project({ alias: undefined });
+    expect(Object.keys(projected)).toStrictEqual(["alias"]);
+    expect(projected.alias).toBeUndefined();
+  });
+
+  it("leaves a sparse row index as a hole rather than shifting later rows down", () => {
+    const projected = projectPaths([[["env_vars", "2", "name"], "THIRD"]]) as { env_vars: readonly unknown[] };
+    expect(projected.env_vars).toHaveLength(3);
+    expect(projected.env_vars[2]).toStrictEqual({ name: "THIRD" });
+  });
+
+  it("mixes flat, nested and list names in one projection", () => {
+    expect(
+      projectPaths([
+        ["transport", "http"],
+        [["credentials", "client_id"], "cid"],
+        [["env_vars", "0", "name"], "K"],
+      ]),
+    ).toStrictEqual({
+      transport: "http",
+      credentials: { client_id: "cid" },
+      env_vars: [{ name: "K" }],
+    });
+  });
+});
+
+describe("useMountRegistry lifecycle", () => {
+  const GatedForm: React.FC<{
+    showOptional: boolean;
+    showRequired: boolean;
+    onFinish: (v: MountedFormValues) => void;
+  }> = ({ showOptional, showRequired, onFinish }) => {
+    const form = useForm<MountedFormValues>({ mode: "onChange", defaultValues: { server_name: "keep" } });
+    const registry = useMountRegistry();
+    return (
+      <MountedFormProvider value={{ control: form.control, registry }}>
+        <form
+          onSubmit={(event) => {
+            event.preventDefault();
+            void form
+              .trigger(registry.mountedNames().map((n) => (Array.isArray(n) ? n.join(".") : (n as string))))
+              .then((valid) => {
+                if (valid) onFinish(projectMountedValues(registry, form.getValues));
+              });
+          }}
+        >
+          <MountedFormField name="server_name">
+            {(control) => (
+              <input aria-label="server_name" value={String(control.value ?? "")} onChange={control.onChange} />
+            )}
+          </MountedFormField>
+          {showOptional && (
+            <MountedFormField name="alias">
+              {(control) => (
+                <input aria-label="alias" value={String(control.value ?? "")} onChange={control.onChange} />
+              )}
+            </MountedFormField>
+          )}
+          {showRequired && (
+            <MountedFormField name="token_url" rules={{ required: "Token URL is required" }}>
+              {(control) => (
+                <input aria-label="token_url" value={String(control.value ?? "")} onChange={control.onChange} />
+              )}
+            </MountedFormField>
+          )}
+          <button type="submit">Submit</button>
+        </form>
+      </MountedFormProvider>
+    );
+  };
+
+  it("drops a field's key from the submitted payload once its gate unmounts it", async () => {
+    const onFinish = vi.fn();
+    const { rerender } = render(<GatedForm showOptional showRequired={false} onFinish={onFinish} />);
+
+    await userEvent.click(screen.getByRole("button", { name: "Submit" }));
+    await waitFor(() => expect(onFinish).toHaveBeenCalledTimes(1));
+    expect(Object.keys(onFinish.mock.calls[0][0] as object)).toContain("alias");
+
+    rerender(<GatedForm showOptional={false} showRequired={false} onFinish={onFinish} />);
+    await userEvent.click(screen.getByRole("button", { name: "Submit" }));
+    await waitFor(() => expect(onFinish).toHaveBeenCalledTimes(2));
+    expect(Object.keys(onFinish.mock.calls[1][0] as object)).not.toContain("alias");
+  });
+
+  it("submits after a required field is unmounted, rather than validating a field the user can no longer see", async () => {
+    const onFinish = vi.fn();
+    const { rerender } = render(<GatedForm showOptional={false} showRequired onFinish={onFinish} />);
+
+    await userEvent.click(screen.getByRole("button", { name: "Submit" }));
+    expect(await screen.findByText("Token URL is required")).toBeInTheDocument();
+    expect(onFinish).not.toHaveBeenCalled();
+
+    rerender(<GatedForm showOptional={false} showRequired={false} onFinish={onFinish} />);
+    await userEvent.click(screen.getByRole("button", { name: "Submit" }));
+    await waitFor(() => expect(onFinish).toHaveBeenCalledTimes(1));
+    expect(Object.keys(onFinish.mock.calls[0][0] as object)).not.toContain("token_url");
+  });
+
+  it("keeps a name mounted while a second field still holds a registration on it", () => {
+    const registry = renderHook(() => useMountRegistry()).result.current;
+    const releaseFirst = registry.register("credentials.scopes");
+    registry.register("credentials.scopes");
+
+    releaseFirst();
+
+    expect(registry.mountedNames()).toStrictEqual(["credentials.scopes"]);
+  });
+});
diff --git a/ui/litellm-dashboard/src/components/common_components/MountedFormField.tsx b/ui/litellm-dashboard/src/components/common_components/MountedFormField.tsx
new file mode 100644
index 00000000000..f0efa885d92
--- /dev/null
+++ b/ui/litellm-dashboard/src/components/common_components/MountedFormField.tsx
@@ -0,0 +1,177 @@
+"use client";
+
+import * as React from "react";
+import {
+  Controller,
+  type Control,
+  type ControllerProps,
+  type RegisterOptions,
+  type UseFormGetValues,
+} from "react-hook-form";
+
+import { Field, FieldDescription, FieldError, FieldLabel } from "@/components/shared/form/field";
+
+export type MountedFormValues = Record<string, unknown>;
+
+const fieldKey = (name: string | readonly string[]): string =>
+  Array.isArray(name) ? name.join(".") : (name as string);
+
+export type MountedFieldName = string | readonly string[];
+
+export interface MountRegistry {
+  readonly register: (name: MountedFieldName) => () => void;
+  readonly mountedNames: () => readonly MountedFieldName[];
+}
+
+export interface MountedFormContextValue {
+  readonly control: Control<MountedFormValues>;
+  readonly registry: MountRegistry;
+}
+
+const missingProvider = (): never => {
+  throw new Error("MountedFormField requires a MountedFormProvider ancestor");
+};
+
+const MountedFormContext = React.createContext<MountedFormContextValue>({
+  get control(): Control<MountedFormValues> {
+    return missingProvider();
+  },
+  registry: {
+    register: missingProvider,
+    mountedNames: missingProvider,
+  },
+});
+
+export const MountedFormProvider = MountedFormContext.Provider;
+
+export const useMountRegistry = (): MountRegistry => {
+  const counts = React.useRef<Map<string, { readonly name: MountedFieldName; readonly count: number }>>(new Map());
+  return React.useMemo(
+    () => ({
+      register: (name: MountedFieldName) => {
+        const key = fieldKey(name);
+        counts.current.set(key, { name, count: (counts.current.get(key)?.count ?? 0) + 1 });
+        return () => {
+          const remaining = (counts.current.get(key)?.count ?? 0) - 1;
+          if (remaining > 0) {
+            counts.current.set(key, { name, count: remaining });
+          } else {
+            counts.current.delete(key);
+          }
+        };
+      },
+      mountedNames: () => Array.from(counts.current.values(), (entry) => entry.name),
+    }),
+    [],
+  );
+};
+
+const withIndex = (base: readonly unknown[], index: number, next: unknown): readonly unknown[] =>
+  Array.from({ length: Math.max(base.length, index + 1) }, (_, i) => (i === index ? next : base[i]));
+
+const setPath = (target: unknown, segments: readonly string[], value: unknown): unknown => {
+  const [head, ...rest] = segments;
+  if (/^\d+$/.test(head)) {
+    const base: readonly unknown[] = Array.isArray(target) ? target : [];
+    const index = Number(head);
+    return withIndex(base, index, rest.length === 0 ? value : setPath(base[index], rest, value));
+  }
+  const base: Record<string, unknown> =
+    target !== null && typeof target === "object" && !Array.isArray(target) ? (target as Record<string, unknown>) : {};
+  return { ...base, [head]: rest.length === 0 ? value : setPath(base[head], rest, value) };
+};
+
+export const projectMountedValues = (
+  registry: MountRegistry,
+  getValues: UseFormGetValues<MountedFormValues>,
+): MountedFormValues => {
+  const names = [...registry.mountedNames()];
+  const values = getValues(names.map(fieldKey));
+  return names.reduce<MountedFormValues>(
+    (projected, name, index) =>
+      setPath(projected, Array.isArray(name) ? name : [name as string], values[index]) as MountedFormValues,
+    {},
+  );
+};
+
+export const useMountedName = (name: MountedFieldName): void => {
+  const { registry } = React.useContext(MountedFormContext);
+  React.useEffect(() => registry.register(name), [registry, name]);
+};
+
+export type MountedFieldControlProps = {
+  readonly id: string;
+  readonly name: string;
+  readonly value: unknown;
+  readonly onChange: (...event: unknown[]) => void;
+  readonly onBlur: () => void;
+  readonly "aria-required": "true" | undefined;
+  readonly "aria-invalid": "true" | undefined;
+  readonly "aria-describedby": string | undefined;
+};
+
+export interface MountedFormFieldProps {
+  readonly name: MountedFieldName;
+  readonly label?: React.ReactNode;
+  readonly help?: React.ReactNode;
+  readonly required?: boolean;
+  readonly rules?: Omit<
+    RegisterOptions<MountedFormValues, string>,
+    "valueAsNumber" | "valueAsDate" | "setValueAs" | "disabled"
+  >;
+  readonly defaultValue?: unknown;
+  readonly bare?: boolean;
+  readonly className?: string;
+  readonly children: (control: MountedFieldControlProps) => React.ReactNode;
+}
+
+export const MountedFormField: React.FC<MountedFormFieldProps> = ({
+  name,
+  label,
+  help,
+  required,
+  rules,
+  defaultValue,
+  bare,
+  className,
+  children,
+}) => {
+  const { control } = React.useContext(MountedFormContext);
+  const path = fieldKey(name);
+  useMountedName(name);
+
+  const helpId = `${path}_help`;
+  const hasHelp = help !== undefined && help !== null;
+
+  const renderField: ControllerProps<MountedFormValues, string>["render"] = ({ field, fieldState }) => {
+    const invalid = fieldState.error !== undefined;
+    const controlProps: MountedFieldControlProps = {
+      id: path,
+      name: field.name,
+      value: field.value,
+      onChange: field.onChange,
+      onBlur: field.onBlur,
+      "aria-required": required ? "true" : undefined,
+      "aria-invalid": invalid ? "true" : undefined,
+      "aria-describedby": hasHelp || invalid ? helpId : undefined,
+    };
+
+    if (bare) {
+      return <>{children(controlProps)}</>;
+    }
+
+    return (
+      <Field data-invalid={invalid || undefined} className={className}>
+        {label !== undefined && <FieldLabel htmlFor={path}>{label}</FieldLabel>}
+        {children(controlProps)}
+        {hasHelp ? (
+          <FieldDescription id={helpId}>{help}</FieldDescription>
+        ) : (
+          <FieldError id={helpId} errors={[fieldState.error]} />
+        )}
+      </Field>
+    );
+  };
+
+  return <Controller control={control} name={path} rules={rules} defaultValue={defaultValue} render={renderField} />;
+};
diff --git a/ui/litellm-dashboard/src/components/common_components/PassThroughGuardrailsSection.test.tsx b/ui/litellm-dashboard/src/components/common_components/PassThroughGuardrailsSection.test.tsx
new file mode 100644
index 00000000000..0cc95033dde
--- /dev/null
+++ b/ui/litellm-dashboard/src/components/common_components/PassThroughGuardrailsSection.test.tsx
@@ -0,0 +1,61 @@
+import { render, screen } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+import PassThroughGuardrailsSection from "./PassThroughGuardrailsSection";
+
+vi.mock("../networking", async (importOriginal) => ({
+  ...(await importOriginal<typeof import("../networking")>()),
+  getGuardrailsList: vi.fn(async () => ({ guardrails: [{ guardrail_name: "pii-guard" }] })),
+}));
+
+const FIELDS = [
+  { label: "Request Fields", matcher: /Request Fields/, payloadKey: "request_fields", typed: "query" },
+  { label: "Response Fields", matcher: /Response Fields/, payloadKey: "response_fields", typed: "choices.content" },
+] as const;
+
+const renderSection = (disabled: boolean) => {
+  const onChange = vi.fn();
+  render(
+    <PassThroughGuardrailsSection
+      accessToken="test-token"
+      value={{ "pii-guard": null }}
+      onChange={onChange}
+      disabled={disabled}
+    />,
+  );
+  return onChange;
+};
+
+const fieldInput = (matcher: RegExp) => screen.getByLabelText(matcher) as HTMLInputElement;
+
+describe("PassThroughGuardrailsSection field targeting", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it.each(FIELDS)(
+    "commits a typed $label entry while the section is enabled",
+    async ({ matcher, payloadKey, typed }) => {
+      const user = userEvent.setup();
+      const onChange = renderSection(false);
+
+      await user.type(fieldInput(matcher), `${typed},`);
+
+      expect(onChange.mock.calls.at(-1)?.[0]).toStrictEqual({ "pii-guard": { [payloadKey]: [typed] } });
+    },
+  );
+
+  it.each(FIELDS)("refuses typed $label input while the section is disabled", async ({ matcher, typed }) => {
+    const user = userEvent.setup();
+    const onChange = renderSection(true);
+    const input = fieldInput(matcher);
+
+    await user.type(input, `${typed},`);
+    await user.type(input, "sneaked-in{Enter}");
+    await user.tab();
+
+    expect(input.value).toBe("");
+    expect(onChange).not.toHaveBeenCalled();
+  });
+});
diff --git a/ui/litellm-dashboard/src/components/common_components/PassThroughGuardrailsSection.tsx b/ui/litellm-dashboard/src/components/common_components/PassThroughGuardrailsSection.tsx
index 2c6856cb8b8..f51629b7ee1 100644
--- a/ui/litellm-dashboard/src/components/common_components/PassThroughGuardrailsSection.tsx
+++ b/ui/litellm-dashboard/src/components/common_components/PassThroughGuardrailsSection.tsx
@@ -174,6 +174,7 @@ const PassThroughGuardrailsSection: React.FC<PassThroughGuardrailsSectionProps>
                       value={value[guardrailName]?.request_fields ?? []}
                       onValueChange={(fields) => handleFieldChange(guardrailName, "request_fields", fields)}
                       tokenSeparators={[","]}
+                      disabled={disabled}
                     />
                   </Field>
                   <Field>
@@ -212,6 +213,7 @@ const PassThroughGuardrailsSection: React.FC<PassThroughGuardrailsSectionProps>
                       value={value[guardrailName]?.response_fields ?? []}
                       onValueChange={(fields) => handleFieldChange(guardrailName, "response_fields", fields)}
                       tokenSeparators={[","]}
+                      disabled={disabled}
                     />
                   </Field>
                 </div>
diff --git a/ui/litellm-dashboard/src/components/common_components/PremiumLoggingSettings.test.tsx b/ui/litellm-dashboard/src/components/common_components/PremiumLoggingSettings.test.tsx
new file mode 100644
index 00000000000..76b90bdca90
--- /dev/null
+++ b/ui/litellm-dashboard/src/components/common_components/PremiumLoggingSettings.test.tsx
@@ -0,0 +1,39 @@
+import { readFileSync } from "fs";
+import { resolve } from "path";
+import React from "react";
+import { describe, it, expect, vi } from "vitest";
+import { renderWithProviders, screen } from "../../../tests/test-utils";
+import PremiumLoggingSettings from "./PremiumLoggingSettings";
+
+const SOURCE_PATH = resolve(process.cwd(), "src/components/common_components/PremiumLoggingSettings.tsx");
+
+const HARDCODED_PALETTE =
+  /\b(?:text|bg|border|hover:bg|hover:text|hover:border|dark:bg|dark:text|dark:border|ring|divide|fill|stroke)-(?:gray|slate|zinc|neutral|stone|red|blue|green|yellow|amber|orange|indigo|purple|pink|rose|teal|cyan|sky|violet|fuchsia|lime|emerald)-\d+(?:\/\d+)?\b/g;
+
+const SEMANTIC_TOKEN =
+  /\b(?:text|bg|border|hover:bg|hover:text|ring|divide|fill|stroke)-(?:foreground|muted-foreground|muted|background|card|popover|primary|secondary|destructive|border|input|accent|ring)(?:-foreground)?(?:\/\d+)?\b/g;
+
+describe("PremiumLoggingSettings", () => {
+  it("styles itself from semantic tokens instead of hardcoded palette classes", () => {
+    const source = readFileSync(SOURCE_PATH, "utf8");
+
+    expect(source).toContain("export function PremiumLoggingSettings");
+    expect(source.match(SEMANTIC_TOKEN) ?? []).not.toHaveLength(0);
+    expect(source.match(HARDCODED_PALETTE) ?? []).toHaveLength(0);
+  });
+
+  it("shows the enterprise notice and withholds the editor from a free user", () => {
+    renderWithProviders(<PremiumLoggingSettings value={[]} onChange={vi.fn()} />);
+
+    expect(screen.getByText(/LiteLLM Enterprise feature/)).toBeInTheDocument();
+    expect(screen.getByText("✨ langfuse-logging")).toBeInTheDocument();
+    expect(screen.queryByText("Logging Integrations")).not.toBeInTheDocument();
+  });
+
+  it("renders the editor for a premium user", () => {
+    renderWithProviders(<PremiumLoggingSettings value={[]} onChange={vi.fn()} premiumUser />);
+
+    expect(screen.getByText("Logging Integrations")).toBeInTheDocument();
+    expect(screen.queryByText(/LiteLLM Enterprise feature/)).not.toBeInTheDocument();
+  });
+});
diff --git a/ui/litellm-dashboard/src/components/common_components/PremiumLoggingSettings.tsx b/ui/litellm-dashboard/src/components/common_components/PremiumLoggingSettings.tsx
index 62d2f182120..d1f3cfe6712 100644
--- a/ui/litellm-dashboard/src/components/common_components/PremiumLoggingSettings.tsx
+++ b/ui/litellm-dashboard/src/components/common_components/PremiumLoggingSettings.tsx
@@ -1,4 +1,5 @@
 import React from "react";
+import { Badge } from "@/components/ui/badge";
 import LoggingSettings from "../team/LoggingSettings";
 
 interface PremiumLoggingSettingsProps {
@@ -20,15 +21,15 @@ export function PremiumLoggingSettings({
     return (
       <div>
         <div className="flex flex-wrap gap-2 mb-3">
-          <div className="inline-flex items-center px-3 py-1.5 rounded-lg bg-green-50 border border-green-200 text-green-800 text-sm font-medium opacity-50">
+          <Badge variant="secondary" className="opacity-50">
             ✨ langfuse-logging
-          </div>
-          <div className="inline-flex items-center px-3 py-1.5 rounded-lg bg-green-50 border border-green-200 text-green-800 text-sm font-medium opacity-50">
+          </Badge>
+          <Badge variant="secondary" className="opacity-50">
             ✨ datadog-logging
-          </div>
+          </Badge>
         </div>
-        <div className="p-3 bg-yellow-50 border border-yellow-200 rounded-lg">
-          <p className="text-sm text-yellow-800">
+        <div className="p-3 bg-muted border border-border rounded-lg">
+          <p className="text-sm text-muted-foreground">
             Setting Key/Team logging settings is a LiteLLM Enterprise feature. Global Logging Settings are available for
             all free users. Get a trial key{" "}
             <a href="https://www.litellm.ai/#pricing" target="_blank" rel="noopener noreferrer" className="underline">
diff --git a/ui/litellm-dashboard/src/components/common_components/antdFormRules.ts b/ui/litellm-dashboard/src/components/common_components/antdFormRules.ts
new file mode 100644
index 00000000000..0afac7301af
--- /dev/null
+++ b/ui/litellm-dashboard/src/components/common_components/antdFormRules.ts
@@ -0,0 +1,44 @@
+import type { Validate } from "react-hook-form";
+
+import type { MountedFormValues } from "./MountedFormField";
+
+interface AntdRuleForm {
+  getFieldValue: (name: string) => unknown;
+  isFieldTouched?: (name: string) => boolean;
+}
+
+interface AntdRule {
+  validator: (rule: never, value: never) => Promise<void>;
+}
+
+type AntdRuleSource = AntdRule | ((form: AntdRuleForm) => AntdRule);
+
+type MountedValidate = Validate<unknown, MountedFormValues>;
+
+const isBlank = (value: unknown): boolean => value === undefined || value === null || value === "";
+
+const isEmptyList = (value: unknown): boolean => Array.isArray(value) && value.length === 0;
+
+export const antdRequired =
+  (message: string): MountedValidate =>
+  (value) =>
+    isBlank(value) || isEmptyList(value) ? message : true;
+
+const toMessage = (error: unknown): string => (error instanceof Error ? error.message : String(error));
+
+export const antdRules = (...rules: readonly AntdRuleSource[]): Record<string, MountedValidate> =>
+  Object.fromEntries(
+    rules.map((rule, index) => [
+      `antd_${index}`,
+      async (value: unknown, values: MountedFormValues) => {
+        const resolved = typeof rule === "function" ? rule({ getFieldValue: (name) => values[name] }) : rule;
+        const validator = resolved.validator as (rule: unknown, value: unknown) => Promise<void>;
+        try {
+          await validator(null, value);
+          return true;
+        } catch (error) {
+          return toMessage(error);
+        }
+      },
+    ]),
+  );
diff --git a/ui/litellm-dashboard/src/components/common_components/chartUtils.test.tsx b/ui/litellm-dashboard/src/components/common_components/chartUtils.test.tsx
deleted file mode 100644
index bae11ff5671..00000000000
--- a/ui/litellm-dashboard/src/components/common_components/chartUtils.test.tsx
+++ /dev/null
@@ -1,384 +0,0 @@
-import { render, screen } from "@testing-library/react";
-import { describe, expect, it } from "vitest";
-import { CustomLegend, CustomTooltip } from "./chartUtils";
-import type { ChartTooltipProps } from "@/components/shared/charts/chart_tooltip";
-import { SpendMetrics } from "../UsagePage/types";
-
-type TooltipPayload = NonNullable<ChartTooltipProps["payload"]>;
-
-describe("CustomTooltip", () => {
-  const mockPayload = [
-    {
-      dataKey: "metrics.total_tokens",
-      value: 1000,
-      color: "blue",
-      payload: {
-        date: "2024-01-15",
-        metrics: {
-          total_tokens: 1000,
-          prompt_tokens: 600,
-          completion_tokens: 400,
-          spend: 0.05,
-          api_requests: 10,
-          successful_requests: 9,
-          failed_requests: 1,
-          cache_read_input_tokens: 0,
-          cache_creation_input_tokens: 0,
-        } as SpendMetrics,
-      },
-    },
-  ];
-
-  it("should render", () => {
-    const props: ChartTooltipProps = {
-      active: true,
-      payload: mockPayload as unknown as TooltipPayload,
-      label: "2024-01-15",
-    };
-    render(<CustomTooltip {...props} />);
-    expect(screen.getByText("2024-01-15")).toBeInTheDocument();
-  });
-
-  it("should return null when not active", () => {
-    const props: ChartTooltipProps = {
-      active: false,
-      payload: mockPayload as unknown as TooltipPayload,
-      label: "2024-01-15",
-    };
-    const { container } = render(<CustomTooltip {...props} />);
-    expect(container).toBeEmptyDOMElement();
-  });
-
-  it("should return null when payload is empty", () => {
-    const props: ChartTooltipProps = {
-      active: true,
-      payload: [] as unknown as TooltipPayload,
-      label: "2024-01-15",
-    };
-    const { container } = render(<CustomTooltip {...props} />);
-    expect(container).toBeEmptyDOMElement();
-  });
-
-  it("should display formatted category names", () => {
-    const props: ChartTooltipProps = {
-      active: true,
-      payload: mockPayload as unknown as TooltipPayload,
-      label: "2024-01-15",
-    };
-    render(<CustomTooltip {...props} />);
-    expect(screen.getByText("Total Tokens")).toBeInTheDocument();
-  });
-
-  it("should format category names by removing metrics prefix and replacing underscores", () => {
-    const payloadWithUnderscores = [
-      {
-        dataKey: "metrics.prompt_tokens",
-        value: 600,
-        color: "green",
-        payload: {
-          date: "2024-01-15",
-          metrics: {
-            prompt_tokens: 600,
-            total_tokens: 1000,
-            completion_tokens: 400,
-            spend: 0.05,
-            api_requests: 10,
-            successful_requests: 9,
-            failed_requests: 1,
-            cache_read_input_tokens: 0,
-            cache_creation_input_tokens: 0,
-          } as SpendMetrics,
-        },
-      },
-    ];
-    const props: ChartTooltipProps = {
-      active: true,
-      payload: payloadWithUnderscores as unknown as TooltipPayload,
-      label: "2024-01-15",
-    };
-    render(<CustomTooltip {...props} />);
-    expect(screen.getByText("Prompt Tokens")).toBeInTheDocument();
-  });
-
-  it("should format spend values with dollar sign and two decimal places", () => {
-    const spendPayload = [
-      {
-        dataKey: "metrics.spend",
-        value: 1234.567,
-        color: "red",
-        payload: {
-          date: "2024-01-15",
-          metrics: {
-            spend: 1234.567,
-            total_tokens: 1000,
-            prompt_tokens: 600,
-            completion_tokens: 400,
-            api_requests: 10,
-            successful_requests: 9,
-            failed_requests: 1,
-            cache_read_input_tokens: 0,
-            cache_creation_input_tokens: 0,
-          } as SpendMetrics,
-        },
-      },
-    ];
-    const props: ChartTooltipProps = {
-      active: true,
-      payload: spendPayload as unknown as TooltipPayload,
-      label: "2024-01-15",
-    };
-    render(<CustomTooltip {...props} />);
-    expect(screen.getByText("$1,234.57")).toBeInTheDocument();
-  });
-
-  it("should format non-spend numeric values with locale string", () => {
-    const props: ChartTooltipProps = {
-      active: true,
-      payload: mockPayload as unknown as TooltipPayload,
-      label: "2024-01-15",
-    };
-    render(<CustomTooltip {...props} />);
-    expect(screen.getByText("1,000")).toBeInTheDocument();
-  });
-
-  it("should display N/A when value is undefined", () => {
-    const payloadWithUndefined = [
-      {
-        dataKey: "metrics.nonexistent",
-        value: undefined,
-        color: "blue",
-        payload: {
-          date: "2024-01-15",
-          metrics: {
-            total_tokens: 1000,
-            prompt_tokens: 600,
-            completion_tokens: 400,
-            spend: 0.05,
-            api_requests: 10,
-            successful_requests: 9,
-            failed_requests: 1,
-            cache_read_input_tokens: 0,
-            cache_creation_input_tokens: 0,
-          } as SpendMetrics,
-        },
-      },
-    ];
-    const props: ChartTooltipProps = {
-      active: true,
-      payload: payloadWithUndefined as unknown as TooltipPayload,
-      label: "2024-01-15",
-    };
-    render(<CustomTooltip {...props} />);
-    expect(screen.getByText("N/A")).toBeInTheDocument();
-  });
-
-  it("should handle multiple payload items", () => {
-    const multiplePayload = [
-      {
-        dataKey: "metrics.total_tokens",
-        value: 1000,
-        color: "blue",
-        payload: {
-          date: "2024-01-15",
-          metrics: {
-            total_tokens: 1000,
-            prompt_tokens: 600,
-            completion_tokens: 400,
-            spend: 0.05,
-            api_requests: 10,
-            successful_requests: 9,
-            failed_requests: 1,
-            cache_read_input_tokens: 0,
-            cache_creation_input_tokens: 0,
-          } as SpendMetrics,
-        },
-      },
-      {
-        dataKey: "metrics.spend",
-        value: 0.05,
-        color: "green",
-        payload: {
-          date: "2024-01-15",
-          metrics: {
-            total_tokens: 1000,
-            prompt_tokens: 600,
-            completion_tokens: 400,
-            spend: 0.05,
-            api_requests: 10,
-            successful_requests: 9,
-            failed_requests: 1,
-            cache_read_input_tokens: 0,
-            cache_creation_input_tokens: 0,
-          } as SpendMetrics,
-        },
-      },
-    ];
-    const props: ChartTooltipProps = {
-      active: true,
-      payload: multiplePayload as unknown as TooltipPayload,
-      label: "2024-01-15",
-    };
-    render(<CustomTooltip {...props} />);
-    expect(screen.getByText("Total Tokens")).toBeInTheDocument();
-    expect(screen.getByText("Spend")).toBeInTheDocument();
-  });
-
-  it("should convert color names to hex values", () => {
-    const props: ChartTooltipProps = {
-      active: true,
-      payload: mockPayload as unknown as TooltipPayload,
-      label: "2024-01-15",
-    };
-    const { container } = render(<CustomTooltip {...props} />);
-    const colorIndicator = container.querySelector('span[style*="background-color"]');
-    expect(colorIndicator).toHaveStyle({ backgroundColor: "#3b82f6" });
-  });
-
-  it("should use hex color directly when color is not a known color name", () => {
-    const payloadWithHexColor = [
-      {
-        dataKey: "metrics.total_tokens",
-        value: 1000,
-        color: "#ff0000",
-        payload: {
-          date: "2024-01-15",
-          metrics: {
-            total_tokens: 1000,
-            prompt_tokens: 600,
-            completion_tokens: 400,
-            spend: 0.05,
-            api_requests: 10,
-            successful_requests: 9,
-            failed_requests: 1,
-            cache_read_input_tokens: 0,
-            cache_creation_input_tokens: 0,
-          } as SpendMetrics,
-        },
-      },
-    ];
-    const props: ChartTooltipProps = {
-      active: true,
-      payload: payloadWithHexColor as unknown as TooltipPayload,
-      label: "2024-01-15",
-    };
-    const { container } = render(<CustomTooltip {...props} />);
-    const colorIndicator = container.querySelector('span[style*="background-color"]');
-    expect(colorIndicator).toHaveStyle({ backgroundColor: "#ff0000" });
-  });
-
-  it("should skip items without dataKey", () => {
-    const payloadWithoutDataKey = [
-      {
-        dataKey: undefined,
-        value: 1000,
-        color: "blue",
-        payload: {
-          date: "2024-01-15",
-          metrics: {
-            total_tokens: 1000,
-            prompt_tokens: 600,
-            completion_tokens: 400,
-            spend: 0.05,
-            api_requests: 10,
-            successful_requests: 9,
-            failed_requests: 1,
-            cache_read_input_tokens: 0,
-            cache_creation_input_tokens: 0,
-          } as SpendMetrics,
-        },
-      },
-    ];
-    const props: ChartTooltipProps = {
-      active: true,
-      payload: payloadWithoutDataKey as unknown as TooltipPayload,
-      label: "2024-01-15",
-    };
-    render(<CustomTooltip {...props} />);
-    expect(screen.queryByText("Total Tokens")).not.toBeInTheDocument();
-  });
-
-  it("should skip items without payload", () => {
-    const payloadWithoutPayload = [
-      {
-        dataKey: "metrics.total_tokens",
-        value: 1000,
-        color: "blue",
-        payload: undefined,
-      },
-    ];
-    const props: ChartTooltipProps = {
-      active: true,
-      payload: payloadWithoutPayload as unknown as TooltipPayload,
-      label: "2024-01-15",
-    };
-    render(<CustomTooltip {...props} />);
-    expect(screen.queryByText("Total Tokens")).not.toBeInTheDocument();
-  });
-});
-
-describe("CustomLegend", () => {
-  it("should render", () => {
-    render(<CustomLegend categories={["metrics.total_tokens"]} colors={["blue"]} />);
-    expect(screen.getByText("Total Tokens")).toBeInTheDocument();
-  });
-
-  it("should display multiple categories", () => {
-    render(
-      <CustomLegend
-        categories={["metrics.total_tokens", "metrics.spend", "metrics.prompt_tokens"]}
-        colors={["blue", "green", "red"]}
-      />,
-    );
-    expect(screen.getByText("Total Tokens")).toBeInTheDocument();
-    expect(screen.getByText("Spend")).toBeInTheDocument();
-    expect(screen.getByText("Prompt Tokens")).toBeInTheDocument();
-  });
-
-  it("should format category names by removing metrics prefix and replacing underscores", () => {
-    render(<CustomLegend categories={["metrics.api_requests"]} colors={["blue"]} />);
-    expect(screen.getByText("Api Requests")).toBeInTheDocument();
-  });
-
-  it("should capitalize first letter of each word", () => {
-    render(<CustomLegend categories={["metrics.successful_requests"]} colors={["green"]} />);
-    expect(screen.getByText("Successful Requests")).toBeInTheDocument();
-  });
-
-  it("should convert color names to hex values", () => {
-    const { container } = render(<CustomLegend categories={["metrics.total_tokens"]} colors={["cyan"]} />);
-    const colorIndicator = container.querySelector('span[style*="background-color"]');
-    expect(colorIndicator).toHaveStyle({ backgroundColor: "#06b6d4" });
-  });
-
-  it("should use hex color directly when color is not a known color name", () => {
-    const { container } = render(<CustomLegend categories={["metrics.total_tokens"]} colors={["#ff00ff"]} />);
-    const colorIndicator = container.querySelector('span[style*="background-color"]');
-    expect(colorIndicator).toHaveStyle({ backgroundColor: "#ff00ff" });
-  });
-
-  it("should handle all supported color names", () => {
-    const colors = ["blue", "cyan", "indigo", "green", "red", "purple", "emerald"];
-    const categories = colors.map((_, idx) => `metrics.category_${idx}`);
-    render(<CustomLegend categories={categories} colors={colors} />);
-    expect(screen.getByText("Category 0")).toBeInTheDocument();
-  });
-
-  it("should match categories and colors by index", () => {
-    render(
-      <CustomLegend
-        categories={["metrics.first", "metrics.second", "metrics.third"]}
-        colors={["blue", "green", "red"]}
-      />,
-    );
-    const { container } = render(
-      <CustomLegend
-        categories={["metrics.first", "metrics.second", "metrics.third"]}
-        colors={["blue", "green", "red"]}
-      />,
-    );
-    const colorIndicators = container.querySelectorAll('span[style*="background-color"]');
-    expect(colorIndicators[0]).toHaveStyle({ backgroundColor: "#3b82f6" });
-    expect(colorIndicators[1]).toHaveStyle({ backgroundColor: "#22c55e" });
-    expect(colorIndicators[2]).toHaveStyle({ backgroundColor: "#ef4444" });
-  });
-});
diff --git a/ui/litellm-dashboard/src/components/common_components/chartUtils.tsx b/ui/litellm-dashboard/src/components/common_components/chartUtils.tsx
deleted file mode 100644
index 0abf004803b..00000000000
--- a/ui/litellm-dashboard/src/components/common_components/chartUtils.tsx
+++ /dev/null
@@ -1,104 +0,0 @@
-import type { ChartTooltipProps } from "@/components/shared/charts/chart_tooltip";
-import { SpendMetrics } from "../UsagePage/types";
-
-interface ChartDataPoint {
-  date: string;
-  metrics: SpendMetrics;
-}
-
-const colorNameToHex: { [key: string]: string } = {
-  blue: "#3b82f6",
-  cyan: "#06b6d4",
-  indigo: "#6366f1",
-  green: "#22c55e",
-  red: "#ef4444",
-  purple: "#8b5cf6",
-  emerald: "#37bc7d",
-};
-
-export const CustomTooltip = ({ active, payload, label }: ChartTooltipProps) => {
-  if (active && payload && payload.length) {
-    const formatCategoryName = (name: string): string => {
-      return name
-        .replace("metrics.", "")
-        .replace(/_/g, " ")
-        .split(" ")
-        .map((word) => word.charAt(0).toUpperCase() + word.slice(1))
-        .join(" ");
-    };
-
-    const getRawValue = (dataPoint: ChartDataPoint, key: string): number | undefined => {
-      // key is like "metrics.total_tokens"
-      const metricKey = key.substring(key.indexOf(".") + 1) as keyof SpendMetrics;
-      if (dataPoint.metrics && metricKey in dataPoint.metrics) {
-        return dataPoint.metrics[metricKey];
-      }
-      return undefined;
-    };
-
-    return (
-      <div className="w-56 rounded-tremor-default border border-tremor-border bg-tremor-background p-2 text-tremor-default shadow-tremor-dropdown">
-        <p className="text-tremor-content-strong">{label}</p>
-        {payload.map((item) => {
-          const dataKey = item.dataKey?.toString();
-          if (!dataKey || !item.payload) return null;
-
-          const rawValue = getRawValue(item.payload, dataKey);
-          const isSpend = dataKey.includes("spend");
-          const formattedValue =
-            rawValue !== undefined
-              ? isSpend
-                ? `$${rawValue.toLocaleString(undefined, { minimumFractionDigits: 2, maximumFractionDigits: 2 })}`
-                : rawValue.toLocaleString()
-              : "N/A";
-
-          const colorName = item.color as keyof typeof colorNameToHex;
-          const hexColor = colorNameToHex[colorName] || item.color;
-          return (
-            <div key={dataKey} className="flex items-center justify-between space-x-4">
-              <div className="flex items-center space-x-2">
-                <span
-                  className={`h-2 w-2 shrink-0 rounded-full ring-2 ring-white drop-shadow-md`}
-                  style={{ backgroundColor: hexColor }}
-                />
-                <p className="font-medium text-tremor-content dark:text-dark-tremor-content">
-                  {formatCategoryName(dataKey)}
-                </p>
-              </div>
-              <p className="font-medium text-tremor-content-emphasis dark:text-dark-tremor-content-emphasis">
-                {formattedValue}
-              </p>
-            </div>
-          );
-        })}
-      </div>
-    );
-  }
-  return null;
-};
-
-export const CustomLegend = ({ categories, colors }: { categories: string[]; colors: string[] }) => {
-  const formatCategoryName = (name: string): string => {
-    return name
-      .replace("metrics.", "")
-      .replace(/_/g, " ")
-      .split(" ")
-      .map((word) => word.charAt(0).toUpperCase() + word.slice(1))
-      .join(" ");
-  };
-
-  return (
-    <div className="flex items-center justify-end space-x-4">
-      {categories.map((category, idx) => {
-        const colorName = colors[idx] as keyof typeof colorNameToHex;
-        const hexColor = colorNameToHex[colorName] || colors[idx];
-        return (
-          <div key={category} className="flex items-center space-x-2">
-            <span className={`h-2 w-2 shrink-0 rounded-full ring-4 ring-white`} style={{ backgroundColor: hexColor }} />
-            <p className="text-sm text-tremor-content dark:text-dark-tremor-content">{formatCategoryName(category)}</p>
-          </div>
-        );
-      })}
-    </div>
-  );
-};
diff --git a/ui/litellm-dashboard/src/components/common_components/check_openapi_schema.tsx b/ui/litellm-dashboard/src/components/common_components/check_openapi_schema.tsx
index bbe6f4f46a0..2bcd516eb7b 100644
--- a/ui/litellm-dashboard/src/components/common_components/check_openapi_schema.tsx
+++ b/ui/litellm-dashboard/src/components/common_components/check_openapi_schema.tsx
@@ -1,10 +1,12 @@
 import React, { useState, useEffect } from "react";
-import { Form, Input as AntdInput, InputNumber, Select } from "antd";
+import { Input as AntdInput, InputNumber, Select } from "antd";
 import { Input } from "@/components/ui/input";
 import { InfoCircleOutlined } from "@ant-design/icons";
 import { Tooltip } from "antd";
+import type { UseFormSetValue } from "react-hook-form";
 import { getOpenAPISchema } from "../networking";
 import { formatLabel } from "@/utils/textUtils";
+import { MountedFormField, type MountedFormValues } from "./MountedFormField";
 
 interface SchemaProperty {
   type?: string;
@@ -25,13 +27,13 @@ interface OpenAPISchema {
 interface SchemaFormFieldsProps {
   schemaComponent: string;
   excludedFields?: string[];
-  form: any;
+  setValue: UseFormSetValue<MountedFormValues>;
   overrideLabels?: { [key: string]: string };
   overrideTooltips?: { [key: string]: string };
   customValidation?: {
-    [key: string]: (rule: any, value: any) => Promise<void>;
+    [key: string]: (rule: unknown, value: unknown) => Promise<void>;
   };
-  defaultValues?: { [key: string]: any };
+  defaultValues?: { [key: string]: unknown };
 }
 
 // Define which fields should be parsed as JSON
@@ -53,6 +55,10 @@ const validateJSON = (value: string): boolean => {
   }
 };
 
+const isBlank = (value: unknown): boolean => value === undefined || value === null || value === "";
+
+const messageOf = (error: unknown): string => (error instanceof Error ? error.message : String(error));
+
 const getFieldHelp = (key: string, property: SchemaProperty, type: string): string => {
   // Default help text based on type
   const defaultHelp =
@@ -99,7 +105,7 @@ const getFieldHelp = (key: string, property: SchemaProperty, type: string): stri
 const SchemaFormFields: React.FC<SchemaFormFieldsProps> = ({
   schemaComponent,
   excludedFields = [],
-  form,
+  setValue,
   overrideLabels = {},
   overrideTooltips = {},
   customValidation = {},
@@ -120,14 +126,11 @@ const SchemaFormFields: React.FC<SchemaFormFieldsProps> = ({
 
         setSchemaProperties(componentSchema);
 
-        const defaultFormValues: { [key: string]: any } = {};
         Object.keys(componentSchema.properties)
           .filter((key) => !excludedFields.includes(key) && defaultValues[key] !== undefined)
           .forEach((key) => {
-            defaultFormValues[key] = defaultValues[key];
+            setValue(key, defaultValues[key]);
           });
-
-        form.setFieldsValue(defaultFormValues);
       } catch (error) {
         console.error("Schema fetch error:", error);
         setError(error instanceof Error ? error.message : "Failed to fetch schema");
@@ -135,7 +138,7 @@ const SchemaFormFields: React.FC<SchemaFormFieldsProps> = ({
     };
 
     fetchOpenAPISchema();
-  }, [schemaComponent, form, excludedFields]);
+  }, [schemaComponent, setValue, excludedFields]);
 
   const getPropertyType = (property: SchemaProperty): string => {
     if (property.type) {
@@ -156,22 +159,25 @@ const SchemaFormFields: React.FC<SchemaFormFieldsProps> = ({
     const label = overrideLabels[key] || property.title || formatLabel(key);
     const tooltip = overrideTooltips[key] || property.description;
 
-    const rules = [];
-    if (isRequired) {
-      rules.push({ required: true, message: `${label} is required` });
-    }
-    if (customValidation[key]) {
-      rules.push({ validator: customValidation[key] });
-    }
-    if (isJSONField(key, property)) {
-      rules.push({
-        validator: async (_: any, value: string) => {
-          if (value && !validateJSON(value)) {
-            throw new Error("Please enter valid JSON");
+    const validate = {
+      ...(isRequired && {
+        required: (value: unknown) => (isBlank(value) ? `${label} is required` : true),
+      }),
+      ...(customValidation[key] && {
+        custom: async (value: unknown) => {
+          try {
+            await customValidation[key](null, value);
+            return true;
+          } catch (thrown) {
+            return messageOf(thrown);
           }
         },
-      });
-    }
+      }),
+      ...(isJSONField(key, property) && {
+        json: (value: unknown) =>
+          value && !validateJSON(value as string) ? "Please enter valid JSON" : (true as const),
+      }),
+    };
 
     const formLabel = tooltip ? (
       <span>
@@ -184,44 +190,63 @@ const SchemaFormFields: React.FC<SchemaFormFieldsProps> = ({
       label
     );
 
-    let inputComponent;
-    if (isJSONField(key, property)) {
-      inputComponent = <AntdInput.TextArea rows={4} placeholder="Enter as JSON" className="font-mono" />;
-    } else if (property.enum) {
-      inputComponent = (
-        <Select>
-          {property.enum.map((value) => (
-            <Select.Option key={value} value={value}>
-              {value}
-            </Select.Option>
-          ))}
-        </Select>
-      );
-    } else if (type === "number" || type === "integer") {
-      inputComponent = <InputNumber style={{ width: "100%" }} precision={type === "integer" ? 0 : undefined} />;
-    } else if (key === "duration") {
-      inputComponent = <Input placeholder="eg: 30s, 30h, 30d" />;
-    } else {
-      inputComponent = <Input placeholder={tooltip || ""} />;
-    }
-
     return (
-      <Form.Item
+      <MountedFormField
         key={key}
         label={formLabel}
         name={key}
         className="mt-8"
-        rules={rules}
-        initialValue={defaultValues[key]}
-        help={<div className="text-xs text-gray-500">{getFieldHelp(key, property, type)}</div>}
+        required={isRequired}
+        rules={Object.keys(validate).length > 0 ? { validate } : undefined}
+        defaultValue={defaultValues[key]}
+        help={<div className="text-xs text-muted-foreground">{getFieldHelp(key, property, type)}</div>}
       >
-        {inputComponent}
-      </Form.Item>
+        {(control) => {
+          if (isJSONField(key, property)) {
+            return (
+              <AntdInput.TextArea
+                {...control}
+                value={control.value as string | undefined}
+                rows={4}
+                placeholder="Enter as JSON"
+                className="font-mono"
+              />
+            );
+          }
+          if (property.enum) {
+            return (
+              <Select {...control} value={control.value as string | undefined}>
+                {property.enum.map((value) => (
+                  <Select.Option key={value} value={value}>
+                    {value}
+                  </Select.Option>
+                ))}
+              </Select>
+            );
+          }
+          if (type === "number" || type === "integer") {
+            return (
+              <InputNumber
+                {...control}
+                value={control.value as number | undefined}
+                style={{ width: "100%" }}
+                precision={type === "integer" ? 0 : undefined}
+              />
+            );
+          }
+          if (key === "duration") {
+            return (
+              <Input {...control} value={(control.value as string | undefined) ?? ""} placeholder="eg: 30s, 30h, 30d" />
+            );
+          }
+          return <Input {...control} value={(control.value as string | undefined) ?? ""} placeholder={tooltip || ""} />;
+        }}
+      </MountedFormField>
     );
   };
 
   if (error) {
-    return <div className="text-red-500">Error: {error}</div>;
+    return <div className="text-destructive">Error: {error}</div>;
   }
 
   if (!schemaProperties?.properties) {
diff --git a/ui/litellm-dashboard/src/components/common_components/user_search_modal.test.tsx b/ui/litellm-dashboard/src/components/common_components/user_search_modal.test.tsx
index d17948b599e..cbaf00b7131 100644
--- a/ui/litellm-dashboard/src/components/common_components/user_search_modal.test.tsx
+++ b/ui/litellm-dashboard/src/components/common_components/user_search_modal.test.tsx
@@ -161,6 +161,26 @@ describe("UserSearchModal submit payload", () => {
     });
   });
 
+  it("commits the first match when the typed search is confirmed with Enter", async () => {
+    const { user, onSubmit } = setup();
+
+    const input = getEmailSearchInput();
+    await user.click(input);
+    await user.type(input, "pick");
+    await waitFor(() => expect(userFilterUICall).toHaveBeenCalled(), { timeout: 3000 });
+    await screen.findByRole("option", { name: "picked@example.com" });
+
+    await user.keyboard("{Enter}");
+    await user.click(save());
+
+    await waitFor(() => expect(onSubmit).toHaveBeenCalledTimes(1));
+    expect(onSubmit.mock.calls[0][0]).toStrictEqual({
+      user_email: "picked@example.com",
+      user_id: "u-1",
+      role: "user",
+    });
+  });
+
   it("does not submit on Enter in any field, while the button still does", async () => {
     const { user, onSubmit } = setup();
 
diff --git a/ui/litellm-dashboard/src/components/common_components/user_search_modal.tsx b/ui/litellm-dashboard/src/components/common_components/user_search_modal.tsx
index 801d19244f8..aeead9d82e6 100644
--- a/ui/litellm-dashboard/src/components/common_components/user_search_modal.tsx
+++ b/ui/litellm-dashboard/src/components/common_components/user_search_modal.tsx
@@ -165,6 +165,9 @@ const UserSearchModal: React.FC<UserSearchModalProps> = ({
         <Combobox
           items={items}
           value={selected}
+          // @ts-expect-error TS2322 -- Combobox.Root narrows autoHighlight to boolean; the AriaCombobox it wraps
+          // accepts "always", the only value that highlights a list this component filters server-side
+          autoHighlight="always"
           filter={null}
           onValueChange={(option: UserOption | null) => {
             controlProps.onChange(option?.value);
diff --git a/ui/litellm-dashboard/src/components/key_team_helpers/BudgetFallbacksEditor.tsx b/ui/litellm-dashboard/src/components/key_team_helpers/BudgetFallbacksEditor.tsx
index e58d289df8a..062aaaa1773 100644
--- a/ui/litellm-dashboard/src/components/key_team_helpers/BudgetFallbacksEditor.tsx
+++ b/ui/litellm-dashboard/src/components/key_team_helpers/BudgetFallbacksEditor.tsx
@@ -1,4 +1,5 @@
-import { Button, Select, Tooltip } from "antd";
+import { SimpleTooltip } from "@/components/ui/tooltip";
+import { Button, Select } from "antd";
 import { ArrowDown, Plus, X } from "lucide-react";
 import React, { useState } from "react";
 
@@ -128,12 +129,9 @@ export function BudgetFallbacksEditor({ value, onChange, availableModels }: Budg
                 getPopupContainer={(trigger) => trigger.parentElement || document.body}
                 maxTagCount="responsive"
                 maxTagPlaceholder={(omittedValues) => (
-                  <Tooltip
-                    styles={{ root: { pointerEvents: "none" } }}
-                    title={omittedValues.map(({ value: v }) => v).join(", ")}
-                  >
+                  <SimpleTooltip content={omittedValues.map(({ value: v }) => v).join(", ")}>
                     <span>+{omittedValues.length} more</span>
-                  </Tooltip>
+                  </SimpleTooltip>
                 )}
               />
               {entry.fallbackModels.length > 1 && (
diff --git a/ui/litellm-dashboard/src/components/model_add/CredentialModal.tsx b/ui/litellm-dashboard/src/components/model_add/CredentialModal.tsx
index fca75853973..ae68e631ba2 100644
--- a/ui/litellm-dashboard/src/components/model_add/CredentialModal.tsx
+++ b/ui/litellm-dashboard/src/components/model_add/CredentialModal.tsx
@@ -1,8 +1,18 @@
 import { Input } from "@/components/ui/input";
-import { Select as AntdSelect, Button, Form, Modal, Tooltip, Typography } from "antd";
+import { Select as AntdSelect, Button, Modal, Tooltip, Typography } from "antd";
 import type { UploadProps } from "antd/es/upload";
 import { useState } from "react";
+import { FormProvider, useForm } from "react-hook-form";
 import ProviderSpecificFields from "../add_model/provider_specific_fields";
+import { antdRequired } from "../common_components/antdFormRules";
+import { labelWithHint } from "@/components/shared/form/LabelWithHint";
+import {
+  MountedFormField,
+  MountedFormProvider,
+  projectMountedValues,
+  useMountRegistry,
+  type MountedFormValues,
+} from "../common_components/MountedFormField";
 import { CredentialItem } from "../networking";
 import { Providers } from "../provider_info_helpers";
 import { Logo } from "@/components/molecules/logo/Logo";
@@ -28,7 +38,6 @@ export default function CredentialModal({
   existingCredential = null,
 }: CredentialModalProps) {
   const isEdit = mode === "edit";
-  const [form] = Form.useForm();
   const [selectedProvider, setSelectedProvider] = useState<Providers>(
     (existingCredential?.credential_info.custom_llm_provider as Providers) ?? Providers.OpenAI,
   );
@@ -43,7 +52,21 @@ export default function CredentialModal({
       }
     : undefined;
 
-  const handleSubmit = (values: any) => {
+  const form = useForm<MountedFormValues>({ mode: "onChange", defaultValues: initialValues });
+  const registry = useMountRegistry();
+
+  const formAdapter = {
+    getFieldValue: (field: string) => form.getValues(field),
+    resetFields: () => form.reset(),
+    setFieldValue: (field: string, value: unknown) => form.setValue(field, value),
+  };
+
+  const handleSubmit = async () => {
+    const isValid = await form.trigger(registry.mountedNames() as string[]);
+    if (!isValid) {
+      return;
+    }
+    const values = projectMountedValues(registry, form.getValues);
     const filteredValues = Object.entries(values).reduce((acc, [key, value]) => {
       if (value !== "" && value !== undefined && value !== null) {
         acc[key] = value;
@@ -51,12 +74,12 @@ export default function CredentialModal({
       return acc;
     }, {} as any);
     onSubmit(filteredValues);
-    form.resetFields();
+    form.reset();
   };
 
   const closeAndReset = () => {
     onCancel();
-    form.resetFields();
+    form.reset();
   };
 
   return (
@@ -68,53 +91,80 @@ export default function CredentialModal({
       width={600}
       destroyOnHidden={isEdit}
     >
-      <Form form={form} onFinish={handleSubmit} layout="vertical" initialValues={initialValues}>
-        <Form.Item
-          label="Credential Name:"
-          name="credential_name"
-          rules={[{ required: true, message: "Credential name is required" }]}
-        >
-          <Input placeholder="Enter a friendly name for these credentials" disabled={isEdit} />
-        </Form.Item>
-
-        <Form.Item
-          rules={[{ required: true, message: "Required" }]}
-          label="Provider:"
-          name="custom_llm_provider"
-          tooltip="Helper to auto-populate provider specific fields"
-        >
-          <AntdSelect
-            showSearch
-            onChange={(value) => {
-              resetCredentialFormOnProviderChange(form, value as Providers, setSelectedProvider);
+      <FormProvider {...form}>
+        <MountedFormProvider value={{ control: form.control, registry }}>
+          <form
+            onSubmit={(event) => {
+              event.preventDefault();
+              void handleSubmit();
             }}
           >
-            {Object.entries(Providers).map(([providerEnum, providerDisplayName]) => (
-              <AntdSelect.Option key={providerEnum} value={providerEnum}>
-                <div className="flex items-center space-x-2">
-                  <Logo provider={providerEnum} label={providerDisplayName} className="w-5 h-5" />
-                  <span>{providerDisplayName}</span>
-                </div>
-              </AntdSelect.Option>
-            ))}
-          </AntdSelect>
-        </Form.Item>
+            <MountedFormField
+              label="Credential Name:"
+              name="credential_name"
+              required
+              rules={{ validate: { required: antdRequired("Credential name is required") } }}
+              className="mb-4"
+            >
+              {(control) => (
+                <Input
+                  id={control.id}
+                  value={(control.value as string | undefined) ?? ""}
+                  onChange={control.onChange}
+                  onBlur={control.onBlur}
+                  placeholder="Enter a friendly name for these credentials"
+                  disabled={isEdit}
+                />
+              )}
+            </MountedFormField>
 
-        <ProviderSpecificFields selectedProvider={selectedProvider} uploadProps={uploadProps} />
+            <MountedFormField
+              label={labelWithHint("Provider:", "Helper to auto-populate provider specific fields")}
+              name="custom_llm_provider"
+              required
+              rules={{ validate: { required: antdRequired("Required") } }}
+              className="mb-4"
+            >
+              {(control) => (
+                <AntdSelect
+                  id={control.id}
+                  showSearch
+                  value={control.value as string | undefined}
+                  onBlur={control.onBlur}
+                  onChange={(value) => {
+                    control.onChange(value);
+                    resetCredentialFormOnProviderChange(formAdapter, value as Providers, setSelectedProvider);
+                  }}
+                >
+                  {Object.entries(Providers).map(([providerEnum, providerDisplayName]) => (
+                    <AntdSelect.Option key={providerEnum} value={providerEnum}>
+                      <div className="flex items-center space-x-2">
+                        <Logo provider={providerEnum} label={providerDisplayName} className="w-5 h-5" />
+                        <span>{providerDisplayName}</span>
+                      </div>
+                    </AntdSelect.Option>
+                  ))}
+                </AntdSelect>
+              )}
+            </MountedFormField>
 
-        <div className="flex justify-between items-center">
-          <Tooltip title="Get help on our github">
-            <Link href="https://github.com/BerriAI/litellm/issues">Need Help?</Link>
-          </Tooltip>
+            <ProviderSpecificFields selectedProvider={selectedProvider} uploadProps={uploadProps} />
 
-          <div>
-            <Button onClick={closeAndReset} style={{ marginRight: 10 }}>
-              Cancel
-            </Button>
-            <Button htmlType="submit">{isEdit ? "Update Credential" : "Add Credential"}</Button>
-          </div>
-        </div>
-      </Form>
+            <div className="flex justify-between items-center">
+              <Tooltip title="Get help on our github">
+                <Link href="https://github.com/BerriAI/litellm/issues">Need Help?</Link>
+              </Tooltip>
+
+              <div>
+                <Button onClick={closeAndReset} style={{ marginRight: 10 }}>
+                  Cancel
+                </Button>
+                <Button htmlType="submit">{isEdit ? "Update Credential" : "Add Credential"}</Button>
+              </div>
+            </div>
+          </form>
+        </MountedFormProvider>
+      </FormProvider>
     </Modal>
   );
 }
diff --git a/ui/litellm-dashboard/src/components/model_info_view.test.tsx b/ui/litellm-dashboard/src/components/model_info_view.test.tsx
index 7dfa3ffb9e5..4ff9b96a5b9 100644
--- a/ui/litellm-dashboard/src/components/model_info_view.test.tsx
+++ b/ui/litellm-dashboard/src/components/model_info_view.test.tsx
@@ -26,6 +26,7 @@ vi.mock("./networking", () => ({
   modelPatchUpdateCall: vi.fn(),
   modelDeleteCall: vi.fn(),
   credentialCreateCall: vi.fn(),
+  vectorStoreListCall: vi.fn(),
 }));
 
 const mockUseModelsInfo = vi.fn();
@@ -57,6 +58,7 @@ const mockTestModelGroupConnection = vi.mocked(networking.testModelGroupConnecti
 const mockModelPatchUpdateCall = vi.mocked(networking.modelPatchUpdateCall);
 const mockModelDeleteCall = vi.mocked(networking.modelDeleteCall);
 const mockCredentialCreateCall = vi.mocked(networking.credentialCreateCall);
+const mockVectorStoreListCall = vi.mocked(networking.vectorStoreListCall);
 
 describe("ModelInfoView", () => {
   let queryClient: QueryClient;
@@ -166,6 +168,12 @@ describe("ModelInfoView", () => {
       status: "success",
     });
 
+    mockVectorStoreListCall.mockResolvedValue({
+      data: [
+        { vector_store_id: "vs-alpha", vector_store_name: "Alpha" },
+        { vector_store_id: "vs-beta", vector_store_name: "Beta" },
+      ],
+    } as never);
     mockModelPatchUpdateCall.mockResolvedValue({});
     mockModelDeleteCall.mockResolvedValue({});
     mockCredentialCreateCall.mockResolvedValue({});
@@ -768,6 +776,99 @@ describe("ModelInfoView", () => {
       });
     });
 
+    const enterPtuEdit = async (user: ReturnType<typeof userEvent.setup>) => {
+      mockUsePtuCostAttributionEnabled.mockReturnValue(true);
+      renderWithPtuModel();
+      expect(await screen.findByRole("button", { name: /edit settings/i })).toBeInTheDocument();
+      await user.click(screen.getByRole("button", { name: /edit settings/i }));
+      expect(await screen.findByPlaceholderText("e.g. 15")).toBeInTheDocument();
+    };
+
+    const expectBlocked = async (user: ReturnType<typeof userEvent.setup>, message: RegExp) => {
+      await user.click(screen.getByRole("button", { name: /save changes/i }));
+      expect(await screen.findAllByText(message)).not.toHaveLength(0);
+      expect(mockModelPatchUpdateCall).not.toHaveBeenCalled();
+    };
+
+    it("skips PTU validation entirely when the feature is disabled, so a half-set stored record still saves", async () => {
+      mockUsePtuCostAttributionEnabled.mockReturnValue(false);
+      const halfSetPtuModel = {
+        ...ptuModelData,
+        model_info: { ...ptuModelData.model_info, cost_per_ptu_per_hour: null, ptu_effective_from: null },
+      };
+      mockUseModelsInfo.mockReturnValue({ data: { data: [halfSetPtuModel] }, isLoading: false, error: null });
+      mockModelInfoV1Call.mockResolvedValue({ data: [halfSetPtuModel] });
+      const user = userEvent.setup();
+      render(<ModelInfoView {...DEFAULT_ADMIN_PROPS} />, { wrapper });
+
+      expect(await screen.findByRole("button", { name: /edit settings/i })).toBeInTheDocument();
+      await user.click(screen.getByRole("button", { name: /edit settings/i }));
+      expect(await screen.findByRole("button", { name: /save changes/i })).toBeInTheDocument();
+      await user.click(screen.getByRole("button", { name: /save changes/i }));
+
+      await waitFor(() => expect(mockModelPatchUpdateCall).toHaveBeenCalled());
+      expect(screen.queryByText(/must be set together/i)).not.toBeInTheDocument();
+    });
+
+    it("blocks a PTU count above the backend ceiling", async () => {
+      const user = userEvent.setup();
+      await enterPtuEdit(user);
+
+      await user.clear(screen.getByPlaceholderText("e.g. 15"));
+      await user.type(screen.getByPlaceholderText("e.g. 15"), "1000001");
+
+      await expectBlocked(user, /PTU Count must be a whole number between 1 and 1,000,000/i);
+    });
+
+    it("blocks a cost per PTU hour above the backend ceiling", async () => {
+      const user = userEvent.setup();
+      await enterPtuEdit(user);
+
+      await user.clear(screen.getByPlaceholderText("e.g. 2.00"));
+      await user.type(screen.getByPlaceholderText("e.g. 2.00"), "2000000");
+
+      await expectBlocked(user, /Cost per PTU \/ Hour must be between 0 and 1,000,000/i);
+    });
+
+    it("blocks a half-set PTU count and rate pair", async () => {
+      const user = userEvent.setup();
+      await enterPtuEdit(user);
+
+      await user.clear(screen.getByPlaceholderText("e.g. 2.00"));
+
+      await expectBlocked(user, /PTU Count and Cost per PTU \/ Hour must be set together/i);
+    });
+
+    it("blocks PTU config with no effective start", async () => {
+      mockUsePtuCostAttributionEnabled.mockReturnValue(true);
+      const undatedPtuModel = {
+        ...ptuModelData,
+        model_info: { ...ptuModelData.model_info, ptu_effective_from: null, ptu_effective_to: null },
+      };
+      mockUseModelsInfo.mockReturnValue({ data: { data: [undatedPtuModel] }, isLoading: false, error: null });
+      mockModelInfoV1Call.mockResolvedValue({ data: [undatedPtuModel] });
+      const user = userEvent.setup();
+      render(<ModelInfoView {...DEFAULT_ADMIN_PROPS} />, { wrapper });
+
+      expect(await screen.findByRole("button", { name: /edit settings/i })).toBeInTheDocument();
+      await user.click(screen.getByRole("button", { name: /edit settings/i }));
+      expect(await screen.findByPlaceholderText("e.g. 15")).toBeInTheDocument();
+
+      await expectBlocked(user, /PTU Effective From is required when PTU Count is set/i);
+    });
+
+    it("blocks a PTU window whose end is not after its start", async () => {
+      const user = userEvent.setup();
+      await enterPtuEdit(user);
+
+      const to = screen.getAllByPlaceholderText("Select date")[1];
+      await user.clear(to);
+      await user.type(to, "2026-06-01 00:00:00");
+      await user.tab();
+
+      await expectBlocked(user, /PTU Effective To must be after PTU Effective From/i);
+    });
+
     it("sends the PTU fields on save when enabled", async () => {
       mockUsePtuCostAttributionEnabled.mockReturnValue(true);
       const user = userEvent.setup();
@@ -791,6 +892,64 @@ describe("ModelInfoView", () => {
       expect(modelInfo.ptu_count).toBe(15);
       expect(modelInfo.cost_per_ptu_per_hour).toBe(2);
     });
+
+    it("routes each edited PTU field into its own model_info key", async () => {
+      mockUsePtuCostAttributionEnabled.mockReturnValue(true);
+      const user = userEvent.setup();
+      renderWithPtuModel();
+
+      expect(await screen.findByRole("button", { name: /edit settings/i })).toBeInTheDocument();
+      await user.click(screen.getByRole("button", { name: /edit settings/i }));
+      expect(await screen.findByRole("button", { name: /save changes/i })).toBeInTheDocument();
+
+      await user.clear(screen.getByPlaceholderText("e.g. 15"));
+      await user.type(screen.getByPlaceholderText("e.g. 15"), "20");
+      await user.clear(screen.getByPlaceholderText("e.g. 2.00"));
+      await user.type(screen.getByPlaceholderText("e.g. 2.00"), "3.5");
+
+      const dates = () => screen.getAllByPlaceholderText("Select date");
+      expect(dates()[0]).toHaveValue("2026-07-01 00:00:00");
+      expect(dates()[1]).toHaveValue("2026-08-01 00:00:00");
+
+      const setDate = async (index: number, value: string) => {
+        await user.clear(dates()[index]);
+        await user.type(dates()[index], value);
+        await user.tab();
+      };
+      await setDate(1, "2026-10-03 02:00:00");
+      await setDate(0, "2026-09-02 01:00:00");
+
+      await user.click(screen.getByRole("button", { name: /save changes/i }));
+      await waitFor(() => expect(mockModelPatchUpdateCall).toHaveBeenCalled());
+
+      const modelInfo = mockModelPatchUpdateCall.mock.calls[0][1].model_info;
+      expect(modelInfo.ptu_count).toBe(20);
+      expect(modelInfo.cost_per_ptu_per_hour).toBe(3.5);
+      expect(modelInfo.ptu_effective_from).toBe("2026-09-02T01:00:00.000Z");
+      expect(modelInfo.ptu_effective_to).toBe("2026-10-03T02:00:00.000Z");
+    });
+  });
+
+  it("blocks the save when the LiteLLM Params box does not hold valid JSON", async () => {
+    const user = userEvent.setup();
+    render(<ModelInfoView {...DEFAULT_ADMIN_PROPS} />, { wrapper });
+
+    expect(await screen.findByRole("button", { name: /edit settings/i })).toBeInTheDocument();
+    await user.click(screen.getByRole("button", { name: /edit settings/i }));
+
+    const extraParams = screen
+      .getAllByRole("textbox")
+      .find(
+        (input) =>
+          input.tagName === "TEXTAREA" && (input as HTMLTextAreaElement).value.includes('"custom_llm_provider"'),
+      ) as HTMLTextAreaElement;
+    await user.clear(extraParams);
+    await user.paste("{not json");
+
+    await user.click(screen.getByRole("button", { name: /save changes/i }));
+
+    expect(await screen.findByText("Please enter valid JSON")).toBeInTheDocument();
+    expect(mockModelPatchUpdateCall).not.toHaveBeenCalled();
   });
 
   it("should not include input_cost_per_token or output_cost_per_token in update payload when user does not touch cost fields", async () => {
@@ -1257,4 +1416,312 @@ describe("ModelInfoView", () => {
       expect(await screen.findByTestId("test-connection-button")).toBeInTheDocument();
     });
   });
+
+  describe("payload parity pins", () => {
+    const enterEditMode = async (user: ReturnType<typeof userEvent.setup>) => {
+      render(<ModelInfoView {...DEFAULT_ADMIN_PROPS} />, { wrapper });
+      expect(await screen.findByRole("button", { name: /edit settings/i })).toBeInTheDocument();
+      await user.click(screen.getByRole("button", { name: /edit settings/i }));
+      expect(await screen.findByRole("button", { name: /save changes/i })).toBeInTheDocument();
+    };
+
+    const save = async (user: ReturnType<typeof userEvent.setup>) => {
+      await user.click(screen.getByRole("button", { name: /save changes/i }));
+      await waitFor(() => expect(mockModelPatchUpdateCall).toHaveBeenCalled());
+      return mockModelPatchUpdateCall.mock.calls[0][1] as {
+        model_name: string;
+        litellm_params: Record<string, unknown>;
+        model_info: Record<string, unknown>;
+      };
+    };
+
+    it("sends the whole edit payload for an untouched save", async () => {
+      const user = userEvent.setup();
+      await enterEditMode(user);
+      const payload = await save(user);
+
+      expect(payload).toEqual({
+        model_name: "GPT-4",
+        litellm_params: {
+          model: "gpt-4",
+          api_base: "https://api.openai.com/v1",
+          custom_llm_provider: "openai",
+          litellm_credential_name: "selected-credential",
+          tags: [],
+          guardrails: [],
+        },
+        model_info: {
+          id: "123",
+          created_by: "123",
+          created_at: "2024-01-01T00:00:00Z",
+          db_model: true,
+          input_cost_per_token: 0.00003,
+          output_cost_per_token: 0.00006,
+          access_groups: [],
+        },
+      });
+    });
+
+    it("omits health_check_model for a model that is not a wildcard, whose field never renders", async () => {
+      const user = userEvent.setup();
+      await enterEditMode(user);
+      const payload = await save(user);
+
+      expect(payload.model_info).not.toHaveProperty("health_check_model");
+    });
+
+    it("routes each edited field into its own payload key", async () => {
+      const user = userEvent.setup();
+      await enterEditMode(user);
+
+      await user.clear(screen.getByPlaceholderText("Enter model name"));
+      await user.type(screen.getByPlaceholderText("Enter model name"), "renamed-model");
+      await user.clear(screen.getByPlaceholderText("Enter LiteLLM model name"));
+      await user.type(screen.getByPlaceholderText("Enter LiteLLM model name"), "gpt-4o");
+      await user.clear(screen.getByPlaceholderText("Enter API base"));
+      await user.type(screen.getByPlaceholderText("Enter API base"), "https://example.test/v1");
+      await user.clear(screen.getByPlaceholderText("Enter custom LLM provider"));
+      await user.type(screen.getByPlaceholderText("Enter custom LLM provider"), "azure");
+      await user.type(screen.getByPlaceholderText("Enter organization"), "org-9");
+      await user.type(screen.getByPlaceholderText("Enter TPM"), "111");
+      await user.type(screen.getByPlaceholderText("Enter RPM"), "222");
+      await user.type(screen.getByPlaceholderText("Enter max retries"), "4");
+      await user.type(screen.getByPlaceholderText("Enter timeout"), "33");
+      await user.type(screen.getByPlaceholderText("Enter stream timeout"), "44");
+
+      const payload = await save(user);
+
+      expect(payload.model_name).toBe("renamed-model");
+      expect(payload.litellm_params).toMatchObject({
+        model: "gpt-4o",
+        api_base: "https://example.test/v1",
+        custom_llm_provider: "azure",
+        organization: "org-9",
+        tpm: "111",
+        rpm: "222",
+        max_retries: "4",
+        timeout: "33",
+        stream_timeout: "44",
+      });
+    });
+
+    it("routes each edited pricing field into its own payload key", async () => {
+      const user = userEvent.setup();
+      await enterEditMode(user);
+
+      await user.clear(screen.getByPlaceholderText("Enter output cost"));
+      await user.type(screen.getByPlaceholderText("Enter output cost"), "12");
+      const [cacheRead, cacheWrite] = screen.getAllByPlaceholderText("Defaults to Input Cost if blank");
+      await user.type(cacheRead, "5");
+      await user.type(cacheWrite, "9");
+
+      const payload = await save(user);
+
+      expect(payload.litellm_params).toMatchObject({
+        output_cost_per_token: 0.000012,
+        cache_read_input_token_cost: 0.000005,
+        cache_creation_input_token_cost: 0.000009,
+      });
+    });
+
+    const addTag = async (user: ReturnType<typeof userEvent.setup>, placeholder: string, tag: string) => {
+      const input = screen.getByPlaceholderText(placeholder);
+      await user.type(input, tag);
+      await user.keyboard("{Enter}");
+    };
+
+    it("routes each typed collection field into its own payload key", async () => {
+      const user = userEvent.setup();
+      await enterEditMode(user);
+
+      await addTag(user, "Select existing groups or type to create new ones", "beta-testers");
+      await addTag(user, "Select existing guardrails or type to create new ones", "content_filter");
+      await addTag(user, "Select existing tags or type to create new ones", "production_tag");
+
+      const payload = await save(user);
+
+      expect(payload.model_info.access_groups).toEqual(["beta-testers"]);
+      expect(payload.litellm_params.guardrails).toEqual(["content_filter"]);
+      expect(payload.litellm_params.tags).toEqual(["production_tag"]);
+    });
+
+    it("sends the edited model info JSON", async () => {
+      const user = userEvent.setup();
+      await enterEditMode(user);
+
+      const modelInfo = screen.getByPlaceholderText('{"gpt-4": 100, "claude-v1": 200}');
+      await user.clear(modelInfo);
+      await user.paste('{"id":"123","team_id":"team-7"}');
+
+      const payload = await save(user);
+
+      expect(payload.model_info).toMatchObject({ team_id: "team-7" });
+    });
+
+    it("sends the edited LiteLLM extra params", async () => {
+      const user = userEvent.setup();
+      await enterEditMode(user);
+
+      const extraParams = screen
+        .getAllByRole("textbox")
+        .find(
+          (input) =>
+            input.tagName === "TEXTAREA" && (input as HTMLTextAreaElement).value.includes('"custom_llm_provider"'),
+        ) as HTMLTextAreaElement;
+      await user.clear(extraParams);
+      await user.paste('{"drop_params":true}');
+
+      const payload = await save(user);
+
+      expect(payload.litellm_params.drop_params).toBe(true);
+    });
+
+    it("sends the credential picked in the selector", async () => {
+      mockCredentialListCall.mockResolvedValue({
+        credentials: [
+          { credential_name: "selected-credential", credential_values: {}, credential_info: {} },
+          { credential_name: "other-credential", credential_values: {}, credential_info: {} },
+        ],
+      } as never);
+      const user = userEvent.setup();
+      await enterEditMode(user);
+
+      await user.click(await screen.findByText("selected-credential"));
+      await user.click(await screen.findByText("other-credential"));
+
+      const payload = await save(user);
+
+      expect(payload.litellm_params.litellm_credential_name).toBe("other-credential");
+    });
+
+    it("sends the vector stores picked in the knowledge base selector", async () => {
+      const user = userEvent.setup();
+      await enterEditMode(user);
+
+      await user.click(screen.getByPlaceholderText("Select knowledge bases (optional)"));
+      await user.click(await screen.findByText("Beta (vs-beta)"));
+      await user.keyboard("{Escape}");
+
+      const payload = await save(user);
+
+      expect(payload.litellm_params.vector_store_ids).toEqual(["vs-beta"]);
+    });
+
+    it("sends the health check model picked for a wildcard deployment", async () => {
+      const wildcard = {
+        ...defaultModelData,
+        litellm_params: { ...defaultModelData.litellm_params, model: "openai/gpt-4*" },
+      };
+      mockUseModelsInfo.mockReturnValue({ data: { data: [wildcard] }, isLoading: false, error: null });
+      mockModelInfoV1Call.mockResolvedValue({ data: [wildcard] });
+      mockUseModelHub.mockReturnValue({
+        data: { data: [{ model_group: "openai/gpt-4o", providers: ["openai"] }] },
+        isLoading: false,
+        error: null,
+      });
+      const user = userEvent.setup();
+      await enterEditMode(user);
+
+      await user.click(screen.getByText("Select existing health check model"));
+      await user.click(await screen.findByText("openai/gpt-4o"));
+
+      const payload = await save(user);
+
+      expect(payload.model_info.health_check_model).toBe("openai/gpt-4o");
+    });
+
+    it("keeps a pricing field in the payload after the operator types a value and restores the original", async () => {
+      // antd marks a field touched on change and never clears it, so retyping the seeded value
+      // still ships the key. RHF's dirtyFields resets on a value returning to its default, which
+      // would silently drop input_cost_per_token here.
+      const user = userEvent.setup();
+      await enterEditMode(user);
+
+      const inputCost = screen.getByPlaceholderText("Enter input cost") as HTMLInputElement;
+      const seeded = inputCost.value;
+      expect(seeded).toBe("30");
+
+      await user.clear(inputCost);
+      await user.type(inputCost, "7");
+      await user.clear(inputCost);
+      await user.type(inputCost, seeded);
+
+      const payload = await save(user);
+
+      expect(payload.litellm_params.input_cost_per_token).toBe(0.00003);
+      expect(payload.litellm_params.cache_read_input_token_cost).toBe(0.00003);
+    });
+
+    it("clears a pricing override with an explicit null once the field is emptied", async () => {
+      const user = userEvent.setup();
+      await enterEditMode(user);
+
+      await user.clear(screen.getByPlaceholderText("Enter input cost"));
+      const payload = await save(user);
+
+      expect(payload.litellm_params.input_cost_per_token).toBeNull();
+      expect(payload.litellm_params).not.toHaveProperty("cache_read_input_token_cost");
+    });
+
+    describe("cache control injection points", () => {
+      const withCachePoints = (points: unknown) => {
+        const data = {
+          ...defaultModelData,
+          litellm_params: { ...defaultModelData.litellm_params, cache_control_injection_points: points },
+        };
+        mockUseModelsInfo.mockReturnValue({ data: { data: [data] }, isLoading: false, error: null });
+        mockModelInfoV1Call.mockResolvedValue({ data: [data] });
+      };
+
+      it("omits the key when the deployment has none and the operator leaves the toggle alone", async () => {
+        const user = userEvent.setup();
+        await enterEditMode(user);
+        const payload = await save(user);
+
+        expect(payload.litellm_params).not.toHaveProperty("cache_control_injection_points");
+      });
+
+      it("hides the injection point rows until the toggle is on", async () => {
+        const user = userEvent.setup();
+        await enterEditMode(user);
+
+        expect(screen.queryByRole("button", { name: /add injection point/i })).not.toBeInTheDocument();
+
+        await user.click(screen.getByRole("switch"));
+
+        expect(await screen.findByRole("button", { name: /add injection point/i })).toBeInTheDocument();
+      });
+
+      it("round-trips the stored injection points on an untouched save", async () => {
+        withCachePoints([{ location: "message", role: "user" }]);
+        const user = userEvent.setup();
+        await enterEditMode(user);
+        const payload = await save(user);
+
+        expect(payload.litellm_params.cache_control_injection_points).toEqual([{ location: "message", role: "user" }]);
+      });
+
+      it("drops the stored injection points when the operator turns the toggle off", async () => {
+        withCachePoints([{ location: "message", role: "user" }]);
+        const user = userEvent.setup();
+        await enterEditMode(user);
+
+        await user.click(screen.getByRole("switch"));
+        const payload = await save(user);
+
+        expect(payload.litellm_params).not.toHaveProperty("cache_control_injection_points");
+      });
+
+      it("adds a typed index as a string, matching what the deployment already stores", async () => {
+        withCachePoints([{ location: "message" }]);
+        const user = userEvent.setup();
+        await enterEditMode(user);
+
+        await user.type(screen.getByPlaceholderText("Optional"), "2");
+        const payload = await save(user);
+
+        expect(payload.litellm_params.cache_control_injection_points).toEqual([{ location: "message", index: "2" }]);
+      });
+    });
+  });
 });
diff --git a/ui/litellm-dashboard/src/components/model_info_view.tsx b/ui/litellm-dashboard/src/components/model_info_view.tsx
index 633c811d6c8..5fb3c18f9b6 100644
--- a/ui/litellm-dashboard/src/components/model_info_view.tsx
+++ b/ui/litellm-dashboard/src/components/model_info_view.tsx
@@ -6,31 +6,16 @@ import { InfoCircleOutlined } from "@ant-design/icons";
 import { KeyIcon, RefreshIcon, TrashIcon } from "@heroicons/react/outline";
 import { Button } from "@/components/ui/button";
 import { Card } from "@/components/ui/card";
-import { Input } from "@/components/ui/input";
 import { Tabs, TabsContent, TabsList, TabsTrigger } from "@/components/ui/tabs";
-import { UiLoadingSpinner } from "@/components/ui/ui-loading-spinner";
-import { Button as AntdButton, DatePicker, Form, Input as AntdInput, Modal, Select, Tooltip } from "antd";
-import { formatPtuUtcDisplay, utcIsoToPickerValue } from "../utils/ptuDatetime";
+import { SimpleTooltip } from "@/components/ui/tooltip";
+import { Button as AntdButton, Modal } from "antd";
 import { applyPtuModelInfo } from "../utils/ptuModelInfo";
 import { usePtuCostAttributionEnabled } from "@/app/(dashboard)/hooks/uiSettings/usePtuCostAttributionEnabled";
-import {
-  PTU_COUNT_FIELD,
-  PTU_RATE_FIELD,
-  ptuCountRules,
-  ptuNoUsageCostRule,
-  ptuPairRule,
-  ptuRateRules,
-  ptuStartRequiredRule,
-  ptuWindowOrderRule,
-  PTU_END_FIELD,
-  PTU_START_FIELD,
-} from "../utils/ptuValidation";
-import VectorStoreSelector from "./vector_store_management/VectorStoreSelector";
 import { ArrowLeft, CheckIcon, CopyIcon } from "lucide-react";
 import { useEffect, useMemo, useState } from "react";
 import { copyToClipboard as utilCopyToClipboard } from "../utils/dataUtils";
-import { isMaskedSecret, stripMaskedSecrets } from "../utils/maskedSecretUtils";
-import { formItemValidateJSON, truncateString } from "../utils/textUtils";
+import { stripMaskedSecrets } from "../utils/maskedSecretUtils";
+import { truncateString } from "../utils/textUtils";
 import AutoRouterConnectionTest from "./add_model/auto_router_connection_test";
 import { AutoRouterTestTarget, buildAutoRouterTestTargets } from "./add_model/build_auto_router_test_targets";
 import { normalizeTierModels, resolveComplexityDefaultModel } from "./add_model/complexity_router_tiers";
@@ -41,7 +26,6 @@ import {
 } from "./add_model/auto_router_strategies";
 import { canModifyModel } from "@/utils/modelPermissions";
 import { useTeams } from "@/app/(dashboard)/hooks/teams/useTeams";
-import CacheControlSettings from "./add_model/cache_control_settings";
 import DeleteResourceModal from "./common_components/DeleteResourceModal";
 import EditAutoRouterModal from "./edit_auto_router/edit_auto_router_modal";
 import ReuseCredentialsModal from "./model_add/reuse_credentials";
@@ -60,7 +44,7 @@ import {
 } from "./networking";
 import { Logo } from "@/components/molecules/logo/Logo";
 import UpdateModelCredentialsModal from "./update_model_credentials_modal";
-import NumericalInput from "./shared/numerical_input";
+import ModelInfoEditForm, { type ModelEditFormValues, type TouchedPricingField } from "./ModelInfoEditForm";
 import { Tag } from "./tag_management/types";
 import { getDisplayModelName } from "./view_model/model_name_display";
 
@@ -74,68 +58,6 @@ interface ModelInfoViewProps {
   modelAccessGroups: string[] | null;
 }
 
-interface PtuEditField {
-  name: string;
-  label: string;
-  input: "number" | "datetime";
-  placeholder?: string;
-  isCount?: boolean;
-  isRate?: boolean;
-  isStart?: boolean;
-  pairedWith?: string;
-  windowPeer?: string;
-  bound?: "start" | "end";
-}
-
-const PTU_EDIT_FIELDS: PtuEditField[] = [
-  {
-    name: PTU_COUNT_FIELD,
-    label: "PTU Count",
-    input: "number",
-    placeholder: "e.g. 15",
-    isCount: true,
-    pairedWith: PTU_RATE_FIELD,
-  },
-  {
-    name: PTU_RATE_FIELD,
-    label: "Cost per PTU / Hour (USD)",
-    input: "number",
-    placeholder: "e.g. 2.00",
-    isRate: true,
-    pairedWith: PTU_COUNT_FIELD,
-  },
-  {
-    name: PTU_START_FIELD,
-    label: "PTU Effective From (UTC)",
-    input: "datetime",
-    isStart: true,
-    windowPeer: PTU_END_FIELD,
-    bound: "start",
-  },
-  {
-    name: PTU_END_FIELD,
-    label: "PTU Effective To (UTC)",
-    input: "datetime",
-    windowPeer: PTU_START_FIELD,
-    bound: "end",
-  },
-];
-
-/** Per-1M-token rate for the first rate that is set, so a deliberate 0 seeds the form as 0. */
-const perMillionTokens = (...rates: (number | null | undefined)[]): number | null => {
-  const rate = rates.find((candidate) => candidate != null);
-  return rate == null ? null : rate * 1_000_000;
-};
-
-const ptuFieldDependencies = ({ isStart, pairedWith, windowPeer }: PtuEditField): string[] | undefined => {
-  const deps = [
-    ...(isStart ? [PTU_COUNT_FIELD] : []),
-    ...(pairedWith ? [pairedWith] : []),
-    ...(windowPeer ? [windowPeer] : []),
-  ];
-  return deps.length ? deps : undefined;
-};
-
 interface ComplexityRouterTierConfig {
   tiers?: {
     SIMPLE?: unknown;
@@ -201,14 +123,12 @@ export default function ModelInfoView({
   onModelUpdate,
   modelAccessGroups,
 }: ModelInfoViewProps) {
-  const [form] = Form.useForm();
   const queryClient = useQueryClient();
   const [localModelData, setLocalModelData] = useState<any>(null);
   const [isDeleteModalOpen, setIsDeleteModalOpen] = useState(false);
   const [deleteLoading, setDeleteLoading] = useState(false);
   const [isCredentialModalOpen, setIsCredentialModalOpen] = useState(false);
   const [isUpdateCredentialsModalOpen, setIsUpdateCredentialsModalOpen] = useState(false);
-  const [isDirty, setIsDirty] = useState(false);
   const [isSaving, setIsSaving] = useState(false);
   const [isEditing, setIsEditing] = useState(false);
   const [existingCredential, setExistingCredential] = useState<CredentialItem | null>(null);
@@ -228,8 +148,6 @@ export default function ModelInfoView({
   const { data: modelHubData } = useModelHub();
   const { data: teams } = useTeams();
   const ptuCostAttributionEnabled = usePtuCostAttributionEnabled();
-  const ptuCostRule = (field: string) =>
-    ptuCostAttributionEnabled ? [ptuNoUsageCostRule(PTU_COUNT_FIELD, field)] : [];
 
   // Transform the model data
   const getProviderFromModel = (model: string) => {
@@ -380,7 +298,10 @@ export default function ModelInfoView({
     toast.success("Credential stored successfully");
   };
 
-  const handleModelUpdate = async (values: any) => {
+  const handleModelUpdate = async (
+    values: ModelEditFormValues,
+    isFieldTouched: (field: TouchedPricingField) => boolean,
+  ) => {
     try {
       if (!accessToken) return;
       setIsSaving(true);
@@ -396,8 +317,7 @@ export default function ModelInfoView({
         return;
       }
 
-      let updatedLitellmParams = {
-        ...values.litellm_params,
+      let updatedLitellmParams: Record<string, any> = {
         ...parsedExtraParams,
         model: values.litellm_model_name,
         api_base: values.api_base,
@@ -411,7 +331,7 @@ export default function ModelInfoView({
         tags: values.tags,
       };
 
-      if (form.isFieldTouched("input_cost")) {
+      if (isFieldTouched("input_cost")) {
         if (values.input_cost !== undefined && values.input_cost !== null && values.input_cost !== "") {
           updatedLitellmParams.input_cost_per_token = Number(values.input_cost) / 1_000_000;
         } else {
@@ -419,7 +339,7 @@ export default function ModelInfoView({
           updatedLitellmParams.input_cost_per_token = null;
         }
       }
-      if (form.isFieldTouched("output_cost")) {
+      if (isFieldTouched("output_cost")) {
         if (values.output_cost !== undefined && values.output_cost !== null && values.output_cost !== "") {
           updatedLitellmParams.output_cost_per_token = Number(values.output_cost) / 1_000_000;
         } else {
@@ -431,10 +351,10 @@ export default function ModelInfoView({
       //   - explicit value provided → use it
       //   - field touched but empty → explicit null (signals backend to remove override)
       //   - only input_cost touched → fall back to input_cost (guarded against null)
-      if (form.isFieldTouched("cache_read_cost") || form.isFieldTouched("input_cost")) {
+      if (isFieldTouched("cache_read_cost") || isFieldTouched("input_cost")) {
         if (values.cache_read_cost !== undefined && values.cache_read_cost !== null && values.cache_read_cost !== "") {
           updatedLitellmParams.cache_read_input_token_cost = Number(values.cache_read_cost) / 1_000_000;
-        } else if (form.isFieldTouched("cache_read_cost")) {
+        } else if (isFieldTouched("cache_read_cost")) {
           updatedLitellmParams.cache_read_input_token_cost = null;
         } else if (
           updatedLitellmParams.input_cost_per_token !== undefined &&
@@ -447,7 +367,7 @@ export default function ModelInfoView({
       // Cache Write Cost: explicit value if provided, else explicit null so the
       // backend removes the override and falls back to the model-level default.
       // Sending 0 here would persist a zero rate even when the user intended to unset it.
-      if (form.isFieldTouched("cache_write_cost")) {
+      if (isFieldTouched("cache_write_cost")) {
         if (
           values.cache_write_cost !== undefined &&
           values.cache_write_cost !== null &&
@@ -467,7 +387,7 @@ export default function ModelInfoView({
       if (values.guardrails) {
         updatedLitellmParams.guardrails = values.guardrails;
       }
-      if (values.vector_store_ids?.length > 0) {
+      if ((values.vector_store_ids?.length ?? 0) > 0) {
         updatedLitellmParams.vector_store_ids = values.vector_store_ids;
       } else if (values.vector_store_ids !== undefined) {
         // User explicitly cleared previously-set vector stores — send [] to clear on backend
@@ -477,7 +397,7 @@ export default function ModelInfoView({
       }
 
       // Handle cache control settings
-      if (values.cache_control && values.cache_control_injection_points?.length > 0) {
+      if (values.cache_control && (values.cache_control_injection_points?.length ?? 0) > 0) {
         updatedLitellmParams.cache_control_injection_points = values.cache_control_injection_points;
       } else {
         delete updatedLitellmParams.cache_control_injection_points;
@@ -536,7 +456,6 @@ export default function ModelInfoView({
       }
 
       toast.success("Model settings updated successfully");
-      setIsDirty(false);
       setIsEditing(false);
     } catch (error) {
       console.error("Error updating model:", error);
@@ -661,6 +580,14 @@ export default function ModelInfoView({
     }
   };
   const isWildcardModel = modelData.litellm_model_name.includes("*");
+  const wildcardProvider = modelData.litellm_model_name.split("/")[0];
+  const healthCheckModelOptions =
+    modelHubData?.data
+      ?.filter(
+        (model: any) =>
+          model.providers?.includes(wildcardProvider) && model.model_group !== modelData.litellm_model_name,
+      )
+      .map((model: any) => ({ value: model.model_group, label: model.model_group })) || [];
 
   return (
     <div className="p-4">
@@ -672,7 +599,7 @@ export default function ModelInfoView({
           </Button>
           <h2 className="text-xl font-semibold">Public Model Name: {getDisplayModelName(modelData)}</h2>
           <div className="flex items-center cursor-pointer">
-            <span className="text-sm text-gray-500 font-mono">{modelData.model_info.id}</span>
+            <span className="text-sm text-muted-foreground font-mono">{modelData.model_info.id}</span>
             <AntdButton
               type="text"
               size="small"
@@ -682,7 +609,7 @@ export default function ModelInfoView({
               className={`left-2 z-10 transition-all duration-200 ${
                 copiedStates["model-id"]
                   ? "text-green-600 bg-green-50 border-green-200"
-                  : "text-gray-500 hover:text-gray-700 hover:bg-gray-100"
+                  : "text-muted-foreground hover:text-foreground hover:bg-muted"
               }`}
             />
           </div>
@@ -759,11 +686,11 @@ export default function ModelInfoView({
               <Card className="block p-6">
                 <p className="text-sm">LiteLLM Model</p>
                 <div className="mt-2 overflow-hidden">
-                  <Tooltip title={modelData.litellm_model_name || "Not Set"}>
+                  <SimpleTooltip content={modelData.litellm_model_name || "Not Set"} className="w-full min-w-0">
                     <div className="break-all text-sm font-medium leading-relaxed cursor-pointer">
                       {modelData.litellm_model_name || "Not Set"}
                     </div>
-                  </Tooltip>
+                  </SimpleTooltip>
                 </div>
               </Card>
               <Card className="block p-6">
@@ -776,7 +703,7 @@ export default function ModelInfoView({
             </div>
 
             {/* Audit info shown as a subtle banner below the overview */}
-            <div className="mb-6 text-sm text-gray-500 flex items-center gap-x-6">
+            <div className="mb-6 text-sm text-muted-foreground flex items-center gap-x-6">
               <div className="flex items-center gap-x-2">
                 <svg className="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
                   <path
@@ -825,731 +752,31 @@ export default function ModelInfoView({
                       </Button>
                     )
                   ) : (
-                    <Tooltip title="Only DB models can be edited. You must be an admin or the creator of the model to edit it.">
+                    <SimpleTooltip content="Only DB models can be edited. You must be an admin or the creator of the model to edit it.">
                       <InfoCircleOutlined />
-                    </Tooltip>
+                    </SimpleTooltip>
                   )}
                 </div>
               </div>
               {localModelData ? (
-                <Form
-                  form={form}
-                  onFinish={handleModelUpdate}
-                  initialValues={{
-                    model_name: localModelData.model_name,
-                    litellm_model_name: localModelData.litellm_model_name,
-                    api_base: localModelData.litellm_params.api_base,
-                    custom_llm_provider: localModelData.litellm_params.custom_llm_provider,
-                    organization: localModelData.litellm_params.organization,
-                    tpm: localModelData.litellm_params.tpm,
-                    rpm: localModelData.litellm_params.rpm,
-                    max_retries: localModelData.litellm_params.max_retries,
-                    timeout: localModelData.litellm_params.timeout,
-                    stream_timeout: localModelData.litellm_params.stream_timeout,
-                    input_cost: perMillionTokens(
-                      localModelData.litellm_params.input_cost_per_token,
-                      localModelData.model_info?.input_cost_per_token,
-                    ),
-                    output_cost: perMillionTokens(
-                      localModelData.litellm_params?.output_cost_per_token,
-                      localModelData.model_info?.output_cost_per_token,
-                    ),
-                    ptu_count: localModelData.model_info?.ptu_count ?? null,
-                    cost_per_ptu_per_hour: localModelData.model_info?.cost_per_ptu_per_hour ?? null,
-                    ptu_effective_from: utcIsoToPickerValue(localModelData.model_info?.ptu_effective_from),
-                    ptu_effective_to: utcIsoToPickerValue(localModelData.model_info?.ptu_effective_to),
-                    cache_read_cost:
-                      localModelData.litellm_params?.cache_read_input_token_cost !== undefined &&
-                      localModelData.litellm_params?.cache_read_input_token_cost !== null
-                        ? localModelData.litellm_params.cache_read_input_token_cost * 1_000_000
-                        : localModelData.model_info?.cache_read_input_token_cost !== undefined &&
-                            localModelData.model_info?.cache_read_input_token_cost !== null
-                          ? localModelData.model_info.cache_read_input_token_cost * 1_000_000
-                          : null,
-                    cache_write_cost:
-                      localModelData.litellm_params?.cache_creation_input_token_cost !== undefined &&
-                      localModelData.litellm_params?.cache_creation_input_token_cost !== null
-                        ? localModelData.litellm_params.cache_creation_input_token_cost * 1_000_000
-                        : localModelData.model_info?.cache_creation_input_token_cost !== undefined &&
-                            localModelData.model_info?.cache_creation_input_token_cost !== null
-                          ? localModelData.model_info.cache_creation_input_token_cost * 1_000_000
-                          : null,
-                    cache_control: localModelData.litellm_params?.cache_control_injection_points ? true : false,
-                    cache_control_injection_points: localModelData.litellm_params?.cache_control_injection_points || [],
-                    model_access_group: Array.isArray(localModelData.model_info?.access_groups)
-                      ? localModelData.model_info.access_groups
-                      : [],
-                    guardrails: Array.isArray(localModelData.litellm_params?.guardrails)
-                      ? localModelData.litellm_params.guardrails
-                      : [],
-                    vector_store_ids:
-                      Array.isArray(localModelData.litellm_params?.vector_store_ids) &&
-                      localModelData.litellm_params.vector_store_ids.length > 0
-                        ? localModelData.litellm_params.vector_store_ids
-                        : undefined,
-                    tags: Array.isArray(localModelData.litellm_params?.tags) ? localModelData.litellm_params.tags : [],
-                    health_check_model: isWildcardModel ? localModelData.model_info?.health_check_model : null,
-                    litellm_credential_name: localModelData.litellm_params?.litellm_credential_name || "",
-                    litellm_extra_params: JSON.stringify(
-                      Object.fromEntries(
-                        Object.entries(localModelData.litellm_params || {}).filter(
-                          ([key, value]) => key !== "litellm_credential_name" && !isMaskedSecret(value),
-                        ),
-                      ),
-                      null,
-                      2,
-                    ),
-                  }}
-                  layout="vertical"
-                  onValuesChange={() => setIsDirty(true)}
-                >
-                  <div className="space-y-4">
-                    <div className="space-y-4">
-                      <div>
-                        <p className="text-sm font-medium">Model Name</p>
-                        {isEditing ? (
-                          <Form.Item name="model_name" className="mb-0">
-                            <Input placeholder="Enter model name" />
-                          </Form.Item>
-                        ) : (
-                          <div className="mt-1 p-2 bg-gray-50 rounded-sm">{localModelData.model_name}</div>
-                        )}
-                      </div>
-
-                      <div>
-                        <p className="text-sm font-medium">LiteLLM Model Name</p>
-                        {isEditing ? (
-                          <Form.Item name="litellm_model_name" className="mb-0">
-                            <Input placeholder="Enter LiteLLM model name" />
-                          </Form.Item>
-                        ) : (
-                          <div className="mt-1 p-2 bg-gray-50 rounded-sm">{localModelData.litellm_model_name}</div>
-                        )}
-                      </div>
-
-                      <div>
-                        <p className="text-sm font-medium">Input Cost (per 1M tokens)</p>
-                        {isEditing ? (
-                          <Form.Item
-                            name="input_cost"
-                            className="mb-0"
-                            dependencies={[PTU_COUNT_FIELD]}
-                            rules={ptuCostRule("input_cost")}
-                          >
-                            <NumericalInput placeholder="Enter input cost" />
-                          </Form.Item>
-                        ) : (
-                          <div className="mt-1 p-2 bg-gray-50 rounded-sm">
-                            {localModelData?.litellm_params?.input_cost_per_token != null
-                              ? (localModelData.litellm_params.input_cost_per_token * 1_000_000).toFixed(4)
-                              : localModelData?.model_info?.input_cost_per_token != null
-                                ? (localModelData.model_info.input_cost_per_token * 1_000_000).toFixed(4)
-                                : "Not Set"}
-                          </div>
-                        )}
-                      </div>
-
-                      <div>
-                        <p className="text-sm font-medium">Output Cost (per 1M tokens)</p>
-                        {isEditing ? (
-                          <Form.Item
-                            name="output_cost"
-                            className="mb-0"
-                            dependencies={[PTU_COUNT_FIELD]}
-                            rules={ptuCostRule("output_cost")}
-                          >
-                            <NumericalInput placeholder="Enter output cost" />
-                          </Form.Item>
-                        ) : (
-                          <div className="mt-1 p-2 bg-gray-50 rounded-sm">
-                            {localModelData?.litellm_params?.output_cost_per_token != null
-                              ? (localModelData.litellm_params.output_cost_per_token * 1_000_000).toFixed(4)
-                              : localModelData?.model_info?.output_cost_per_token != null
-                                ? (localModelData.model_info.output_cost_per_token * 1_000_000).toFixed(4)
-                                : "Not Set"}
-                          </div>
-                        )}
-                      </div>
-
-                      {ptuCostAttributionEnabled &&
-                        PTU_EDIT_FIELDS.map((ptuField) => {
-                          const { name, label, input, placeholder, isCount, isRate, isStart, pairedWith } = ptuField;
-                          const { windowPeer, bound } = ptuField;
-                          return (
-                            <div key={name}>
-                              <p className="text-sm font-medium">{label}</p>
-                              {isEditing ? (
-                                <Form.Item
-                                  name={name}
-                                  className="mb-0"
-                                  dependencies={ptuFieldDependencies(ptuField)}
-                                  rules={[
-                                    ...(isCount ? ptuCountRules : []),
-                                    ...(isRate ? ptuRateRules : []),
-                                    ...(isStart ? [ptuStartRequiredRule(PTU_COUNT_FIELD)] : []),
-                                    ...(pairedWith ? [ptuPairRule(pairedWith)] : []),
-                                    ...(windowPeer && bound ? [ptuWindowOrderRule(windowPeer, bound)] : []),
-                                  ]}
-                                >
-                                  {input === "number" ? (
-                                    <NumericalInput
-                                      placeholder={placeholder}
-                                      step={isCount ? 1 : undefined}
-                                      min={isCount ? 1 : 0}
-                                    />
-                                  ) : (
-                                    <DatePicker showTime style={{ width: "100%" }} />
-                                  )}
-                                </Form.Item>
-                              ) : (
-                                <div className="mt-1 p-2 bg-gray-50 rounded-sm">
-                                  {(input === "datetime"
-                                    ? formatPtuUtcDisplay(localModelData?.model_info?.[name])
-                                    : localModelData?.model_info?.[name]) ?? "Not Set"}
-                                </div>
-                              )}
-                            </div>
-                          );
-                        })}
-
-                      <div>
-                        <p className="text-sm font-medium">Cache Read Cost (per 1M tokens)</p>
-                        {isEditing ? (
-                          <Form.Item
-                            name="cache_read_cost"
-                            className="mb-0"
-                            dependencies={[PTU_COUNT_FIELD]}
-                            rules={ptuCostRule("cache_read_cost")}
-                            tooltip="If left blank on save, defaults to Input Cost."
-                          >
-                            <NumericalInput placeholder="Defaults to Input Cost if blank" />
-                          </Form.Item>
-                        ) : (
-                          <div className="mt-1 p-2 bg-gray-50 rounded-sm">
-                            {localModelData?.litellm_params?.cache_read_input_token_cost !== undefined &&
-                            localModelData?.litellm_params?.cache_read_input_token_cost !== null
-                              ? (localModelData.litellm_params.cache_read_input_token_cost * 1_000_000).toFixed(4)
-                              : localModelData?.model_info?.cache_read_input_token_cost !== undefined &&
-                                  localModelData?.model_info?.cache_read_input_token_cost !== null
-                                ? (localModelData.model_info.cache_read_input_token_cost * 1_000_000).toFixed(4)
-                                : "Not Set"}
-                          </div>
-                        )}
-                      </div>
-
-                      <div>
-                        <p className="text-sm font-medium">Cache Write Cost (per 1M tokens)</p>
-                        {isEditing ? (
-                          <Form.Item
-                            name="cache_write_cost"
-                            className="mb-0"
-                            dependencies={[PTU_COUNT_FIELD]}
-                            rules={ptuCostRule("cache_write_cost")}
-                            tooltip="If left blank on save, defaults to Input Cost (backend falls back to input_cost_per_token)."
-                          >
-                            <NumericalInput placeholder="Defaults to Input Cost if blank" />
-                          </Form.Item>
-                        ) : (
-                          <div className="mt-1 p-2 bg-gray-50 rounded-sm">
-                            {localModelData?.litellm_params?.cache_creation_input_token_cost !== undefined &&
-                            localModelData?.litellm_params?.cache_creation_input_token_cost !== null
-                              ? (localModelData.litellm_params.cache_creation_input_token_cost * 1_000_000).toFixed(4)
-                              : localModelData?.model_info?.cache_creation_input_token_cost !== undefined &&
-                                  localModelData?.model_info?.cache_creation_input_token_cost !== null
-                                ? (localModelData.model_info.cache_creation_input_token_cost * 1_000_000).toFixed(4)
-                                : "Not Set"}
-                          </div>
-                        )}
-                      </div>
-
-                      <div>
-                        <p className="text-sm font-medium">API Base</p>
-                        {isEditing ? (
-                          <Form.Item name="api_base" className="mb-0">
-                            <Input placeholder="Enter API base" />
-                          </Form.Item>
-                        ) : (
-                          <div className="mt-1 p-2 bg-gray-50 rounded-sm">
-                            {localModelData.litellm_params?.api_base || "Not Set"}
-                          </div>
-                        )}
-                      </div>
-
-                      <div>
-                        <p className="text-sm font-medium">Custom LLM Provider</p>
-                        {isEditing ? (
-                          <Form.Item name="custom_llm_provider" className="mb-0">
-                            <Input placeholder="Enter custom LLM provider" />
-                          </Form.Item>
-                        ) : (
-                          <div className="mt-1 p-2 bg-gray-50 rounded-sm">
-                            {localModelData.litellm_params?.custom_llm_provider || "Not Set"}
-                          </div>
-                        )}
-                      </div>
-
-                      <div>
-                        <p className="text-sm font-medium">Organization</p>
-                        {isEditing ? (
-                          <Form.Item name="organization" className="mb-0">
-                            <Input placeholder="Enter organization" />
-                          </Form.Item>
-                        ) : (
-                          <div className="mt-1 p-2 bg-gray-50 rounded-sm">
-                            {localModelData.litellm_params?.organization || "Not Set"}
-                          </div>
-                        )}
-                      </div>
-
-                      <div>
-                        <p className="text-sm font-medium">TPM (Tokens per Minute)</p>
-                        {isEditing ? (
-                          <Form.Item name="tpm" className="mb-0">
-                            <NumericalInput placeholder="Enter TPM" />
-                          </Form.Item>
-                        ) : (
-                          <div className="mt-1 p-2 bg-gray-50 rounded-sm">
-                            {localModelData.litellm_params?.tpm || "Not Set"}
-                          </div>
-                        )}
-                      </div>
-
-                      <div>
-                        <p className="text-sm font-medium">RPM (Requests per Minute)</p>
-                        {isEditing ? (
-                          <Form.Item name="rpm" className="mb-0">
-                            <NumericalInput placeholder="Enter RPM" />
-                          </Form.Item>
-                        ) : (
-                          <div className="mt-1 p-2 bg-gray-50 rounded-sm">
-                            {localModelData.litellm_params?.rpm || "Not Set"}
-                          </div>
-                        )}
-                      </div>
-
-                      <div>
-                        <p className="text-sm font-medium">Max Retries</p>
-                        {isEditing ? (
-                          <Form.Item name="max_retries" className="mb-0">
-                            <NumericalInput placeholder="Enter max retries" />
-                          </Form.Item>
-                        ) : (
-                          <div className="mt-1 p-2 bg-gray-50 rounded-sm">
-                            {localModelData.litellm_params?.max_retries || "Not Set"}
-                          </div>
-                        )}
-                      </div>
-
-                      <div>
-                        <p className="text-sm font-medium">Timeout (seconds)</p>
-                        {isEditing ? (
-                          <Form.Item name="timeout" className="mb-0">
-                            <NumericalInput placeholder="Enter timeout" />
-                          </Form.Item>
-                        ) : (
-                          <div className="mt-1 p-2 bg-gray-50 rounded-sm">
-                            {localModelData.litellm_params?.timeout || "Not Set"}
-                          </div>
-                        )}
-                      </div>
-
-                      <div>
-                        <p className="text-sm font-medium">Stream Timeout (seconds)</p>
-                        {isEditing ? (
-                          <Form.Item name="stream_timeout" className="mb-0">
-                            <NumericalInput placeholder="Enter stream timeout" />
-                          </Form.Item>
-                        ) : (
-                          <div className="mt-1 p-2 bg-gray-50 rounded-sm">
-                            {localModelData.litellm_params?.stream_timeout || "Not Set"}
-                          </div>
-                        )}
-                      </div>
-
-                      <div>
-                        <p className="text-sm font-medium">Model Access Groups</p>
-                        {isEditing ? (
-                          <Form.Item name="model_access_group" className="mb-0">
-                            <Select
-                              mode="tags"
-                              showSearch
-                              placeholder="Select existing groups or type to create new ones"
-                              optionFilterProp="children"
-                              tokenSeparators={[","]}
-                              maxTagCount="responsive"
-                              allowClear
-                              style={{ width: "100%" }}
-                              options={modelAccessGroups?.map((group) => ({
-                                value: group,
-                                label: group,
-                              }))}
-                            />
-                          </Form.Item>
-                        ) : (
-                          <div className="mt-1 p-2 bg-gray-50 rounded-sm">
-                            {localModelData.model_info?.access_groups ? (
-                              Array.isArray(localModelData.model_info.access_groups) ? (
-                                localModelData.model_info.access_groups.length > 0 ? (
-                                  <div className="flex flex-wrap gap-1">
-                                    {localModelData.model_info.access_groups.map((group: string, index: number) => (
-                                      <span
-                                        key={index}
-                                        className="inline-flex items-center px-2 py-1 rounded-full text-xs font-medium bg-blue-100 text-blue-800"
-                                      >
-                                        {group}
-                                      </span>
-                                    ))}
-                                  </div>
-                                ) : (
-                                  "No groups assigned"
-                                )
-                              ) : (
-                                localModelData.model_info.access_groups
-                              )
-                            ) : (
-                              "Not Set"
-                            )}
-                          </div>
-                        )}
-                      </div>
-
-                      <div>
-                        <p className="text-sm font-medium">
-                          Guardrails
-                          <Tooltip title="Apply safety guardrails to this model to filter content or enforce policies">
-                            <a
-                              href="https://docs.litellm.ai/docs/proxy/guardrails/quick_start"
-                              target="_blank"
-                              rel="noopener noreferrer"
-                              onClick={(e) => e.stopPropagation()}
-                            >
-                              <InfoCircleOutlined style={{ marginLeft: "4px" }} />
-                            </a>
-                          </Tooltip>
-                        </p>
-                        {isEditing ? (
-                          <Form.Item name="guardrails" className="mb-0">
-                            <Select
-                              mode="tags"
-                              showSearch
-                              placeholder="Select existing guardrails or type to create new ones"
-                              optionFilterProp="children"
-                              tokenSeparators={[","]}
-                              maxTagCount="responsive"
-                              allowClear
-                              style={{ width: "100%" }}
-                              options={guardrailsList.map((name) => ({
-                                value: name,
-                                label: name,
-                              }))}
-                            />
-                          </Form.Item>
-                        ) : (
-                          <div className="mt-1 p-2 bg-gray-50 rounded-sm">
-                            {localModelData.litellm_params?.guardrails ? (
-                              Array.isArray(localModelData.litellm_params.guardrails) ? (
-                                localModelData.litellm_params.guardrails.length > 0 ? (
-                                  <div className="flex flex-wrap gap-1">
-                                    {localModelData.litellm_params.guardrails.map(
-                                      (guardrail: string, index: number) => (
-                                        <span
-                                          key={index}
-                                          className="inline-flex items-center px-2 py-1 rounded-full text-xs font-medium bg-green-100 text-green-800"
-                                        >
-                                          {guardrail}
-                                        </span>
-                                      ),
-                                    )}
-                                  </div>
-                                ) : (
-                                  "No guardrails assigned"
-                                )
-                              ) : (
-                                localModelData.litellm_params.guardrails
-                              )
-                            ) : (
-                              "Not Set"
-                            )}
-                          </div>
-                        )}
-                      </div>
-
-                      <div>
-                        <p className="text-sm font-medium">
-                          Attached Knowledge Bases (RAG)
-                          <Tooltip title="Vector stores used for RAG. Every request to this model will automatically retrieve context from these knowledge bases.">
-                            <a
-                              href="https://docs.litellm.ai/docs/completion/knowledgebase"
-                              target="_blank"
-                              rel="noopener noreferrer"
-                              onClick={(e) => e.stopPropagation()}
-                            >
-                              <InfoCircleOutlined style={{ marginLeft: "4px" }} />
-                            </a>
-                          </Tooltip>
-                        </p>
-                        {isEditing ? (
-                          <Form.Item name="vector_store_ids" className="mb-0">
-                            <VectorStoreSelector
-                              onChange={() => {}}
-                              accessToken={accessToken || ""}
-                              placeholder="Select knowledge bases (optional)"
-                            />
-                          </Form.Item>
-                        ) : (
-                          <div className="mt-1 p-2 bg-gray-50 rounded-sm">
-                            {localModelData.litellm_params?.vector_store_ids ? (
-                              Array.isArray(localModelData.litellm_params.vector_store_ids) ? (
-                                localModelData.litellm_params.vector_store_ids.length > 0 ? (
-                                  <div className="flex flex-wrap gap-1">
-                                    {localModelData.litellm_params.vector_store_ids.map(
-                                      (vsId: string, index: number) => (
-                                        <span
-                                          key={index}
-                                          className="inline-flex items-center px-2 py-1 rounded-full text-xs font-medium bg-blue-100 text-blue-800"
-                                        >
-                                          {vsId}
-                                        </span>
-                                      ),
-                                    )}
-                                  </div>
-                                ) : (
-                                  "No knowledge bases attached"
-                                )
-                              ) : (
-                                String(localModelData.litellm_params.vector_store_ids)
-                              )
-                            ) : (
-                              "Not Set"
-                            )}
-                          </div>
-                        )}
-                      </div>
-
-                      <div>
-                        <p className="text-sm font-medium">Tags</p>
-                        {isEditing ? (
-                          <Form.Item name="tags" className="mb-0">
-                            <Select
-                              mode="tags"
-                              showSearch
-                              placeholder="Select existing tags or type to create new ones"
-                              optionFilterProp="children"
-                              tokenSeparators={[","]}
-                              maxTagCount="responsive"
-                              allowClear
-                              style={{ width: "100%" }}
-                              options={Object.values(tagsList).map((tag: Tag) => ({
-                                value: tag.name,
-                                label: tag.name,
-                                title: tag.description || tag.name,
-                              }))}
-                            />
-                          </Form.Item>
-                        ) : (
-                          <div className="mt-1 p-2 bg-gray-50 rounded-sm">
-                            {localModelData.litellm_params?.tags ? (
-                              Array.isArray(localModelData.litellm_params.tags) ? (
-                                localModelData.litellm_params.tags.length > 0 ? (
-                                  <div className="flex flex-wrap gap-1">
-                                    {localModelData.litellm_params.tags.map((tag: string, index: number) => (
-                                      <span
-                                        key={index}
-                                        className="inline-flex items-center px-2 py-1 rounded-full text-xs font-medium bg-purple-100 text-purple-800"
-                                      >
-                                        {tag}
-                                      </span>
-                                    ))}
-                                  </div>
-                                ) : (
-                                  "No tags assigned"
-                                )
-                              ) : (
-                                localModelData.litellm_params.tags
-                              )
-                            ) : (
-                              "Not Set"
-                            )}
-                          </div>
-                        )}
-                      </div>
-                      <div>
-                        <p className="text-sm font-medium">Existing Credentials</p>
-                        {isEditing ? (
-                          <Form.Item name="litellm_credential_name" className="mb-0">
-                            <Select
-                              showSearch
-                              placeholder="Select or search for existing credentials"
-                              optionFilterProp="children"
-                              filterOption={(input, option) =>
-                                (option?.label ?? "").toLowerCase().includes(input.toLowerCase())
-                              }
-                              options={[
-                                { value: "", label: "None" },
-                                ...credentialsList.map((credential) => ({
-                                  value: credential.credential_name,
-                                  label: credential.credential_name,
-                                })),
-                              ]}
-                              allowClear
-                            />
-                          </Form.Item>
-                        ) : (
-                          <div className="mt-1 p-2 bg-gray-50 rounded-sm">
-                            {localModelData.litellm_params?.litellm_credential_name || "Manual"}
-                          </div>
-                        )}
-                      </div>
-
-                      {isWildcardModel && (
-                        <div>
-                          <p className="text-sm font-medium">Health Check Model</p>
-                          {isEditing ? (
-                            <Form.Item name="health_check_model" className="mb-0">
-                              <Select
-                                showSearch
-                                placeholder="Select existing health check model"
-                                optionFilterProp="children"
-                                allowClear
-                                options={(() => {
-                                  const wildcardProvider = modelData.litellm_model_name.split("/")[0];
-                                  return (
-                                    modelHubData?.data
-                                      ?.filter((model: any) => {
-                                        // Filter by provider to match the wildcard provider
-                                        return (
-                                          model.providers?.includes(wildcardProvider) &&
-                                          model.model_group !== modelData.litellm_model_name
-                                        );
-                                      })
-                                      .map((model: any) => ({
-                                        value: model.model_group,
-                                        label: model.model_group,
-                                      })) || []
-                                  );
-                                })()}
-                              />
-                            </Form.Item>
-                          ) : (
-                            <div className="mt-1 p-2 bg-gray-50 rounded-sm">
-                              {localModelData.model_info?.health_check_model || "Not Set"}
-                            </div>
-                          )}
-                        </div>
-                      )}
-
-                      {/* Cache Control Section */}
-                      {isEditing ? (
-                        <CacheControlSettings
-                          form={form}
-                          showCacheControl={showCacheControl}
-                          onCacheControlChange={(checked) => setShowCacheControl(checked)}
-                        />
-                      ) : (
-                        <div>
-                          <p className="text-sm font-medium">Cache Control</p>
-                          <div className="mt-1 p-2 bg-gray-50 rounded-sm">
-                            {localModelData.litellm_params?.cache_control_injection_points ? (
-                              <div>
-                                <p>Enabled</p>
-                                <div className="mt-2">
-                                  {localModelData.litellm_params.cache_control_injection_points.map(
-                                    (point: any, i: number) => (
-                                      <div key={i} className="text-sm text-gray-600 mb-1">
-                                        Location: {point.location},{point.role && <span> Role: {point.role}</span>}
-                                        {point.index !== undefined && <span> Index: {point.index}</span>}
-                                      </div>
-                                    ),
-                                  )}
-                                </div>
-                              </div>
-                            ) : (
-                              "Disabled"
-                            )}
-                          </div>
-                        </div>
-                      )}
-
-                      <div>
-                        <p className="text-sm font-medium">Model Info</p>
-                        {isEditing ? (
-                          <Form.Item name="model_info" className="mb-0">
-                            <AntdInput.TextArea
-                              rows={4}
-                              placeholder='{"gpt-4": 100, "claude-v1": 200}'
-                              defaultValue={JSON.stringify(modelData.model_info, null, 2)}
-                            />
-                          </Form.Item>
-                        ) : (
-                          <div className="mt-1 p-2 bg-gray-50 rounded-sm">
-                            <pre className="bg-gray-100 p-2 rounded-sm text-xs overflow-auto mt-1">
-                              {JSON.stringify(localModelData.model_info, null, 2)}
-                            </pre>
-                          </div>
-                        )}
-                      </div>
-                      <div>
-                        <p className="text-sm font-medium">
-                          LiteLLM Params
-                          <Tooltip title="Optional litellm params used for making a litellm.completion() call. Some params are automatically added by LiteLLM.">
-                            <a
-                              href="https://docs.litellm.ai/docs/completion/input"
-                              target="_blank"
-                              rel="noopener noreferrer"
-                              onClick={(e) => e.stopPropagation()}
-                            >
-                              <InfoCircleOutlined style={{ marginLeft: "4px" }} />
-                            </a>
-                          </Tooltip>
-                        </p>
-                        {isEditing ? (
-                          <Form.Item name="litellm_extra_params" rules={[{ validator: formItemValidateJSON }]}>
-                            <AntdInput.TextArea
-                              rows={4}
-                              placeholder='{
-                  "rpm": 100,
-                  "timeout": 0,
-                  "stream_timeout": 0
-                }'
-                            />
-                          </Form.Item>
-                        ) : (
-                          <div className="mt-1 p-2 bg-gray-50 rounded-sm">
-                            <pre className="bg-gray-100 p-2 rounded-sm text-xs overflow-auto mt-1">
-                              {JSON.stringify(localModelData.litellm_params, null, 2)}
-                            </pre>
-                          </div>
-                        )}
-                      </div>
-                      <div>
-                        <p className="text-sm font-medium">Team ID</p>
-                        <div className="mt-1 p-2 bg-gray-50 rounded-sm">
-                          {modelData.model_info.team_id || "Not Set"}
-                        </div>
-                      </div>
-                    </div>
-
-                    {isEditing && (
-                      <div className="mt-6 flex justify-end gap-2">
-                        <Button
-                          variant="secondary"
-                          onClick={() => {
-                            form.resetFields();
-                            setIsDirty(false);
-                            setIsEditing(false);
-                          }}
-                          disabled={isSaving}
-                        >
-                          Cancel
-                        </Button>
-                        <Button onClick={() => form.submit()} disabled={isSaving} aria-busy={isSaving}>
-                          {isSaving && <UiLoadingSpinner className="size-4" />}
-                          Save Changes
-                        </Button>
-                      </div>
-                    )}
-                  </div>
-                </Form>
+                <ModelInfoEditForm
+                  localModelData={localModelData}
+                  modelData={modelData}
+                  accessToken={accessToken}
+                  isEditing={isEditing}
+                  isSaving={isSaving}
+                  isWildcardModel={isWildcardModel}
+                  ptuCostAttributionEnabled={ptuCostAttributionEnabled}
+                  showCacheControl={showCacheControl}
+                  setShowCacheControl={setShowCacheControl}
+                  onCancel={() => setIsEditing(false)}
+                  onSubmit={handleModelUpdate}
+                  modelAccessGroups={modelAccessGroups}
+                  guardrailsList={guardrailsList}
+                  tagsList={tagsList}
+                  credentialsList={credentialsList}
+                  healthCheckModelOptions={healthCheckModelOptions}
+                />
               ) : (
                 <p className="text-sm">Loading...</p>
               )}
@@ -1558,9 +785,7 @@ export default function ModelInfoView({
 
           <TabsContent value="raw" keepMounted>
             <Card className="block p-6">
-              <pre className="bg-gray-100 p-4 rounded-sm text-xs overflow-auto">
-                {JSON.stringify(modelData, null, 2)}
-              </pre>
+              <pre className="bg-muted p-4 rounded-sm text-xs overflow-auto">{JSON.stringify(modelData, null, 2)}</pre>
             </Card>
           </TabsContent>
         </div>
diff --git a/ui/litellm-dashboard/src/components/organisms/createKeyPayload.test.ts b/ui/litellm-dashboard/src/components/organisms/createKeyPayload.test.ts
new file mode 100644
index 00000000000..67729d63fc3
--- /dev/null
+++ b/ui/litellm-dashboard/src/components/organisms/createKeyPayload.test.ts
@@ -0,0 +1,556 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { buildKeyCreatePayload, type KeyCreateInput, type KeyPayloadResult } from "./createKeyPayload";
+
+const baseInput: KeyCreateInput = {
+  formValues: {},
+  existingKeys: null,
+  keyOwner: "you",
+  userID: "test-user",
+  selectedAgentId: null,
+  loggingSettings: [],
+  disabledCallbacks: [],
+  autoRotationEnabled: false,
+  rotationInterval: "30d",
+  modelAliases: {},
+  routerSettings: null,
+  budgetLimits: [],
+  tagRateLimits: [],
+  budgetFallbacks: {},
+};
+
+const build = (formValues: Record<string, unknown>, overrides: Partial<KeyCreateInput> = {}): KeyPayloadResult =>
+  buildKeyCreatePayload({ ...baseInput, ...overrides, formValues });
+
+const payloadOf = (result: KeyPayloadResult): Record<string, unknown> => {
+  expect(result.kind).toBe("ok");
+  if (result.kind !== "ok") throw new Error("unreachable");
+  return result.payload;
+};
+
+const wireKeys = (payload: Record<string, unknown>): string[] =>
+  Object.keys(JSON.parse(JSON.stringify(payload)) as Record<string, unknown>);
+
+const DROPPED_AT_SERIALISATION = [
+  "access_group_ids",
+  "allowed_passthrough_routes",
+  "allowed_vector_store_ids",
+  "budget_duration",
+  "enable_prompt_caching",
+  "guardrails",
+  "max_budget",
+  "organization_id",
+  "policies",
+  "prompts",
+  "rpm_limit",
+  "tags",
+  "throttle_on_budget_exceeded",
+  "tpm_limit",
+];
+
+const CLOSED_SECTIONS_VALUES = {
+  organization_id: undefined,
+  team_id: null,
+  key_alias: "my-key",
+  models: [],
+  key_type: "llm_api",
+};
+
+const OPTIONAL_SETTINGS_VALUES = {
+  ...CLOSED_SECTIONS_VALUES,
+  max_budget: undefined,
+  budget_duration: undefined,
+  tpm_limit: undefined,
+  tpm_limit_type: "key",
+  rpm_limit: undefined,
+  rpm_limit_type: "key",
+  throttle_on_budget_exceeded: undefined,
+  enable_prompt_caching: undefined,
+  guardrails: undefined,
+  disable_global_guardrails: undefined,
+  policies: undefined,
+  prompts: undefined,
+  access_group_ids: undefined,
+  allowed_passthrough_routes: undefined,
+  allowed_vector_store_ids: undefined,
+  tags: undefined,
+};
+
+const aliasOnly = (overrides: Record<string, unknown> = {}): Record<string, unknown> => ({
+  key_alias: "my-key",
+  user_id: "test-user",
+  duration: null,
+  metadata: "{}",
+  ...overrides,
+});
+
+afterEach(() => {
+  vi.restoreAllMocks();
+});
+
+describe("always-present keys", () => {
+  it("emits the eight keys the closed form sends, and nothing else", () => {
+    const closedFormValues = { ...CLOSED_SECTIONS_VALUES };
+    const closedFormPayload = {
+      ...closedFormValues,
+      user_id: "test-user",
+      duration: null,
+      metadata: "{}",
+    };
+    expect(payloadOf(build(closedFormValues))).toStrictEqual(closedFormPayload);
+  });
+
+  it("injects user_id, duration and metadata even when the form reported none of them", () => {
+    expect(payloadOf(build({ key_alias: "my-key" }))).toStrictEqual(aliasOnly());
+  });
+
+  it("keeps a mounted-but-untouched field as an undefined-valued key rather than dropping it", () => {
+    expect(payloadOf(build({ key_alias: "my-key", guardrails: undefined, tags: undefined }))).toStrictEqual(
+      aliasOnly({ guardrails: undefined, tags: undefined }),
+    );
+  });
+});
+
+describe("duration", () => {
+  it("forwards a typed duration by value", () => {
+    expect(payloadOf(build({ key_alias: "my-key", duration: "45d" }))).toStrictEqual(aliasOnly({ duration: "45d" }));
+  });
+
+  it.each([
+    ["an empty string", ""],
+    ["a whitespace-only string", "   "],
+    ["undefined", undefined],
+  ])("coalesces %s to null", (_label, duration) => {
+    expect(payloadOf(build({ key_alias: "my-key", duration }))).toStrictEqual(aliasOnly({ duration: null }));
+  });
+
+  it("does not coerce a non-string duration", () => {
+    expect(() => build({ key_alias: "my-key", duration: 30 })).toThrow(TypeError);
+  });
+});
+
+describe("key ownership", () => {
+  it("overwrites user_id with the signed-in user when the key is owned by you", () => {
+    expect(payloadOf(build({ key_alias: "my-key", user_id: "someone-else" }))).toStrictEqual(
+      aliasOnly({ user_id: "test-user" }),
+    );
+  });
+
+  it("leaves the form's user_id alone for another_user", () => {
+    const expected = { key_alias: "my-key", user_id: "someone-else", duration: null, metadata: "{}" };
+    expect(
+      payloadOf(build({ key_alias: "my-key", user_id: "someone-else" }, { keyOwner: "another_user" })),
+    ).toStrictEqual(expected);
+  });
+
+  it("adds the selected agent id for an agent-owned key", () => {
+    const expected = { key_alias: "my-key", agent_id: "agent-1", duration: null, metadata: "{}" };
+    expect(payloadOf(build({ key_alias: "my-key" }, { keyOwner: "agent", selectedAgentId: "agent-1" }))).toStrictEqual(
+      expected,
+    );
+  });
+
+  it("reports agent_not_selected instead of building a payload when no agent is selected", () => {
+    expect(build({ key_alias: "my-key" }, { keyOwner: "agent", selectedAgentId: null })).toStrictEqual({
+      kind: "agent_not_selected",
+    });
+  });
+
+  it("stamps the alias into metadata as the service account id and sends no user_id", () => {
+    expect(payloadOf(build({ key_alias: "svc-key" }, { keyOwner: "service_account" }))).toStrictEqual({
+      key_alias: "svc-key",
+      duration: null,
+      metadata: '{"service_account_id":"svc-key"}',
+    });
+  });
+});
+
+describe("metadata", () => {
+  it("re-serialises the parsed form value", () => {
+    expect(payloadOf(build({ key_alias: "my-key", metadata: '{"team":"core"}' }))).toStrictEqual(
+      aliasOnly({ metadata: '{"team":"core"}' }),
+    );
+  });
+
+  it("falls back to an empty object and logs when the JSON is malformed", () => {
+    const consoleError = vi.spyOn(console, "error").mockImplementation(() => {});
+    expect(payloadOf(build({ key_alias: "my-key", metadata: "{not json" }))).toStrictEqual(aliasOnly());
+    expect(consoleError).toHaveBeenCalledWith("Error parsing metadata:", expect.any(SyntaxError));
+  });
+
+  it("merges logging configs, dropping rows with no callback selected", () => {
+    expect(
+      payloadOf(
+        build(
+          { key_alias: "my-key", metadata: '{"team":"core"}' },
+          { loggingSettings: [{ callback_name: "langfuse" }, { callback_name: "" }] },
+        ),
+      ),
+    ).toStrictEqual(aliasOnly({ metadata: '{"team":"core","logging":[{"callback_name":"langfuse"}]}' }));
+  });
+
+  it("maps disabled callbacks from display names to internal names", () => {
+    expect(payloadOf(build({ key_alias: "my-key" }, { disabledCallbacks: ["Langfuse"] }))).toStrictEqual(
+      aliasOnly({ metadata: '{"litellm_disabled_callbacks":["langfuse"]}' }),
+    );
+  });
+
+  it("keeps an array metadata as an array when stamping the service account id", () => {
+    expect(
+      payloadOf(build({ key_alias: "svc-key", metadata: '["a"]' }, { keyOwner: "service_account" })),
+    ).toStrictEqual({ key_alias: "svc-key", duration: null, metadata: '["a"]' });
+  });
+
+  it("rejects a service account whose metadata parses to a primitive", () => {
+    expect(() => build({ key_alias: "svc-key", metadata: "5" }, { keyOwner: "service_account" })).toThrow(TypeError);
+  });
+
+  it("keeps every metadata contributor in one object", () => {
+    expect(
+      payloadOf(
+        build(
+          { key_alias: "svc-key", metadata: '{"team":"core"}' },
+          {
+            keyOwner: "service_account",
+            loggingSettings: [{ callback_name: "otel" }],
+            disabledCallbacks: ["Datadog"],
+          },
+        ),
+      ),
+    ).toStrictEqual({
+      key_alias: "svc-key",
+      duration: null,
+      metadata:
+        '{"team":"core","service_account_id":"svc-key","logging":[{"callback_name":"otel"}],"litellm_disabled_callbacks":["datadog"]}',
+    });
+  });
+});
+
+describe("object_permission", () => {
+  it("is absent when nothing contributes to it", () => {
+    expect(payloadOf(build({ key_alias: "my-key", allowed_vector_store_ids: [] }))).toStrictEqual(
+      aliasOnly({ allowed_vector_store_ids: [] }),
+    );
+  });
+
+  it("moves selected vector stores off the top level", () => {
+    expect(payloadOf(build({ key_alias: "my-key", allowed_vector_store_ids: ["vs-1"] }))).toStrictEqual(
+      aliasOnly({ object_permission: { vector_stores: ["vs-1"] } }),
+    );
+  });
+
+  it("splits an MCP selection into servers, access groups and toolsets", () => {
+    expect(
+      payloadOf(
+        build({
+          key_alias: "my-key",
+          allowed_mcp_servers_and_groups: { servers: ["s-1"], accessGroups: ["g-1"], toolsets: ["t-1"] },
+        }),
+      ),
+    ).toStrictEqual(
+      aliasOnly({
+        object_permission: { mcp_servers: ["s-1"], mcp_access_groups: ["g-1"], mcp_toolsets: ["t-1"] },
+      }),
+    );
+  });
+
+  it("omits the empty halves of an MCP selection", () => {
+    expect(
+      payloadOf(
+        build({
+          key_alias: "my-key",
+          allowed_mcp_servers_and_groups: { servers: ["s-1"], accessGroups: [], toolsets: [] },
+        }),
+      ),
+    ).toStrictEqual(aliasOnly({ object_permission: { mcp_servers: ["s-1"] } }));
+  });
+
+  it("leaves an all-empty MCP selection on the top level", () => {
+    expect(
+      payloadOf(
+        build({ key_alias: "my-key", allowed_mcp_servers_and_groups: { servers: [], accessGroups: [], toolsets: [] } }),
+      ),
+    ).toStrictEqual(aliasOnly({ allowed_mcp_servers_and_groups: { servers: [], accessGroups: [], toolsets: [] } }));
+  });
+
+  it("nests configured MCP tool permissions", () => {
+    expect(payloadOf(build({ key_alias: "my-key", mcp_tool_permissions: { "s-1": ["read"] } }))).toStrictEqual(
+      aliasOnly({ object_permission: { mcp_tool_permissions: { "s-1": ["read"] } } }),
+    );
+  });
+
+  it("always strips mcp_tool_permissions from the top level, even when empty", () => {
+    expect(payloadOf(build({ key_alias: "my-key", mcp_tool_permissions: {} }))).toStrictEqual(aliasOnly());
+  });
+
+  it("lets a standalone access group list win over the one from the MCP selection", () => {
+    expect(
+      payloadOf(
+        build({
+          key_alias: "my-key",
+          allowed_mcp_servers_and_groups: { servers: ["s-1"], accessGroups: ["from-selector"] },
+          allowed_mcp_access_groups: ["standalone"],
+        }),
+      ),
+    ).toStrictEqual(aliasOnly({ object_permission: { mcp_servers: ["s-1"], mcp_access_groups: ["standalone"] } }));
+  });
+
+  it("splits an agent selection into agents and agent access groups", () => {
+    expect(
+      payloadOf(build({ key_alias: "my-key", allowed_agents_and_groups: { agents: ["a-1"], accessGroups: ["ag-1"] } })),
+    ).toStrictEqual(aliasOnly({ object_permission: { agents: ["a-1"], agent_access_groups: ["ag-1"] } }));
+  });
+
+  it("merges every source into a single object_permission", () => {
+    const everySource = {
+      key_alias: "my-key",
+      allowed_vector_store_ids: ["vs-1"],
+      allowed_mcp_servers_and_groups: { servers: ["s-1"], accessGroups: ["g-1"], toolsets: ["t-1"] },
+      mcp_tool_permissions: { "s-1": ["read"] },
+      allowed_agents_and_groups: { agents: ["a-1"], accessGroups: ["ag-1"] },
+    };
+    expect(payloadOf(build(everySource))).toStrictEqual(
+      aliasOnly({
+        object_permission: {
+          vector_stores: ["vs-1"],
+          mcp_servers: ["s-1"],
+          mcp_access_groups: ["g-1"],
+          mcp_toolsets: ["t-1"],
+          mcp_tool_permissions: { "s-1": ["read"] },
+          agents: ["a-1"],
+          agent_access_groups: ["ag-1"],
+        },
+      }),
+    );
+  });
+});
+
+describe("premium and rotation flags", () => {
+  it("drops disable_global_guardrails when it is off", () => {
+    expect(payloadOf(build({ key_alias: "my-key", disable_global_guardrails: false }))).toStrictEqual(aliasOnly());
+  });
+
+  it("keeps disable_global_guardrails when it is on", () => {
+    expect(payloadOf(build({ key_alias: "my-key", disable_global_guardrails: true }))).toStrictEqual(
+      aliasOnly({ disable_global_guardrails: true }),
+    );
+  });
+
+  it("adds the rotation fields only when auto rotation is enabled", () => {
+    expect(
+      payloadOf(build({ key_alias: "my-key" }, { autoRotationEnabled: true, rotationInterval: "7d" })),
+    ).toStrictEqual(aliasOnly({ auto_rotate: true, rotation_interval: "7d" }));
+  });
+
+  it("sends no rotation fields when auto rotation is off", () => {
+    expect(payloadOf(build({ key_alias: "my-key" }, { rotationInterval: "7d" }))).toStrictEqual(aliasOnly());
+  });
+});
+
+describe("keys sourced from component state", () => {
+  it("serialises model aliases", () => {
+    expect(payloadOf(build({ key_alias: "my-key" }, { modelAliases: { fast: "gpt-4o-mini" } }))).toStrictEqual(
+      aliasOnly({ aliases: '{"fast":"gpt-4o-mini"}' }),
+    );
+  });
+
+  it("sends router settings that hold at least one value", () => {
+    expect(
+      payloadOf(build({ key_alias: "my-key" }, { routerSettings: { router_settings: { num_retries: 3 } } })),
+    ).toStrictEqual(aliasOnly({ router_settings: { num_retries: 3 } }));
+  });
+
+  it("skips router settings whose every field is blank", () => {
+    expect(
+      payloadOf(
+        build(
+          { key_alias: "my-key" },
+          { routerSettings: { router_settings: { num_retries: null, timeout: undefined, routing_strategy: "" } } },
+        ),
+      ),
+    ).toStrictEqual(aliasOnly());
+  });
+
+  it("keeps only budget windows that carry both a duration and a limit", () => {
+    expect(
+      payloadOf(
+        build(
+          { key_alias: "my-key" },
+          {
+            budgetLimits: [
+              { budget_duration: "1h", max_budget: 5 },
+              { budget_duration: "", max_budget: 3 },
+              { budget_duration: "7d", max_budget: null },
+            ],
+          },
+        ),
+      ),
+    ).toStrictEqual(aliasOnly({ budget_limits: [{ budget_duration: "1h", max_budget: 5 }] }));
+  });
+
+  it("keeps a zero budget window rather than treating it as unset", () => {
+    expect(
+      payloadOf(build({ key_alias: "my-key" }, { budgetLimits: [{ budget_duration: "1h", max_budget: 0 }] })),
+    ).toStrictEqual(aliasOnly({ budget_limits: [{ budget_duration: "1h", max_budget: 0 }] }));
+  });
+
+  it("omits budget_limits when no window is complete", () => {
+    expect(
+      payloadOf(build({ key_alias: "my-key" }, { budgetLimits: [{ budget_duration: "7d", max_budget: null }] })),
+    ).toStrictEqual(aliasOnly());
+  });
+
+  it("reduces tag rows into a tag_rpm_limit map", () => {
+    expect(
+      payloadOf(
+        build(
+          { key_alias: "my-key" },
+          {
+            tagRateLimits: [
+              { id: "r-1", tag: "prod", rpm_limit: 10 },
+              { id: "r-2", tag: "  ", rpm_limit: 5 },
+              { id: "r-3", tag: "dev", rpm_limit: null },
+            ],
+          },
+        ),
+      ),
+    ).toStrictEqual(aliasOnly({ tag_rpm_limit: { prod: 10 } }));
+  });
+
+  it("omits tag_rpm_limit when no row is complete", () => {
+    expect(
+      payloadOf(build({ key_alias: "my-key" }, { tagRateLimits: [{ id: "r-1", tag: "", rpm_limit: 10 }] })),
+    ).toStrictEqual(aliasOnly());
+  });
+
+  it("sends configured budget fallbacks", () => {
+    expect(payloadOf(build({ key_alias: "my-key" }, { budgetFallbacks: { "gpt-4": ["gpt-4o"] } }))).toStrictEqual(
+      aliasOnly({ budget_fallbacks: { "gpt-4": ["gpt-4o"] } }),
+    );
+  });
+});
+
+describe("budget duration", () => {
+  it("turns the never-resets sentinel into null", () => {
+    expect(payloadOf(build({ key_alias: "my-key", budget_duration: "none" }))).toStrictEqual(
+      aliasOnly({ budget_duration: null }),
+    );
+  });
+
+  it("forwards a real budget duration untouched", () => {
+    expect(payloadOf(build({ key_alias: "my-key", budget_duration: "30d" }))).toStrictEqual(
+      aliasOnly({ budget_duration: "30d" }),
+    );
+  });
+});
+
+describe("purity", () => {
+  it("leaves the submitted form values untouched", () => {
+    const values = {
+      key_alias: "my-key",
+      mcp_tool_permissions: { "s-1": ["read"] },
+      allowed_vector_store_ids: ["vs-1"],
+      disable_global_guardrails: false,
+      duration: "",
+    };
+    const before = structuredClone(values);
+    build(values);
+    expect(values).toStrictEqual(before);
+  });
+});
+
+describe("serialised wire shape", () => {
+  it("keeps an untouched closed form at eight object keys and seven wire keys", () => {
+    const payload = payloadOf(build(CLOSED_SECTIONS_VALUES));
+    expect(Object.keys(payload)).toHaveLength(8);
+    expect(wireKeys(payload)).toStrictEqual([
+      "team_id",
+      "key_alias",
+      "models",
+      "key_type",
+      "user_id",
+      "duration",
+      "metadata",
+    ]);
+    expect(payload.duration).toBeNull();
+  });
+
+  it("drops the undefined picker and keeps the null one, which is what the two Form.Items differ on", () => {
+    const payload = payloadOf(build(CLOSED_SECTIONS_VALUES));
+    expect(payload.organization_id).toBeUndefined();
+    expect(payload.team_id).toBeNull();
+    expect(wireKeys(payload)).not.toContain("organization_id");
+    expect(wireKeys(payload)).toContain("team_id");
+  });
+
+  it("forwards a selected team by value", () => {
+    expect(payloadOf(build({ ...CLOSED_SECTIONS_VALUES, team_id: "team-1" })).team_id).toBe("team-1");
+  });
+
+  it("adds fifteen keys to the object and only the two limit types to the wire when Optional Settings opens", () => {
+    const payload = payloadOf(build(OPTIONAL_SETTINGS_VALUES));
+    expect(Object.keys(payload)).toHaveLength(23);
+    expect(wireKeys(payload)).toStrictEqual([
+      "team_id",
+      "key_alias",
+      "models",
+      "key_type",
+      "tpm_limit_type",
+      "rpm_limit_type",
+      "user_id",
+      "duration",
+      "metadata",
+    ]);
+  });
+
+  it("never turns an undefined-valued key into null or an empty string", () => {
+    const payload = payloadOf(build(OPTIONAL_SETTINGS_VALUES));
+    DROPPED_AT_SERIALISATION.forEach((key) => {
+      expect(payload[key]).toBeUndefined();
+    });
+    expect(wireKeys(payload)).toEqual(expect.not.arrayContaining(DROPPED_AT_SERIALISATION));
+  });
+});
+
+describe("duplicate alias", () => {
+  it("reports the clash instead of building a payload", () => {
+    expect(
+      build({ key_alias: "taken", team_id: "team-1" }, { existingKeys: [{ team_id: "team-1", key_alias: "taken" }] }),
+    ).toStrictEqual({ kind: "duplicate_alias", alias: "taken", teamId: "team-1" });
+  });
+
+  it("scopes the clash to the same team", () => {
+    expect(
+      payloadOf(
+        build({ key_alias: "taken", team_id: "team-2" }, { existingKeys: [{ team_id: "team-1", key_alias: "taken" }] }),
+      ).key_alias,
+    ).toBe("taken");
+  });
+
+  it("treats a keyless form and a teamless key as the same bucket", () => {
+    expect(build({}, { existingKeys: [{ team_id: null, key_alias: "" }] })).toStrictEqual({
+      kind: "duplicate_alias",
+      alias: "",
+      teamId: null,
+    });
+  });
+
+  it("checks the alias before the agent selection", () => {
+    expect(
+      build(
+        { key_alias: "taken" },
+        { existingKeys: [{ team_id: null, key_alias: "taken" }], keyOwner: "agent", selectedAgentId: null },
+      ).kind,
+    ).toBe("duplicate_alias");
+  });
+});
+
+describe("endpoint", () => {
+  it.each([
+    ["you", "standard"],
+    ["another_user", "standard"],
+    ["service_account", "service_account"],
+  ])("routes a %s key to the %s endpoint", (keyOwner, endpoint) => {
+    const result = build({ key_alias: "my-key" }, { keyOwner });
+    expect(result.kind === "ok" && result.endpoint).toBe(endpoint);
+  });
+});
diff --git a/ui/litellm-dashboard/src/components/organisms/createKeyPayload.ts b/ui/litellm-dashboard/src/components/organisms/createKeyPayload.ts
new file mode 100644
index 00000000000..2b14e8372f7
--- /dev/null
+++ b/ui/litellm-dashboard/src/components/organisms/createKeyPayload.ts
@@ -0,0 +1,212 @@
+import { mapDisplayToInternalNames } from "../callback_info_helpers";
+import { NEVER_RESETS_BUDGET_DURATION } from "../common_components/budget_duration_dropdown";
+import type { RouterSettingsAccordionValue } from "../common_components/RouterSettingsAccordion";
+import type { BudgetWindowEntry } from "../key_team_helpers/BudgetWindowsEditor";
+import { tagRowsToLimits, type TagRateLimitEntry } from "../key_team_helpers/TagRateLimitEditor";
+
+export interface KeyLoggingSetting {
+  callback_name?: string;
+}
+
+export interface ExistingKey {
+  readonly team_id?: string | null;
+  readonly key_alias?: string | null;
+}
+
+export interface KeyCreateInput {
+  readonly formValues: Record<string, unknown>;
+  readonly existingKeys: readonly ExistingKey[] | null;
+  readonly keyOwner: string;
+  readonly userID: string | null;
+  readonly selectedAgentId: string | null;
+  readonly loggingSettings: KeyLoggingSetting[];
+  readonly disabledCallbacks: string[];
+  readonly autoRotationEnabled: boolean;
+  readonly rotationInterval: string;
+  readonly modelAliases: Record<string, string>;
+  readonly routerSettings: RouterSettingsAccordionValue | null;
+  readonly budgetLimits: BudgetWindowEntry[];
+  readonly tagRateLimits: TagRateLimitEntry[];
+  readonly budgetFallbacks: Record<string, string[]>;
+}
+
+export type KeyPayloadResult =
+  | {
+      readonly kind: "ok";
+      readonly payload: Record<string, unknown>;
+      readonly endpoint: "standard" | "service_account";
+    }
+  | { readonly kind: "duplicate_alias"; readonly alias: string; readonly teamId: string | null }
+  | { readonly kind: "agent_not_selected" };
+
+interface McpSelection {
+  readonly servers?: unknown[];
+  readonly accessGroups?: unknown[];
+  readonly toolsets?: unknown[];
+}
+
+interface AgentSelection {
+  readonly agents?: unknown[];
+  readonly accessGroups?: unknown[];
+}
+
+const nonEmptyList = (raw: unknown): unknown[] | undefined => {
+  const list = raw as unknown[] | undefined;
+  return list && list.length > 0 ? list : undefined;
+};
+
+const readMcpSelection = (raw: unknown): McpSelection | undefined => {
+  const selection = raw as McpSelection | undefined;
+  if (!selection) return undefined;
+  const servers = nonEmptyList(selection.servers);
+  const accessGroups = nonEmptyList(selection.accessGroups);
+  const toolsets = nonEmptyList(selection.toolsets);
+  if (!servers && !accessGroups && !toolsets) return undefined;
+  return { servers, accessGroups, toolsets };
+};
+
+const readAgentSelection = (raw: unknown): AgentSelection | undefined => {
+  const selection = raw as AgentSelection | undefined;
+  if (!selection) return undefined;
+  const agents = nonEmptyList(selection.agents);
+  const accessGroups = nonEmptyList(selection.accessGroups);
+  if (!agents && !accessGroups) return undefined;
+  return { agents, accessGroups };
+};
+
+const readToolPermissions = (raw: unknown): unknown | undefined => {
+  const permissions = raw || {};
+  return Object.keys(permissions as object).length > 0 ? permissions : undefined;
+};
+
+const parseMetadata = (raw: unknown): unknown => {
+  try {
+    return JSON.parse((raw as string) || "{}");
+  } catch (error) {
+    console.error("Error parsing metadata:", error);
+    return {};
+  }
+};
+
+const buildMetadataJson = (values: Record<string, unknown>, input: KeyCreateInput): string => {
+  const parsed = parseMetadata(values.metadata);
+  if (input.keyOwner === "service_account") {
+    (parsed as Record<string, unknown>).service_account_id = values.key_alias;
+  }
+  const logged =
+    input.loggingSettings.length > 0
+      ? { ...(parsed as object), logging: input.loggingSettings.filter((config) => config.callback_name) }
+      : parsed;
+  const disabled =
+    input.disabledCallbacks.length > 0
+      ? { ...(logged as object), litellm_disabled_callbacks: mapDisplayToInternalNames(input.disabledCallbacks) }
+      : logged;
+  return JSON.stringify(disabled);
+};
+
+interface PermissionSources {
+  readonly vectorStores: unknown[] | undefined;
+  readonly mcp: McpSelection | undefined;
+  readonly toolPermissions: unknown | undefined;
+  readonly extraMcpAccessGroups: unknown[] | undefined;
+  readonly agents: AgentSelection | undefined;
+}
+
+const readPermissionSources = (values: Record<string, unknown>): PermissionSources => ({
+  vectorStores: nonEmptyList(values.allowed_vector_store_ids),
+  mcp: readMcpSelection(values.allowed_mcp_servers_and_groups),
+  toolPermissions: readToolPermissions(values.mcp_tool_permissions),
+  extraMcpAccessGroups: nonEmptyList(values.allowed_mcp_access_groups),
+  agents: readAgentSelection(values.allowed_agents_and_groups),
+});
+
+const buildObjectPermission = ({
+  vectorStores,
+  mcp,
+  toolPermissions,
+  extraMcpAccessGroups,
+  agents,
+}: PermissionSources): Record<string, unknown> | undefined => {
+  const permission: Record<string, unknown> = {
+    ...(vectorStores && { vector_stores: vectorStores }),
+    ...(mcp?.servers && { mcp_servers: mcp.servers }),
+    ...(mcp?.accessGroups && { mcp_access_groups: mcp.accessGroups }),
+    ...(mcp?.toolsets && { mcp_toolsets: mcp.toolsets }),
+    ...(toolPermissions !== undefined && { mcp_tool_permissions: toolPermissions }),
+    ...(extraMcpAccessGroups && { mcp_access_groups: extraMcpAccessGroups }),
+    ...(agents?.agents && { agents: agents.agents }),
+    ...(agents?.accessGroups && { agent_access_groups: agents.accessGroups }),
+  };
+  return Object.keys(permission).length > 0 ? permission : undefined;
+};
+
+const consumedSourceKeys = (
+  values: Record<string, unknown>,
+  { vectorStores, mcp, extraMcpAccessGroups, agents }: PermissionSources,
+): ReadonlySet<string> =>
+  new Set<string>([
+    "mcp_tool_permissions",
+    ...(values.disable_global_guardrails ? [] : ["disable_global_guardrails"]),
+    ...(vectorStores ? ["allowed_vector_store_ids"] : []),
+    ...(mcp ? ["allowed_mcp_servers_and_groups"] : []),
+    ...(extraMcpAccessGroups ? ["allowed_mcp_access_groups"] : []),
+    ...(agents ? ["allowed_agents_and_groups"] : []),
+  ]);
+
+const withoutKeys = (values: Record<string, unknown>, dropped: ReadonlySet<string>): Record<string, unknown> =>
+  Object.fromEntries(Object.entries(values).filter(([key]) => !dropped.has(key)));
+
+const duplicateAlias = (input: KeyCreateInput): { alias: string; teamId: string | null } | undefined => {
+  const alias = (input.formValues?.key_alias as string | undefined) ?? "";
+  const teamId = (input.formValues?.team_id as string | undefined) ?? null;
+  const taken = (input.existingKeys ?? []).filter((key) => key.team_id === teamId).map((key) => key.key_alias);
+  return taken.includes(alias) ? { alias, teamId } : undefined;
+};
+
+export const buildKeyCreatePayload = (input: KeyCreateInput): KeyPayloadResult => {
+  const duplicate = duplicateAlias(input);
+  if (duplicate) {
+    return { kind: "duplicate_alias", ...duplicate };
+  }
+  if (input.keyOwner === "agent" && !input.selectedAgentId) {
+    return { kind: "agent_not_selected" };
+  }
+
+  const values = input.formValues;
+
+  const sources = readPermissionSources(values);
+  const objectPermission = buildObjectPermission(sources);
+  const dropped = consumedSourceKeys(values, sources);
+
+  const duration = values.duration;
+  const validWindows = input.budgetLimits.filter(
+    (window) => window.budget_duration && window.max_budget !== null && window.max_budget !== undefined,
+  );
+  const { tag_rpm_limit } = tagRowsToLimits(input.tagRateLimits);
+  const routerSettings = input.routerSettings?.router_settings;
+  const configuredRouterSettings =
+    routerSettings &&
+    Object.values(routerSettings).some((value) => value !== null && value !== undefined && value !== "")
+      ? routerSettings
+      : undefined;
+
+  return {
+    kind: "ok",
+    endpoint: input.keyOwner === "service_account" ? "service_account" : "standard",
+    payload: {
+      ...withoutKeys(values, dropped),
+      ...(input.keyOwner === "you" && { user_id: input.userID }),
+      ...(input.keyOwner === "agent" && { agent_id: input.selectedAgentId }),
+      ...(input.autoRotationEnabled && { auto_rotate: true, rotation_interval: input.rotationInterval }),
+      duration: !duration || (duration as string).trim() === "" ? null : duration,
+      metadata: buildMetadataJson(values, input),
+      ...(objectPermission && { object_permission: objectPermission }),
+      ...(Object.keys(input.modelAliases).length > 0 && { aliases: JSON.stringify(input.modelAliases) }),
+      ...(configuredRouterSettings && { router_settings: configuredRouterSettings }),
+      ...(validWindows.length > 0 && { budget_limits: validWindows }),
+      ...(Object.keys(tag_rpm_limit).length > 0 && { tag_rpm_limit }),
+      ...(Object.keys(input.budgetFallbacks).length > 0 && { budget_fallbacks: input.budgetFallbacks }),
+      ...(values.budget_duration === NEVER_RESETS_BUDGET_DURATION && { budget_duration: null }),
+    },
+  };
+};
diff --git a/ui/litellm-dashboard/src/components/organisms/create_key_button.integration.test.tsx b/ui/litellm-dashboard/src/components/organisms/create_key_button.integration.test.tsx
index feea216e4ff..3069d25a18b 100644
--- a/ui/litellm-dashboard/src/components/organisms/create_key_button.integration.test.tsx
+++ b/ui/litellm-dashboard/src/components/organisms/create_key_button.integration.test.tsx
@@ -1,70 +1,114 @@
 import userEvent from "@testing-library/user-event";
-import { beforeEach, describe, expect, it, vi } from "vitest";
-import { renderWithProviders, screen, waitFor } from "../../../tests/test-utils";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { renderWithProviders, screen, testQueryClient, waitFor } from "../../../tests/test-utils";
+import type { Team } from "../key_team_helpers/key_list";
+import { keyCreateCall, keyCreateServiceAccountCall, modelAvailableCall, userFilterUICall } from "../networking";
 import CreateKey from "./create_key_button";
 
-const { mockKeyCreateCall } = vi.hoisted(() => ({
-  mockKeyCreateCall: vi.fn().mockResolvedValue({ key: "sk-created", soft_budget: null }),
+const state = vi.hoisted(() => ({
+  authorized: {
+    accessToken: "test-token",
+    userId: "test-user-id",
+    userRole: "Admin",
+    premiumUser: false,
+  },
+  can: {} as Record<string, boolean>,
+  uiSettings: {} as Record<string, unknown>,
+  tags: {} as Record<string, { name: string }>,
+  teams: [] as { team_id: string; team_alias: string; models: string[] }[],
+  organizations: [] as { organization_id: string; organization_alias: string }[],
+  accessGroups: [] as { access_group_id: string; access_group_name: string }[],
+  projects: [] as { project_id: string; project_alias: string; team_id?: string; models?: string[] }[],
 }));
 
-vi.mock("@/app/(dashboard)/hooks/useAuthorized", () => ({
-  default: () => ({ accessToken: "test-token", userId: "test-user-id", userRole: "Admin", premiumUser: true }),
+vi.mock("@/app/(dashboard)/hooks/useAuthorized", () => ({ default: () => state.authorized }));
+vi.mock("@/app/(dashboard)/hooks/useCan", () => ({
+  default: (capability: string) => state.can[capability] ?? true,
 }));
-
-vi.mock("@/app/(dashboard)/hooks/useCan", () => ({ default: () => false }));
-
-vi.mock("@/app/(dashboard)/hooks/keys/useKeys", () => ({ keyKeys: { lists: () => ["keys"] } }));
-
 vi.mock("@/app/(dashboard)/hooks/organizations/useOrganizations", () => ({
-  useOrganizations: () => ({ data: [], isLoading: false }),
+  useOrganizations: () => ({ data: state.organizations, isLoading: false }),
 }));
-
 vi.mock("@/app/(dashboard)/hooks/projects/useProjects", () => ({
-  useProjects: () => ({ data: [], isLoading: false }),
+  useProjects: () => ({ data: state.projects, isLoading: false }),
 }));
-
 vi.mock("@/app/(dashboard)/hooks/uiSettings/useUISettings", () => ({
-  useUISettings: () => ({ data: { values: {} } }),
+  useUISettings: () => ({ data: { values: state.uiSettings } }),
+}));
+vi.mock("@/app/(dashboard)/hooks/tags/useTags", () => ({
+  useTags: () => ({ data: state.tags, isLoading: false }),
 }));
-
-vi.mock("@/app/(dashboard)/hooks/tags/useTags", () => ({ useTags: () => ({ data: {} }) }));
-
 vi.mock("@/app/(dashboard)/hooks/teams/useTeams", () => ({
-  useInfiniteTeams: () => ({ data: { pages: [{ teams: [] }] }, fetchNextPage: vi.fn(), hasNextPage: false }),
+  useInfiniteTeams: () => ({
+    data: { pages: [{ teams: state.teams, total: state.teams.length, page: 1, page_size: 50, total_pages: 1 }] },
+    fetchNextPage: vi.fn(),
+    hasNextPage: false,
+    isFetchingNextPage: false,
+    isLoading: false,
+  }),
 }));
-
 vi.mock("@/app/(dashboard)/hooks/accessGroups/useAccessGroups", () => ({
-  useAccessGroups: () => ({ data: [], isLoading: false, isError: false }),
+  useAccessGroups: () => ({ data: state.accessGroups, isLoading: false, isError: false }),
+}));
+vi.mock("@/app/(dashboard)/hooks/mcpServers/useMCPServers", () => ({
+  useMCPServers: () => ({ data: [], isLoading: false }),
+}));
+vi.mock("@/app/(dashboard)/hooks/mcpServers/useMCPAccessGroups", () => ({
+  useMCPAccessGroups: () => ({ data: [], isLoading: false }),
+}));
+vi.mock("@/app/(dashboard)/hooks/mcpServers/useMCPToolsets", () => ({
+  useMCPToolsets: () => ({ data: [], isLoading: false }),
 }));
 
-vi.mock("../networking", () => ({
-  keyCreateCall: mockKeyCreateCall,
-  keyCreateServiceAccountCall: vi.fn().mockResolvedValue({ key: "sk-sa", soft_budget: null }),
-  modelAvailableCall: vi.fn().mockResolvedValue({ data: [{ id: "gpt-4" }] }),
-  getGuardrailsList: vi.fn().mockResolvedValue({ guardrails: [] }),
-  getPoliciesList: vi.fn().mockResolvedValue({ policies: [] }),
-  getPromptsList: vi.fn().mockResolvedValue({ prompts: [] }),
-  getPossibleUserRoles: vi.fn().mockResolvedValue({}),
-  userFilterUICall: vi.fn().mockResolvedValue([]),
-  fetchMCPAccessGroups: vi.fn().mockResolvedValue([]),
-  getAgentsList: vi.fn().mockResolvedValue({ agents: [] }),
-  getPassThroughEndpointsCall: vi.fn().mockResolvedValue({ endpoints: [] }),
-  proxyBaseUrl: "http://localhost:4000",
-}));
+vi.mock("../networking", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("../networking")>();
+  const emptyMcpTools = { tools: [], error: null, message: null, stack_trace: null };
+  return {
+    ...actual,
+    keyCreateCall: vi.fn().mockResolvedValue({ key: "sk-created", soft_budget: null }),
+    keyCreateServiceAccountCall: vi.fn().mockResolvedValue({ key: "sk-service-account", soft_budget: null }),
+    modelAvailableCall: vi.fn().mockResolvedValue({ data: [{ id: "gpt-4" }] }),
+    getGuardrailsList: vi.fn().mockResolvedValue({ guardrails: [] }),
+    getPoliciesList: vi.fn().mockResolvedValue({ policies: [] }),
+    getPromptsList: vi.fn().mockResolvedValue({ prompts: [] }),
+    getPossibleUserRoles: vi.fn().mockResolvedValue({}),
+    userFilterUICall: vi.fn().mockResolvedValue([]),
+    getAgentsList: vi.fn().mockResolvedValue({ agents: [] }),
+    getPassThroughEndpointsCall: vi.fn().mockResolvedValue({ endpoints: [] }),
+    vectorStoreListCall: vi.fn().mockResolvedValue({ data: [] }),
+    listMCPTools: vi.fn().mockResolvedValue(emptyMcpTools),
+    getRouterSettingsCall: vi.fn().mockResolvedValue({ router_settings: {} }),
+  };
+});
 
-vi.mock("../agent_management/AgentSelector", () => ({ default: () => null }));
-vi.mock("../common_components/check_openapi_schema", () => ({ default: () => null }));
-vi.mock("../common_components/PremiumLoggingSettings", () => ({ default: () => null }));
-vi.mock("../common_components/RouterSettingsAccordion", () => ({ default: () => null }));
-vi.mock("../mcp_server_management/MCPServerSelector", () => ({ default: () => null }));
-vi.mock("../mcp_server_management/MCPToolPermissions", () => ({ default: () => null }));
-vi.mock("../vector_store_management/VectorStoreSelector", () => ({ default: () => null }));
-vi.mock("../CreateUserButton", () => ({ CreateUserButton: () => null }));
+const OPENAPI_SCHEMA = {
+  components: {
+    schemas: {
+      GenerateKeyRequest: {
+        properties: {
+          key: { type: "string", title: "Key" },
+          soft_budget: { type: "number", title: "Soft Budget" },
+          blocked: { type: "boolean", title: "Blocked" },
+          max_budget: { type: "number", title: "Max Budget" },
+        },
+      },
+    },
+  },
+};
 
-const MINIMAL_CREATE_PAYLOAD = {
+const SECTIONS = {
+  mcp: /MCP Settings/i,
+  agent: /Agent Settings/i,
+  logging: /Logging Settings/i,
+  router: /Router Settings/i,
+  aliases: /Model Aliases/i,
+  lifecycle: /Key Lifecycle/i,
+  advanced: /Advanced Settings/i,
+} as const;
+
+const ALL_CLOSED_PAYLOAD = {
   organization_id: undefined,
   team_id: null,
-  key_alias: "probe-key",
+  key_alias: "contract-key",
   models: [],
   key_type: "llm_api",
   user_id: "test-user-id",
@@ -72,100 +116,829 @@ const MINIMAL_CREATE_PAYLOAD = {
   metadata: "{}",
 };
 
-describe("CreateKey submit payload contract", () => {
+const OPTIONAL_OPEN_PAYLOAD = {
+  ...ALL_CLOSED_PAYLOAD,
+  max_budget: undefined,
+  budget_duration: undefined,
+  tpm_limit: undefined,
+  tpm_limit_type: null,
+  rpm_limit: undefined,
+  rpm_limit_type: null,
+  throttle_on_budget_exceeded: undefined,
+  enable_prompt_caching: undefined,
+  guardrails: undefined,
+  policies: undefined,
+  prompts: undefined,
+  access_group_ids: undefined,
+  allowed_passthrough_routes: undefined,
+  allowed_vector_store_ids: undefined,
+  tags: undefined,
+};
+
+const ROUTER_SETTINGS_DEFAULT = {
+  routing_strategy: null,
+  allowed_fails: null,
+  cooldown_time: null,
+  num_retries: null,
+  timeout: null,
+  retry_after: null,
+  fallbacks: null,
+  context_window_fallbacks: null,
+  retry_policy: null,
+  model_group_alias: null,
+  enable_tag_filtering: false,
+  routing_strategy_args: null,
+};
+
+const SECTION_PAYLOAD_ADDITIONS: Record<keyof typeof SECTIONS, Record<string, unknown>> = {
+  mcp: { allowed_mcp_servers_and_groups: { servers: [], accessGroups: [] } },
+  agent: { allowed_agents_and_groups: undefined },
+  logging: {},
+  router: { router_settings: ROUTER_SETTINGS_DEFAULT },
+  aliases: {},
+  lifecycle: {},
+  advanced: { key: undefined, soft_budget: undefined, blocked: undefined },
+};
+
+const ALL_OPEN_PAYLOAD = {
+  ...OPTIONAL_OPEN_PAYLOAD,
+  ...SECTION_PAYLOAD_ADDITIONS.mcp,
+  ...SECTION_PAYLOAD_ADDITIONS.agent,
+  ...SECTION_PAYLOAD_ADDITIONS.router,
+  ...SECTION_PAYLOAD_ADDITIONS.advanced,
+};
+
+const renderCreateKey = (props: Partial<React.ComponentProps<typeof CreateKey>> = {}) =>
+  renderWithProviders(<CreateKey team={null} teams={[]} data={[]} addKey={vi.fn()} {...props} />);
+
+const openModal = async (props: Partial<React.ComponentProps<typeof CreateKey>> = {}) => {
+  const view = renderCreateKey(props);
+  await userEvent.click(screen.getByTestId("create-key-button"));
+  await screen.findByRole("button", { name: /^create key$/i });
+  return view;
+};
+
+const antdSearchInput = (placeholder: HTMLElement): HTMLInputElement => {
+  const input = placeholder.parentElement?.querySelector("input");
+  if (input == null) {
+    throw new Error("no antd search input next to the placeholder");
+  }
+  return input;
+};
+
+const openAntdSelect = async (placeholder: HTMLElement) => {
+  await userEvent.click(antdSearchInput(placeholder));
+};
+
+const openSection = async (name: RegExp) => {
+  await userEvent.click(await screen.findByRole("button", { name }));
+};
+
+const nameTheKey = async (alias = "contract-key") => {
+  await userEvent.type(await screen.findByLabelText(/Key Name/), alias);
+};
+
+const submit = async () => {
+  await userEvent.click(screen.getByRole("button", { name: /^create key$/i }));
+};
+
+const createdPayload = async () => {
+  await waitFor(() => {
+    expect(vi.mocked(keyCreateCall)).toHaveBeenCalled();
+  });
+  return vi.mocked(keyCreateCall).mock.calls[0][2] as Record<string, unknown>;
+};
+
+describe("CreateKey", () => {
   beforeEach(() => {
-    mockKeyCreateCall.mockClear();
+    testQueryClient.clear();
+    state.authorized = { accessToken: "test-token", userId: "test-user-id", userRole: "Admin", premiumUser: false };
+    state.can = {};
+    state.uiSettings = {};
+    state.tags = {};
+    state.teams = [];
+    state.organizations = [];
+    state.projects = [];
+    state.accessGroups = [];
+    vi.mocked(keyCreateCall).mockClear().mockResolvedValue({ key: "sk-created", soft_budget: null });
+    vi.mocked(keyCreateServiceAccountCall)
+      .mockClear()
+      .mockResolvedValue({ key: "sk-service-account", soft_budget: null });
+    vi.mocked(userFilterUICall).mockClear().mockResolvedValue([]);
+    vi.mocked(modelAvailableCall)
+      .mockClear()
+      .mockResolvedValue({ data: [{ id: "gpt-4" }] });
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(async (input: RequestInfo | URL) => {
+        const url = String(input);
+        if (url.includes("openapi.json")) {
+          return { ok: true, status: 200, json: async () => OPENAPI_SCHEMA } as unknown as Response;
+        }
+        return { ok: true, status: 200, json: async () => ({}) } as unknown as Response;
+      }),
+    );
   });
 
-  const openModal = async () => {
-    renderWithProviders(<CreateKey team={null} teams={[]} data={[]} addKey={() => {}} />);
-    await userEvent.click(screen.getAllByTestId("create-key-button")[0]);
-    await screen.findByRole("button", { name: /create key/i });
-  };
-
-  it("sends exactly the bound form fields for a minimal create", async () => {
-    await openModal();
-
-    await userEvent.type(screen.getByLabelText(/Key Name/), "probe-key");
-    await userEvent.click(screen.getByRole("button", { name: /create key/i }));
-
-    await waitFor(() => {
-      expect(mockKeyCreateCall).toHaveBeenCalled();
-    });
-    expect(mockKeyCreateCall.mock.calls[0][2]).toStrictEqual(MINIMAL_CREATE_PAYLOAD);
+  afterEach(() => {
+    vi.unstubAllGlobals();
   });
 
-  it("keeps a collapsed Optional Settings section out of the payload entirely", async () => {
-    await openModal();
+  describe("submit payload contract", () => {
+    it("sends only the always-mounted fields when every collapsible section is closed", async () => {
+      await openModal();
+      await nameTheKey();
+      await submit();
 
-    await userEvent.type(screen.getByLabelText(/Key Name/), "probe-key");
-    await userEvent.click(screen.getByRole("button", { name: /create key/i }));
-
-    await waitFor(() => {
-      expect(mockKeyCreateCall).toHaveBeenCalled();
+      expect(await createdPayload()).toStrictEqual(ALL_CLOSED_PAYLOAD);
     });
-    const payload = mockKeyCreateCall.mock.calls[0][2];
-    expect(payload).not.toHaveProperty("tpm_limit_type");
-    expect(payload).not.toHaveProperty("rpm_limit_type");
-    expect(payload).not.toHaveProperty("max_budget");
-  });
 
-  it("carries the shared rate-limit-type control into the payload once its section is open", async () => {
-    await openModal();
+    it("registers the Optional Settings fields as undefined-valued keys once that section is open", async () => {
+      await openModal();
+      await nameTheKey();
+      await openSection(/Optional Settings/i);
+      await submit();
 
-    await userEvent.type(screen.getByLabelText(/Key Name/), "probe-key");
-    await userEvent.click(screen.getByText("Optional Settings"));
-
-    await userEvent.click(await screen.findByLabelText(/TPM Rate Limit Type/));
-    await userEvent.click(await screen.findByText("Guaranteed throughput"));
-
-    await userEvent.click(screen.getByRole("button", { name: /create key/i }));
-
-    await waitFor(() => {
-      expect(mockKeyCreateCall).toHaveBeenCalled();
+      expect(await createdPayload()).toStrictEqual(OPTIONAL_OPEN_PAYLOAD);
     });
-    expect(mockKeyCreateCall.mock.calls[0][2]).toMatchObject({
-      tpm_limit_type: "guaranteed_throughput",
-      rpm_limit_type: null,
+
+    it("sends the full mounted field set when every section is open", async () => {
+      await openModal();
+      await nameTheKey();
+      await openSection(/Optional Settings/i);
+      for (const trigger of Object.values(SECTIONS)) {
+        await openSection(trigger);
+      }
+      await screen.findByLabelText("Soft Budget");
+      await submit();
+
+      expect(await createdPayload()).toStrictEqual(ALL_OPEN_PAYLOAD);
+    });
+
+    it.each(Object.keys(SECTIONS) as (keyof typeof SECTIONS)[])(
+      "adds exactly the %s section's own keys when it is the only nested section open",
+      async (section) => {
+        await openModal();
+        await nameTheKey();
+        await openSection(/Optional Settings/i);
+        await openSection(SECTIONS[section]);
+        if (section === "advanced") {
+          await screen.findByLabelText("Soft Budget");
+        }
+        await submit();
+
+        expect(await createdPayload()).toStrictEqual({
+          ...OPTIONAL_OPEN_PAYLOAD,
+          ...SECTION_PAYLOAD_ADDITIONS[section],
+        });
+      },
+    );
+
+    it.each([
+      [
+        "every section closed",
+        false,
+        ["team_id", "key_alias", "models", "key_type", "user_id", "duration", "metadata"],
+      ],
+      [
+        "Optional Settings open",
+        true,
+        [
+          "team_id",
+          "key_alias",
+          "models",
+          "key_type",
+          "tpm_limit_type",
+          "rpm_limit_type",
+          "user_id",
+          "duration",
+          "metadata",
+        ],
+      ],
+    ])("serialises to exactly the wire keys with %s", async (_label, openOptional, wireKeys) => {
+      await openModal();
+      await nameTheKey();
+      if (openOptional) {
+        await openSection(/Optional Settings/i);
+      }
+      await submit();
+
+      const serialised = JSON.parse(JSON.stringify(await createdPayload())) as Record<string, unknown>;
+      expect(Object.keys(serialised).sort()).toStrictEqual([...wireKeys].sort());
+    });
+
+    it("omits a budget typed into a section the user closed again, rather than sending it as null", async () => {
+      await openModal();
+      await nameTheKey();
+      await openSection(/Optional Settings/i);
+      await userEvent.type(await screen.findByLabelText(/Max Budget \(USD\)/), "150.75");
+      await openSection(/Optional Settings/i);
+      await submit();
+
+      const payload = await createdPayload();
+      expect(payload).not.toHaveProperty("max_budget");
+      expect(payload).toStrictEqual(ALL_CLOSED_PAYLOAD);
+    });
+
+    it("restores the typed budget when the closed section is expanded again before submit", async () => {
+      await openModal();
+      await nameTheKey();
+      await openSection(/Optional Settings/i);
+      await userEvent.type(await screen.findByLabelText(/Max Budget \(USD\)/), "150.75");
+      await openSection(/Optional Settings/i);
+      await openSection(/Optional Settings/i);
+
+      expect(await screen.findByLabelText(/Max Budget \(USD\)/)).toHaveValue(150.75);
+
+      await submit();
+
+      expect(await createdPayload()).toStrictEqual({ ...OPTIONAL_OPEN_PAYLOAD, max_budget: "150.75" });
+    });
+
+    it("sends a typed max budget as a string, not a number", async () => {
+      await openModal();
+      await nameTheKey();
+      await openSection(/Optional Settings/i);
+      await userEvent.type(await screen.findByLabelText(/Max Budget \(USD\)/), "150.75");
+      await submit();
+
+      const payload = await createdPayload();
+      expect(payload.max_budget).toBe("150.75");
+    });
+
+    it.each([
+      ["Tokens per minute Limit (TPM)", "tpm_limit"],
+      ["Requests per minute Limit (RPM)", "rpm_limit"],
+    ])("routes a typed %s into the %s payload key", async (label, key) => {
+      await openModal();
+      await nameTheKey();
+      await openSection(/Optional Settings/i);
+      await userEvent.type(await screen.findByLabelText(label), "42");
+      await submit();
+
+      expect((await createdPayload())[key]).toBe("42");
+    });
+
+    it("routes the shared rate-limit-type control into its own payload key", async () => {
+      await openModal();
+      await nameTheKey();
+      await openSection(/Optional Settings/i);
+      await userEvent.click(await screen.findByLabelText(/TPM Rate Limit Type/));
+      await userEvent.click(await screen.findByRole("option", { name: /Guaranteed throughput/ }));
+      await submit();
+
+      const payload = await createdPayload();
+      expect(payload.tpm_limit_type).toBe("guaranteed_throughput");
+      expect(payload.rpm_limit_type).toBeNull();
+    });
+
+    it("routes a typed expiry into duration, which is otherwise coalesced to null", async () => {
+      await openModal();
+      await nameTheKey();
+      await openSection(/Optional Settings/i);
+      await openSection(SECTIONS.lifecycle);
+      await userEvent.type(await screen.findByLabelText("Expire Key"), "45d");
+      await submit();
+
+      expect((await createdPayload()).duration).toBe("45d");
+    });
+
+    it("drops a typed expiry back to null when its section is collapsed before submit", async () => {
+      await openModal();
+      await nameTheKey();
+      await openSection(/Optional Settings/i);
+      await openSection(SECTIONS.lifecycle);
+      await userEvent.type(await screen.findByLabelText("Expire Key"), "45d");
+      await openSection(SECTIONS.lifecycle);
+      await submit();
+
+      expect((await createdPayload()).duration).toBeNull();
+    });
+
+    it("routes a selected budget reset window into budget_duration", async () => {
+      await openModal();
+      await nameTheKey();
+      await openSection(/Optional Settings/i);
+      await userEvent.click(await screen.findByLabelText("Reset Budget"));
+      await userEvent.click(await screen.findByRole("option", { name: "daily" }));
+      await submit();
+
+      expect((await createdPayload()).budget_duration).toBe("24h");
+    });
+
+    it("sends an explicit null budget_duration when the never-resets window is chosen", async () => {
+      await openModal();
+      await nameTheKey();
+      await openSection(/Optional Settings/i);
+      await userEvent.click(await screen.findByLabelText("Reset Budget"));
+      await userEvent.click(await screen.findByRole("option", { name: /never resets/i }));
+      await submit();
+
+      const payload = await createdPayload();
+      expect("budget_duration" in payload).toBe(true);
+      expect(payload.budget_duration).toBeNull();
+    });
+
+    it("routes typed tags into the tags key", async () => {
+      state.tags = { production: { name: "production" } };
+      await openModal();
+      await nameTheKey();
+      await openSection(/Optional Settings/i);
+      await userEvent.type(await screen.findByLabelText("Tags"), "production{Enter}");
+      await submit();
+
+      expect((await createdPayload()).tags).toStrictEqual(["production"]);
+    });
+
+    it("routes a chosen access group into access_group_ids", async () => {
+      state.accessGroups = [{ access_group_id: "ag-1", access_group_name: "Group One" }];
+      await openModal();
+      await nameTheKey();
+      await openSection(/Optional Settings/i);
+
+      await openAntdSelect(await screen.findByText("Select access groups (optional)"));
+      await userEvent.click(await screen.findByText("Group One"));
+      await submit();
+
+      expect((await createdPayload()).access_group_ids).toStrictEqual(["ag-1"]);
+    });
+
+    it("moves the schema-driven Advanced Settings fields onto the payload under their own keys", async () => {
+      await openModal();
+      await nameTheKey();
+      await openSection(/Optional Settings/i);
+      await openSection(SECTIONS.advanced);
+      await userEvent.type(await screen.findByLabelText("Soft Budget"), "12");
+      await submit();
+
+      const payload = await createdPayload();
+      expect(payload.soft_budget).toBe(12);
+      expect(payload).toHaveProperty("key");
+    });
+
+    it("drops the schema-driven custom key field when the proxy disables custom API keys", async () => {
+      state.uiSettings = { disable_custom_api_keys: true };
+      await openModal();
+      await nameTheKey();
+      await openSection(/Optional Settings/i);
+      await openSection(SECTIONS.advanced);
+      await screen.findByLabelText("Soft Budget");
+      await submit();
+
+      const payload = await createdPayload();
+      expect(payload).not.toHaveProperty("key");
+      expect(payload).toHaveProperty("soft_budget");
+    });
+
+    it("drops the policy and prompt keys entirely for a role that cannot see those fields", async () => {
+      state.can = { viewPolicies: false, viewPrompts: false };
+      await openModal();
+      await nameTheKey();
+      await openSection(/Optional Settings/i);
+      await submit();
+
+      const payload = await createdPayload();
+      expect(payload).not.toHaveProperty("policies");
+      expect(payload).not.toHaveProperty("prompts");
+      expect(payload).toHaveProperty("guardrails");
+    });
+
+    it("adds project_id only when the projects UI is enabled", async () => {
+      state.uiSettings = { enable_projects_ui: true };
+      await openModal();
+      await nameTheKey();
+      await submit();
+
+      expect(await createdPayload()).toStrictEqual({ ...ALL_CLOSED_PAYLOAD, project_id: undefined });
+    });
+
+    it("keeps disable_global_guardrails out of the payload while the switch is off", async () => {
+      await openModal();
+      await nameTheKey();
+      await openSection(/Optional Settings/i);
+      await submit();
+
+      expect(await createdPayload()).not.toHaveProperty("disable_global_guardrails");
+    });
+
+    it("sends disable_global_guardrails once the switch is on", async () => {
+      state.authorized = { ...state.authorized, premiumUser: true };
+      await openModal();
+      await nameTheKey();
+      await openSection(/Optional Settings/i);
+      await userEvent.click(await screen.findByLabelText("Disable Global Guardrails"));
+      await submit();
+
+      expect((await createdPayload()).disable_global_guardrails).toBe(true);
+    });
+
+    it("folds a metadata JSON string back through JSON.stringify", async () => {
+      await openModal();
+      await nameTheKey();
+      await openSection(/Optional Settings/i);
+      await userEvent.type(await screen.findByLabelText("Metadata"), '{{"team":"research"}');
+      await submit();
+
+      expect((await createdPayload()).metadata).toBe('{"team":"research"}');
     });
   });
 
-  it("carries the shared lifecycle expiry into the payload once its section is open", async () => {
-    await openModal();
+  describe("key ownership", () => {
+    it("stamps the signed-in user onto user_id when the key is owned by you", async () => {
+      await openModal();
+      await nameTheKey();
+      await submit();
 
-    await userEvent.type(screen.getByLabelText(/Key Name/), "probe-key");
-    await userEvent.click(screen.getByText("Optional Settings"));
-    await userEvent.click(await screen.findByText("Key Lifecycle"));
-
-    await userEvent.type(await screen.findByLabelText("Expire Key"), "45d");
-
-    await userEvent.click(screen.getByRole("button", { name: /create key/i }));
-
-    await waitFor(() => {
-      expect(mockKeyCreateCall).toHaveBeenCalled();
+      expect((await createdPayload()).user_id).toBe("test-user-id");
+    });
+
+    it("mounts the user search control only once Another User is chosen", async () => {
+      await openModal();
+      expect(screen.queryByText("Type email to search for users")).not.toBeInTheDocument();
+
+      await userEvent.click(screen.getByRole("radio", { name: "Another User" }));
+
+      expect(await screen.findByText("Type email to search for users")).toBeInTheDocument();
+    });
+
+    it("hides the Another User option from a non-admin", async () => {
+      state.authorized = { ...state.authorized, userRole: "Internal User" };
+      await openModal();
+
+      expect(screen.queryByRole("radio", { name: "Another User" })).not.toBeInTheDocument();
+    });
+
+    it("routes a service account through the service account endpoint and stamps the alias into metadata", async () => {
+      state.teams = [{ team_id: "team-1", team_alias: "Team One", models: [] }];
+      await openModal({ teams: state.teams as unknown as Team[] });
+      await userEvent.click(screen.getByRole("radio", { name: "Service Account" }));
+      await userEvent.type(await screen.findByLabelText(/Service Account ID/), "svc-account-1");
+
+      await userEvent.click(await screen.findByLabelText("Team"));
+      await userEvent.click(await screen.findByRole("option", { name: /Team One/ }));
+
+      await submit();
+
+      await waitFor(() => {
+        expect(vi.mocked(keyCreateServiceAccountCall)).toHaveBeenCalled();
+      });
+      expect(vi.mocked(keyCreateCall)).not.toHaveBeenCalled();
+      const payload = vi.mocked(keyCreateServiceAccountCall).mock.calls[0][1] as Record<string, unknown>;
+      expect(JSON.parse(String(payload.metadata))).toStrictEqual({ service_account_id: "svc-account-1" });
+      expect(payload).not.toHaveProperty("user_id");
     });
-    expect(mockKeyCreateCall.mock.calls[0][2]).toMatchObject({ duration: "45d" });
   });
 
-  it("preserves a value typed in a section that is collapsed and reopened before submit", async () => {
-    await openModal();
+  describe("required field validation", () => {
+    it("blocks the submit and marks the alias invalid when it is blank", async () => {
+      await openModal();
+      await submit();
 
-    await userEvent.type(screen.getByLabelText(/Key Name/), "probe-key");
-    await userEvent.click(screen.getByText("Optional Settings"));
-
-    const maxBudget = await screen.findByLabelText(/Max Budget/);
-    await userEvent.type(maxBudget, "150.75");
-
-    await userEvent.click(screen.getByText("Optional Settings"));
-    await userEvent.click(screen.getByText("Optional Settings"));
-
-    expect(await screen.findByLabelText(/Max Budget/)).toHaveValue(150.75);
-
-    await userEvent.click(screen.getByRole("button", { name: /create key/i }));
-
-    await waitFor(() => {
-      expect(mockKeyCreateCall).toHaveBeenCalled();
+      await waitFor(() => {
+        expect(screen.getByLabelText(/Key Name/)).toHaveAttribute("aria-invalid", "true");
+      });
+      expect(vi.mocked(keyCreateCall)).not.toHaveBeenCalled();
+    });
+
+    it("suppresses the required message behind the always-visible help text", async () => {
+      await openModal();
+      await submit();
+
+      await waitFor(() => {
+        expect(screen.getByLabelText(/Key Name/)).toHaveAttribute("aria-invalid", "true");
+      });
+      expect(screen.queryByText("Please input a key name")).not.toBeInTheDocument();
+      expect(screen.getByText("required")).toBeInTheDocument();
+    });
+
+    it("blocks a service account submit until a team is chosen, then lets it through", async () => {
+      state.teams = [{ team_id: "team-1", team_alias: "Team One", models: [] }];
+      await openModal({ teams: state.teams as unknown as Team[] });
+      await userEvent.click(screen.getByRole("radio", { name: "Service Account" }));
+      await userEvent.type(await screen.findByLabelText(/Service Account ID/), "svc-account-1");
+      await submit();
+
+      await waitFor(() => {
+        expect(vi.mocked(keyCreateServiceAccountCall)).not.toHaveBeenCalled();
+      });
+
+      await userEvent.click(await screen.findByLabelText("Team"));
+      await userEvent.click(await screen.findByRole("option", { name: /Team One/ }));
+      await submit();
+
+      await waitFor(() => {
+        expect(vi.mocked(keyCreateServiceAccountCall)).toHaveBeenCalledTimes(1);
+      });
+    });
+
+    it("blocks the submit when the budget exceeds the team ceiling", async () => {
+      await openModal({ team: { team_id: "team-1", max_budget: 10 } as unknown as Team });
+      await nameTheKey();
+      await openSection(/Optional Settings/i);
+      await userEvent.type(await screen.findByLabelText(/Max Budget \(USD\)/), "50");
+      await submit();
+
+      await waitFor(() => {
+        expect(screen.getByLabelText(/Max Budget \(USD\)/)).toHaveAttribute("aria-invalid", "true");
+      });
+      expect(vi.mocked(keyCreateCall)).not.toHaveBeenCalled();
+    });
+  });
+
+  describe("deep link prefill", () => {
+    it("prefills the key alias", async () => {
+      renderCreateKey({ autoOpenCreate: true, prefillData: { key_alias: "prefilled-key" } });
+
+      expect(await screen.findByLabelText(/Key Name/)).toHaveValue("prefilled-key");
+    });
+
+    it("prefills models once the available model list arrives", async () => {
+      renderCreateKey({ autoOpenCreate: true, prefillData: { models: ["gpt-4"] } });
+
+      expect(await screen.findByTitle("gpt-4")).toBeInTheDocument();
+    });
+
+    it("ignores a team the user has no access to", async () => {
+      renderCreateKey({
+        teams: [{ team_id: "team-1", models: [] } as unknown as Team],
+        autoOpenCreate: true,
+        prefillData: { team_id: "team-404", key_alias: "example-key" },
+      });
+
+      await userEvent.type(await screen.findByLabelText(/Key Name/), "-suffix");
+      await submit();
+
+      const payload = await createdPayload();
+      expect(payload.team_id).toBeNull();
+      expect(payload.key_alias).toBe("example-key-suffix");
+    });
+
+    it("falls back to you when another_user is requested by a non-admin", async () => {
+      state.authorized = { ...state.authorized, userRole: "Internal User" };
+      renderCreateKey({ autoOpenCreate: true, prefillData: { owned_by: "another_user", key_alias: "example-key" } });
+
+      expect(await screen.findByRole("radio", { name: "You" })).toBeChecked();
+    });
+
+    it("applies another_user for an admin", async () => {
+      renderCreateKey({ autoOpenCreate: true, prefillData: { owned_by: "another_user" } });
+
+      expect(await screen.findByRole("radio", { name: "Another User" })).toBeChecked();
+    });
+
+    it("prefills the key type", async () => {
+      renderCreateKey({ autoOpenCreate: true, prefillData: { key_type: "management" } });
+
+      await screen.findByLabelText(/Key Name/);
+      await userEvent.type(await screen.findByLabelText(/Key Name/), "prefilled-type");
+      await submit();
+
+      expect((await createdPayload()).key_type).toBe("management");
+    });
+  });
+
+  describe("models dropdown team gating", () => {
+    it("offers all-proxy-models but not all-team-models when no team is selected", async () => {
+      await openModal();
+      await userEvent.click(await screen.findByLabelText("Models"));
+
+      expect(await screen.findByTitle("All Proxy Models")).toBeInTheDocument();
+      expect(screen.queryByTitle("All Team Models")).not.toBeInTheDocument();
+    });
+
+    it("offers all-team-models but hides all-proxy-models once a team is selected", async () => {
+      state.teams = [{ team_id: "team-1", team_alias: "Team One", models: ["team-model-1"] }];
+      await openModal({ teams: state.teams as unknown as Team[] });
+
+      await userEvent.click(await screen.findByLabelText("Team"));
+      await userEvent.click(await screen.findByRole("option", { name: /Team One/ }));
+
+      await userEvent.click(await screen.findByLabelText("Models"));
+
+      expect(await screen.findByTitle("All Team Models")).toBeInTheDocument();
+      expect(screen.queryByTitle("All Proxy Models")).not.toBeInTheDocument();
+    });
+  });
+
+  describe("organization dropdown", () => {
+    it("is editable for an admin", async () => {
+      state.organizations = [{ organization_id: "org-1", organization_alias: "Engineering" }];
+      await openModal();
+
+      expect(await screen.findByLabelText("Organization")).not.toHaveAttribute("data-disabled");
+    });
+
+    it("is read-only for a non-admin", async () => {
+      state.authorized = { ...state.authorized, userRole: "Internal User" };
+      state.organizations = [{ organization_id: "org-1", organization_alias: "Engineering" }];
+      await openModal();
+
+      expect(await screen.findByLabelText("Organization")).toHaveAttribute("data-disabled", "");
+    });
+
+    it("routes a chosen organization into organization_id", async () => {
+      state.organizations = [{ organization_id: "org-1", organization_alias: "Engineering" }];
+      await openModal();
+      await nameTheKey();
+
+      await userEvent.click(await screen.findByLabelText("Organization"));
+      await userEvent.click(await screen.findByRole("option", { name: /Engineering/ }));
+      await submit();
+
+      expect((await createdPayload()).organization_id).toBe("org-1");
+    });
+  });
+
+  describe("policy and prompt fields", () => {
+    it("loads and offers both selectors for a role that can see them", async () => {
+      await openModal();
+      await openSection(/Optional Settings/i);
+
+      expect(await screen.findByLabelText("Policies")).toBeInTheDocument();
+      expect(await screen.findByLabelText("Prompts")).toBeInTheDocument();
+    });
+
+    it("omits both selectors for a role that cannot see them", async () => {
+      state.can = { viewPolicies: false, viewPrompts: false };
+      await openModal();
+      await openSection(/Optional Settings/i);
+
+      await screen.findByLabelText("Guardrails");
+      expect(screen.queryByLabelText("Policies")).not.toBeInTheDocument();
+      expect(screen.queryByLabelText("Prompts")).not.toBeInTheDocument();
+    });
+  });
+
+  describe("tags dropdown", () => {
+    it("offers the tags returned by the tags hook", async () => {
+      state.tags = { production: { name: "production" }, staging: { name: "staging" } };
+      await openModal();
+      await openSection(/Optional Settings/i);
+
+      await userEvent.click(await screen.findByLabelText("Tags"));
+
+      expect(await screen.findByTitle("production")).toBeInTheDocument();
+      expect(await screen.findByTitle("staging")).toBeInTheDocument();
+    });
+  });
+
+  describe("user search debounce", () => {
+    it("fires exactly one search carrying the last typed value", async () => {
+      const user = userEvent.setup({ advanceTimers: vi.advanceTimersByTime });
+      vi.useFakeTimers({ shouldAdvanceTime: true });
+      try {
+        renderCreateKey({ autoOpenCreate: true, prefillData: { owned_by: "another_user" } });
+        const search = antdSearchInput(await screen.findByText("Type email to search for users"));
+
+        await user.type(search, "ali");
+        expect(vi.mocked(userFilterUICall)).not.toHaveBeenCalled();
+
+        await user.type(search, "ce");
+        await vi.advanceTimersByTimeAsync(400);
+
+        expect(vi.mocked(userFilterUICall)).toHaveBeenCalledTimes(1);
+        const params = vi.mocked(userFilterUICall).mock.calls[0][1] as URLSearchParams;
+        expect(params.get("user_email")).toBe("alice");
+      } finally {
+        vi.useRealTimers();
+      }
+    });
+  });
+
+  describe("created key display", () => {
+    it("surfaces the generated key after a successful create", async () => {
+      await openModal();
+      await nameTheKey();
+      await submit();
+      await createdPayload();
+
+      expect(await screen.findByText("Save your Key")).toBeInTheDocument();
+    });
+
+    it("rejects a duplicate alias within the same team without calling the API", async () => {
+      await openModal({ data: [{ team_id: null, key_alias: "contract-key" }] });
+      await nameTheKey();
+      await submit();
+
+      await waitFor(() => {
+        expect(screen.getByRole("button", { name: /^create key$/i })).toBeInTheDocument();
+      });
+      expect(vi.mocked(keyCreateCall)).not.toHaveBeenCalled();
+    });
+  });
+
+  describe("key type gating", () => {
+    it("labels the llm_api option AI APIs", async () => {
+      await openModal();
+      await userEvent.click(await screen.findByLabelText("Key Type"));
+
+      expect(
+        await screen.findByText("Can call only AI API routes (chat/completions, embeddings, etc.)"),
+      ).toBeInTheDocument();
+      expect(screen.queryByText("LLM API")).not.toBeInTheDocument();
+    });
+
+    it("clears and disables models when a management key type is chosen", async () => {
+      await openModal();
+      await nameTheKey();
+
+      await userEvent.click(await screen.findByLabelText("Key Type"));
+      await userEvent.click(await screen.findByText("Management"));
+      await submit();
+
+      const payload = await createdPayload();
+      expect(payload.key_type).toBe("management");
+      expect(payload.models).toStrictEqual([]);
+    });
+  });
+
+  describe("mount-gate liveness", () => {
+    it("keeps the MCP tool permissions key out of the payload even with its section open", async () => {
+      await openModal();
+      await nameTheKey();
+      await openSection(/Optional Settings/i);
+      await openSection(SECTIONS.mcp);
+      await submit();
+
+      const payload = await createdPayload();
+      expect(payload).not.toHaveProperty("mcp_tool_permissions");
+      expect(payload).toHaveProperty("allowed_mcp_servers_and_groups");
+    });
+
+    it("registers no Optional Settings field while a team choice is still required", async () => {
+      vi.mocked(modelAvailableCall).mockResolvedValue({ data: [{ id: "no-default-models" }] });
+      renderCreateKey();
+      await userEvent.click(screen.getByTestId("create-key-button"));
+
+      expect(await screen.findByText(/Please select a team to continue/)).toBeInTheDocument();
+      expect(screen.queryByLabelText(/Key Name/)).not.toBeInTheDocument();
+      expect(screen.queryByRole("button", { name: /Optional Settings/i })).not.toBeInTheDocument();
+    });
+  });
+
+  describe("writers outside the submit path", () => {
+    it("lets the selected user win over the search text typed into the same field", async () => {
+      vi.mocked(userFilterUICall).mockResolvedValue([
+        { user_id: "u-77", user_email: "alice@example.com" },
+      ] as unknown as Awaited<ReturnType<typeof userFilterUICall>>);
+
+      await openModal();
+      await userEvent.click(screen.getByRole("radio", { name: "Another User" }));
+      await nameTheKey();
+
+      await userEvent.type(antdSearchInput(await screen.findByText("Type email to search for users")), "alice");
+      await userEvent.click(await screen.findByText("alice@example.com (u-77)"));
+      await submit();
+
+      expect((await createdPayload()).user_id).toBe("u-77");
+    });
+
+    it("surfaces the required message on a field that carries no help text", async () => {
+      await openModal();
+      await userEvent.click(screen.getByRole("radio", { name: "Another User" }));
+      await nameTheKey();
+      await submit();
+
+      expect(
+        await screen.findByText("Please input the user ID of the user you are assigning the key to"),
+      ).toBeInTheDocument();
+      expect(vi.mocked(keyCreateCall)).not.toHaveBeenCalled();
+    });
+  });
+
+  describe("validation follows the mounted set", () => {
+    it("submits an over-ceiling budget typed into a section the user closed again, omitting the key", async () => {
+      await openModal({ team: { team_id: "team-1", max_budget: 10 } as unknown as Team });
+      await nameTheKey();
+      await openSection(/Optional Settings/i);
+      await userEvent.type(await screen.findByLabelText(/Max Budget \(USD\)/), "50");
+      await openSection(/Optional Settings/i);
+      await submit();
+
+      const payload = await createdPayload();
+      expect(payload).not.toHaveProperty("max_budget");
+      expect(payload.key_alias).toBe("contract-key");
+    });
+  });
+
+  describe("submit gestures", () => {
+    it("creates the key when Enter is pressed inside a text field", async () => {
+      await openModal();
+      await userEvent.type(await screen.findByLabelText(/Key Name/), "enter-key{Enter}");
+
+      expect((await createdPayload()).key_alias).toBe("enter-key");
+    });
+  });
+
+  describe("switch coercion", () => {
+    it("sends enable_prompt_caching as a boolean once the switch is on", async () => {
+      await openModal();
+      await nameTheKey();
+      await openSection(/Optional Settings/i);
+      await userEvent.click(await screen.findByLabelText("Enable Prompt Caching"));
+      await submit();
+
+      expect((await createdPayload()).enable_prompt_caching).toBe(true);
     });
-    expect(mockKeyCreateCall.mock.calls[0][2]).toMatchObject({ max_budget: "150.75" });
   });
 });
diff --git a/ui/litellm-dashboard/src/components/organisms/create_key_button.test.tsx b/ui/litellm-dashboard/src/components/organisms/create_key_button.test.tsx
index 7c9eed62c89..e6bd6cddd38 100644
--- a/ui/litellm-dashboard/src/components/organisms/create_key_button.test.tsx
+++ b/ui/litellm-dashboard/src/components/organisms/create_key_button.test.tsx
@@ -1,891 +1,76 @@
-import { act, fireEvent, within } from "@testing-library/react";
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import { renderWithProviders, screen, waitFor } from "../../../tests/test-utils";
-import { Team } from "../key_team_helpers/key_list";
-import { getPoliciesList, getPromptsList, userFilterUICall } from "../networking";
-import CreateKey from "./create_key_button";
-
-const { formMock, setFieldsValueMock, radioGroupValueRef, formStateRef, mockKeyCreateCall, teamDropdownTeamsRef } =
-  vi.hoisted(() => {
-    const formStateRef = { current: {} as Record<string, any> };
-    const teamDropdownTeamsRef = { current: [] as Array<{ team_id: string; team_alias: string; models: string[] }> };
-    const mockKeyCreateCall = vi.fn().mockResolvedValue({
-      key: "test-api-key",
-      soft_budget: null,
-    });
-    const formMock = {
-      setFieldsValue: vi.fn((values: Record<string, any>) => {
-        Object.assign(formStateRef.current, values);
-      }),
-      setFieldValue: vi.fn((name: string, value: any) => {
-        formStateRef.current[name] = value;
-      }),
-      getFieldValue: vi.fn((name: string) => formStateRef.current[name]),
-      resetFields: vi.fn(() => {
-        formStateRef.current = {};
-      }),
-    };
-    const radioGroupValueRef = { current: null as string | null };
-    return {
-      formMock,
-      setFieldsValueMock: formMock.setFieldsValue,
-      radioGroupValueRef,
-      formStateRef,
-      mockKeyCreateCall,
-      teamDropdownTeamsRef,
-    };
-  });
-
-const defaultAuthorizedState = {
-  accessToken: "test-token",
-  userId: "test-user-id",
-  userRole: "Admin",
-  premiumUser: false,
-};
-
-let authorizedState = { ...defaultAuthorizedState };
-
-vi.mock("@/app/(dashboard)/hooks/useAuthorized", () => ({
-  default: () => authorizedState,
-}));
-
-vi.mock("@/app/(dashboard)/hooks/keys/useKeys", () => ({
-  keyKeys: {
-    lists: () => ["keys"],
-  },
-}));
-
-vi.mock("@ant-design/icons", () => ({
-  InfoCircleOutlined: () => null,
-}));
-
-vi.mock("react-copy-to-clipboard", () => ({
-  CopyToClipboard: ({ children }: { children: any }) => children,
-}));
-
-vi.mock("antd", () => {
-  const React = require("react");
-
-  const getValueFromEvent = (event: any) => {
-    if (event?.target) {
-      if (event.target.type === "checkbox") {
-        return event.target.checked;
-      }
-      return event.target.value;
-    }
-    return event;
-  };
-
-  const Form = ({
-    children,
-    onFinish,
-    ...props
-  }: {
-    children?: any;
-    onFinish?: (values: Record<string, any>) => void;
-  }) =>
-    React.createElement(
-      "form",
-      {
-        ...props,
-        onSubmit: (event: Event) => {
-          event.preventDefault();
-          onFinish?.({ ...formStateRef.current });
-        },
-      },
-      children,
-    );
-
-  Form.Item = ({ children, name }: { children?: any; name?: string }) => {
-    if (!name || !React.isValidElement(children)) {
-      return React.createElement(React.Fragment, null, children);
-    }
-
-    return React.cloneElement(children, {
-      value: formStateRef.current[name],
-      onChange: (event: any) => {
-        formStateRef.current[name] = getValueFromEvent(event);
-      },
-    });
-  };
-
-  Form.useForm = () => [formMock];
-
-  Form.useWatch = (name: string) => formStateRef.current[name];
-
-  const Select = ({
-    children,
-    onChange,
-    onSearch,
-    options,
-    ...props
-  }: {
-    children?: any;
-    onChange?: (value: string) => void;
-    onSearch?: (value: string) => void;
-    options?: Array<{ value: string; label: string }>;
-  }) => {
-    const select = React.createElement(
-      "select",
-      {
-        ...props,
-        onChange: (event: any) => onChange?.(event.target.value),
-      },
-      children,
-      options?.map((opt: any) => React.createElement("option", { key: opt.value, value: opt.value }, opt.label)),
-    );
-
-    if (!onSearch) {
-      return select;
-    }
-
-    return React.createElement(
-      React.Fragment,
-      null,
-      React.createElement("input", {
-        "data-testid": "select-search-input",
-        onChange: (event: React.ChangeEvent<HTMLInputElement>) => onSearch(event.target.value),
-      }),
-      select,
-    );
-  };
-
-  Select.Option = ({ children, ...props }: { children?: any }) => React.createElement("option", props, children);
-
-  const Input = (props: any) => React.createElement("input", props);
-  Input.Password = (props: any) => React.createElement("input", { ...props, type: "password" });
-  Input.TextArea = (props: any) => React.createElement("textarea", props);
-
-  const Modal = ({ children, open }: { children?: any; open?: boolean }) =>
-    open ? React.createElement("div", null, children) : null;
-
-  const Radio = ({ children, ...props }: { children?: any }) => React.createElement("div", props, children);
-
-  Radio.Group = ({ children, value }: { children?: any; value?: string }) => {
-    radioGroupValueRef.current = value ?? null;
-    return React.createElement("div", null, children);
-  };
-
-  const Switch = (props: any) => React.createElement("input", { ...props, type: "checkbox" });
-  const Tag = ({ children }: { children?: any }) => React.createElement("span", null, children);
-  const Tooltip = ({ children }: { children?: any }) => React.createElement(React.Fragment, null, children);
-
-  const Button = ({ children, htmlType, ...props }: { children?: any; htmlType?: string }) =>
-    React.createElement("button", { ...props, type: htmlType ?? props.type }, children);
-
-  const Typography = ({ children, ...props }: { children?: any }) => React.createElement("div", props, children);
-  Typography.Text = ({ children, ...props }: { children?: any }) => React.createElement("span", props, children);
-  Typography.Paragraph = ({ children, ...props }: { children?: any }) => React.createElement("p", props, children);
-  Typography.Title = ({ children, ...props }: { children?: any }) => React.createElement("h1", props, children);
-
-  return {
-    Button,
-    Form,
-    Input,
-    message: {
-      success: vi.fn(),
-      error: vi.fn(),
-      warning: vi.fn(),
-      info: vi.fn(),
-    },
-    Modal,
-    Radio,
-    Select,
-    Switch,
-    Tag,
-    Tooltip,
-    Typography,
-  };
-});
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { modelAvailableCall } from "../networking";
+import { fetchTeamModels, fetchUserModels } from "./create_key_button";
 
 vi.mock("../networking", () => ({
-  keyCreateCall: mockKeyCreateCall,
-  modelAvailableCall: vi.fn().mockResolvedValue({ data: [{ id: "gpt-4" }] }),
-  getGuardrailsList: vi.fn().mockResolvedValue({ guardrails: [] }),
-  getPoliciesList: vi.fn().mockResolvedValue({ policies: [] }),
-  getPromptsList: vi.fn().mockResolvedValue({ prompts: [] }),
-  proxyBaseUrl: "http://localhost:4000",
-  getPossibleUserRoles: vi.fn().mockResolvedValue({
-    Admin: { ui_label: "Admin" },
-    User: { ui_label: "User" },
-  }),
-  userFilterUICall: vi.fn().mockResolvedValue([]),
-  keyCreateServiceAccountCall: vi.fn().mockResolvedValue({
-    key: "test-service-account-key",
-    soft_budget: null,
-  }),
-  fetchMCPAccessGroups: vi.fn().mockResolvedValue([]),
-  getAgentsList: vi.fn().mockResolvedValue({ agents: [] }),
+  modelAvailableCall: vi.fn(),
 }));
 
-vi.mock("../agent_management/AgentSelector", () => ({ default: () => null }));
-vi.mock("../common_components/budget_duration_dropdown", () => ({
-  NEVER_RESETS_BUDGET_DURATION: "none",
-  default: ({
-    showNeverResets,
-    placeholder,
-    onChange,
-  }: {
-    showNeverResets?: boolean;
-    placeholder?: string;
-    onChange?: (value: string) => void;
-  }) => (
-    <select data-testid="budget-duration-dropdown" onChange={(event) => onChange?.(event.target.value)}>
-      <option value="">{placeholder ?? "n/a"}</option>
-      {showNeverResets ? <option value="none">Never resets</option> : null}
-      <option value="30d">monthly</option>
-    </select>
-  ),
-}));
-vi.mock("../common_components/check_openapi_schema", () => ({ default: () => null }));
-vi.mock("../common_components/KeyLifecycleSettings", () => ({ default: () => null }));
-vi.mock("../common_components/ModelAliasManager", () => ({ default: () => null }));
-vi.mock("../common_components/PassThroughRoutesSelector", () => ({ default: () => null }));
-vi.mock("../common_components/PremiumLoggingSettings", () => ({ default: () => null }));
-vi.mock("../common_components/RateLimitTypeFormItem", () => ({ default: () => null }));
-vi.mock("../common_components/RouterSettingsAccordion", () => ({ default: () => null }));
-vi.mock("@/app/(dashboard)/hooks/teams/useTeams", () => ({
-  useInfiniteTeams: () => ({
-    data: {
-      pages: [
-        {
-          teams: [
-            { team_id: "team-1", team_alias: "Team One" },
-            { team_id: "team-2", team_alias: "Team Two" },
-          ],
-          total: 2,
-          page: 1,
-          page_size: 50,
-          total_pages: 1,
-        },
-      ],
-    },
-    fetchNextPage: vi.fn(),
-    hasNextPage: false,
-    isFetchingNextPage: false,
-    isLoading: false,
-  }),
-}));
-vi.mock("../common_components/team_dropdown", () => ({
-  default: ({
-    onTeamSelect,
-    disabled,
-  }: {
-    onTeamSelect?: (team: { team_id: string; team_alias: string; models: string[] } | null) => void;
-    disabled?: boolean;
-  }) => (
-    <select
-      data-testid="team-dropdown"
-      disabled={disabled}
-      onChange={(e) =>
-        onTeamSelect?.(teamDropdownTeamsRef.current.find((team) => team.team_id === e.target.value) ?? null)
-      }
-    >
-      <option value="">Select team</option>
-      {teamDropdownTeamsRef.current.map((team) => (
-        <option key={team.team_id} value={team.team_id}>
-          {team.team_alias}
-        </option>
-      ))}
-    </select>
-  ),
-}));
-vi.mock("../CreateUserButton", () => ({ CreateUserButton: () => null }));
-vi.mock("../mcp_server_management/MCPServerSelector", () => ({ default: () => null }));
-vi.mock("../mcp_server_management/MCPToolPermissions", () => ({ default: () => null }));
-vi.mock("../shared/numerical_input", () => ({ default: () => null }));
-vi.mock("../vector_store_management/VectorStoreSelector", () => ({ default: () => null }));
-vi.mock("../key_team_helpers/fetch_available_models_team_key", async () => {
-  const actual = await vi.importActual("../key_team_helpers/fetch_available_models_team_key");
-  return {
-    ...actual,
-    getModelDisplayName: (model: string) => model,
-  };
-});
-
-vi.mock("@/app/(dashboard)/hooks/tags/useTags", () => ({
-  useTags: vi.fn().mockReturnValue({
-    data: [
-      { name: "production", description: "Prod tag", models: [], created_at: "2026-01-01", updated_at: "2026-01-01" },
-      { name: "staging", description: "Staging tag", models: [], created_at: "2026-01-01", updated_at: "2026-01-01" },
-    ],
-    isLoading: false,
-  }),
-}));
-
-vi.mock("@/app/(dashboard)/hooks/projects/useProjects", () => ({
-  useProjects: vi.fn().mockReturnValue({ data: [], isLoading: false }),
-}));
-
-vi.mock("@/app/(dashboard)/hooks/organizations/useOrganizations", () => ({
-  useOrganizations: vi.fn().mockReturnValue({
-    data: [
-      { organization_id: "org-1", organization_alias: "Engineering" },
-      { organization_id: "org-2", organization_alias: "Sales" },
-    ],
-    isLoading: false,
-  }),
-}));
-
-vi.mock("../common_components/OrganizationDropdown", () => ({
-  default: ({ value, onChange, disabled }: { value?: string; onChange?: (v: string) => void; disabled?: boolean }) => (
-    <select
-      data-testid="org-dropdown"
-      disabled={disabled}
-      value={value || ""}
-      onChange={(e) => onChange?.(e.target.value)}
-    >
-      <option value="">Select org</option>
-      <option value="org-1">Engineering</option>
-      <option value="org-2">Sales</option>
-    </select>
-  ),
-}));
-
-vi.mock("../common_components/ProjectDropdown", () => ({
-  default: ({ value, onChange }: { value?: string; onChange?: (v: string) => void }) => (
-    <input data-testid="project-dropdown" value={value || ""} onChange={(e) => onChange?.(e.target.value)} />
-  ),
-}));
-
-vi.mock("../common_components/AccessGroupSelector", () => ({
-  default: ({ value = [], onChange }: { value?: string[]; onChange?: (v: string[]) => void }) => (
-    <input
-      data-testid="access-group-selector"
-      value={Array.isArray(value) ? value.join(",") : ""}
-      onChange={(event) => onChange?.(event.target.value ? event.target.value.split(",").map((v) => v.trim()) : [])}
-    />
-  ),
-}));
-
-describe("CreateKey", () => {
-  const defaultProps = {
-    team: null,
-    teams: [],
-    data: [],
-    addKey: vi.fn(),
-  };
-
-  const openOptionalSettings = async () => {
-    const trigger = await screen.findByRole("button", { name: /optional settings/i });
-    act(() => {
-      fireEvent.click(trigger);
-    });
-  };
-
+describe("fetchTeamModels", () => {
   beforeEach(() => {
-    vi.clearAllMocks();
-    if (typeof window !== "undefined" && window.localStorage && typeof window.localStorage.clear === "function") {
-      window.localStorage.clear();
-    }
-    authorizedState = { ...defaultAuthorizedState };
-    radioGroupValueRef.current = null;
-    formStateRef.current = {};
-    teamDropdownTeamsRef.current = [
-      { team_id: "team-1", team_alias: "Team One", models: [] },
-      { team_id: "team-2", team_alias: "Team Two", models: [] },
-    ];
-    mockKeyCreateCall.mockResolvedValue({
-      key: "test-api-key",
-      soft_budget: null,
-    });
+    vi.mocked(modelAvailableCall).mockReset();
   });
 
-  it("should render the CreateKey component", () => {
-    renderWithProviders(<CreateKey {...defaultProps} />);
-    expect(screen.getByRole("button", { name: /create new key/i })).toBeInTheDocument();
+  it("asks the proxy for the team-scoped model list and returns the ids", async () => {
+    vi.mocked(modelAvailableCall).mockResolvedValue({ data: [{ id: "gpt-4" }, { id: "claude-opus-4" }] });
+
+    await expect(fetchTeamModels("user-1", "Admin", "token-1", "team-1")).resolves.toStrictEqual([
+      "gpt-4",
+      "claude-opus-4",
+    ]);
+    expect(modelAvailableCall).toHaveBeenCalledWith("token-1", "user-1", "Admin", true, "team-1", true);
   });
 
-  it("should display 'AI APIs' label for the llm_api key type option", async () => {
-    renderWithProviders(<CreateKey {...defaultProps} />);
+  it("passes a null team through rather than dropping the argument", async () => {
+    vi.mocked(modelAvailableCall).mockResolvedValue({ data: [] });
 
-    act(() => {
-      fireEvent.click(screen.getByRole("button", { name: /create new key/i }));
-    });
+    await fetchTeamModels("user-1", "Admin", "token-1", null);
 
-    await waitFor(() => {
-      expect(screen.getByText("AI APIs")).toBeInTheDocument();
-      expect(screen.queryByText("LLM API")).not.toBeInTheDocument();
-    });
+    expect(modelAvailableCall).toHaveBeenCalledWith("token-1", "user-1", "Admin", true, null, true);
   });
 
-  it("should include access_group_ids in keyCreateCall payload when access groups are selected", async () => {
-    renderWithProviders(<CreateKey {...defaultProps} />);
-
-    act(() => {
-      fireEvent.click(screen.getByRole("button", { name: /create new key/i }));
-    });
-
-    await openOptionalSettings();
-
-    await waitFor(() => {
-      expect(screen.getByTestId("access-group-selector")).toBeInTheDocument();
-    });
-
-    act(() => {
-      fireEvent.change(screen.getByTestId("access-group-selector"), { target: { value: "ag-1,ag-2" } });
-      formMock.setFieldValue("key_alias", "Test Key");
-    });
-
-    act(() => {
-      fireEvent.click(screen.getByRole("button", { name: /create key/i }));
-    });
-
-    await waitFor(() => {
-      expect(mockKeyCreateCall).toHaveBeenCalled();
-      const formValues = mockKeyCreateCall.mock.calls[0][2];
-      expect(formValues).toHaveProperty("access_group_ids");
-      expect(formValues.access_group_ids).toEqual(["ag-1", "ag-2"]);
-    });
+  it("returns an empty list and makes no call when the user id is null", async () => {
+    await expect(fetchTeamModels(null as unknown as string, "Admin", "token-1", "team-1")).resolves.toStrictEqual([]);
+    expect(modelAvailableCall).not.toHaveBeenCalled();
   });
 
-  it("should include mcp_toolsets in keyCreateCall payload when only toolsets are selected", async () => {
-    renderWithProviders(<CreateKey {...defaultProps} />);
+  it("swallows a failed lookup and returns an empty list", async () => {
+    vi.mocked(modelAvailableCall).mockRejectedValue(new Error("proxy down"));
 
-    act(() => {
-      fireEvent.click(screen.getByRole("button", { name: /create new key/i }));
-    });
-
-    await waitFor(() => {
-      expect(screen.getByRole("button", { name: /create key/i })).toBeInTheDocument();
-    });
-
-    act(() => {
-      formMock.setFieldValue("key_alias", "Test Key");
-      formMock.setFieldValue("allowed_mcp_servers_and_groups", {
-        servers: [],
-        accessGroups: [],
-        toolsets: ["ts-1"],
-      });
-    });
-
-    act(() => {
-      fireEvent.click(screen.getByRole("button", { name: /create key/i }));
-    });
-
-    await waitFor(() => {
-      expect(mockKeyCreateCall).toHaveBeenCalled();
-    });
-    expect(mockKeyCreateCall.mock.calls[0][2].object_permission?.mcp_toolsets).toEqual(["ts-1"]);
-  });
-
-  it("should prefill models when provided without team_id", async () => {
-    renderWithProviders(
-      <CreateKey
-        {...defaultProps}
-        autoOpenCreate={true}
-        prefillData={{
-          models: ["gpt-4"],
-        }}
-      />,
-    );
-
-    await waitFor(() => {
-      expect(setFieldsValueMock).toHaveBeenCalledWith({ models: ["gpt-4"] });
-    });
-  });
-
-  it("should prefill team_id when it exists in teams", async () => {
-    renderWithProviders(
-      <CreateKey
-        {...defaultProps}
-        teams={[{ team_id: "team-1", models: [] } as any]}
-        autoOpenCreate={true}
-        prefillData={{ team_id: "team-1" }}
-      />,
-    );
-
-    await waitFor(() => {
-      expect(setFieldsValueMock).toHaveBeenCalledWith({ team_id: "team-1" });
-    });
-  });
-
-  it("should ignore team_id when it does not exist in teams", async () => {
-    renderWithProviders(
-      <CreateKey
-        {...defaultProps}
-        teams={[{ team_id: "team-1", models: [] } as any]}
-        autoOpenCreate={true}
-        prefillData={{ team_id: "team-404", key_alias: "example-key" }}
-      />,
-    );
-
-    await waitFor(() => {
-      expect(setFieldsValueMock).toHaveBeenCalledWith({ key_alias: "example-key" });
-    });
-
-    expect(setFieldsValueMock).not.toHaveBeenCalledWith({ team_id: "team-404" });
-  });
-
-  it('should fall back to "you" when owned_by is another_user for non-admin', async () => {
-    authorizedState = { ...defaultAuthorizedState, userRole: "Internal User" };
-
-    renderWithProviders(
-      <CreateKey
-        {...defaultProps}
-        autoOpenCreate={true}
-        prefillData={{ owned_by: "another_user", key_alias: "example-key" }}
-      />,
-    );
-
-    await waitFor(() => {
-      expect(setFieldsValueMock).toHaveBeenCalledWith({ key_alias: "example-key" });
-    });
-
-    expect(radioGroupValueRef.current).toBe("you");
-  });
-
-  it("should apply owned_by another_user for admin", async () => {
-    renderWithProviders(
-      <CreateKey {...defaultProps} autoOpenCreate={true} prefillData={{ owned_by: "another_user" }} />,
-    );
-
-    await waitFor(() => {
-      expect(radioGroupValueRef.current).toBe("another_user");
-    });
-  });
-
-  it("should prefill key_type when provided", async () => {
-    renderWithProviders(<CreateKey {...defaultProps} autoOpenCreate={true} prefillData={{ key_type: "management" }} />);
-
-    await waitFor(() => {
-      expect(setFieldsValueMock).toHaveBeenCalledWith({ key_type: "management" });
-    });
-  });
-
-  describe("organization dropdown", () => {
-    it("should render the organization dropdown when modal is open", async () => {
-      renderWithProviders(<CreateKey {...defaultProps} />);
-
-      act(() => {
-        fireEvent.click(screen.getByRole("button", { name: /create new key/i }));
-      });
-
-      await waitFor(() => {
-        expect(screen.getByTestId("org-dropdown")).toBeInTheDocument();
-      });
-    });
-
-    it("should disable the organization dropdown for non-admin users", async () => {
-      authorizedState = { ...defaultAuthorizedState, userRole: "Internal User" };
-
-      renderWithProviders(<CreateKey {...defaultProps} />);
-
-      act(() => {
-        fireEvent.click(screen.getByRole("button", { name: /create new key/i }));
-      });
-
-      await waitFor(() => {
-        expect(screen.getByTestId("org-dropdown")).toBeDisabled();
-      });
-    });
-
-    it("should enable the organization dropdown for admin users", async () => {
-      authorizedState = { ...defaultAuthorizedState, userRole: "Admin" };
-
-      renderWithProviders(<CreateKey {...defaultProps} />);
-
-      act(() => {
-        fireEvent.click(screen.getByRole("button", { name: /create new key/i }));
-      });
-
-      await waitFor(() => {
-        expect(screen.getByTestId("org-dropdown")).toBeEnabled();
-      });
-    });
-
-    it("should render team dropdown alongside organization dropdown", async () => {
-      const teamsWithOrg = [{ team_id: "team-1", team_alias: "Team Alpha", organization_id: "org-1", models: [] }];
-
-      renderWithProviders(<CreateKey {...defaultProps} teams={teamsWithOrg as any} />);
-
-      act(() => {
-        fireEvent.click(screen.getByRole("button", { name: /create new key/i }));
-      });
-
-      await waitFor(() => {
-        expect(screen.getByTestId("org-dropdown")).toBeInTheDocument();
-        expect(screen.getByTestId("team-dropdown")).toBeInTheDocument();
-      });
-    });
-
-    it("should set organization_id in form state when org is selected", async () => {
-      renderWithProviders(<CreateKey {...defaultProps} />);
-
-      act(() => {
-        fireEvent.click(screen.getByRole("button", { name: /create new key/i }));
-      });
-
-      await waitFor(() => {
-        expect(screen.getByTestId("org-dropdown")).toBeInTheDocument();
-      });
-
-      act(() => {
-        fireEvent.change(screen.getByTestId("org-dropdown"), { target: { value: "org-1" } });
-      });
-
-      expect(formStateRef.current["organization_id"]).toBe("org-1");
-    });
-  });
-
-  describe("models dropdown team gating", () => {
-    const getModelsSelect = async (): Promise<HTMLElement> => {
-      return waitFor(() => {
-        const element = document.querySelector('select[placeholder="Select models"]');
-        expect(element).toBeTruthy();
-        return element as HTMLElement;
-      });
-    };
-
-    it("should offer all-proxy-models but not all-team-models when no team is selected", async () => {
-      renderWithProviders(<CreateKey {...defaultProps} />);
-
-      act(() => {
-        fireEvent.click(screen.getByRole("button", { name: /create new key/i }));
-      });
-
-      const modelsSelect = await getModelsSelect();
-
-      await waitFor(() => {
-        expect(within(modelsSelect).getByText("gpt-4")).toBeInTheDocument();
-      });
-
-      expect(within(modelsSelect).getByText("All Proxy Models")).toBeInTheDocument();
-      expect(within(modelsSelect).queryByText("All Team Models")).not.toBeInTheDocument();
-    });
-
-    it("should offer all-team-models but hide all-proxy-models when a team is selected", async () => {
-      teamDropdownTeamsRef.current = [
-        { team_id: "team-1", team_alias: "Team One", models: ["all-proxy-models", "team-model-1"] },
-      ];
-
-      renderWithProviders(<CreateKey {...defaultProps} teams={teamDropdownTeamsRef.current as unknown as Team[]} />);
-
-      act(() => {
-        fireEvent.click(screen.getByRole("button", { name: /create new key/i }));
-      });
-
-      await waitFor(() => {
-        expect(screen.getByTestId("team-dropdown")).toBeInTheDocument();
-      });
-
-      act(() => {
-        fireEvent.change(screen.getByTestId("team-dropdown"), { target: { value: "team-1" } });
-      });
-
-      const modelsSelect = await getModelsSelect();
-
-      await waitFor(() => {
-        expect(within(modelsSelect).getByText("team-model-1")).toBeInTheDocument();
-      });
-
-      expect(within(modelsSelect).getByText("All Team Models")).toBeInTheDocument();
-      expect(within(modelsSelect).queryByText("All Proxy Models")).not.toBeInTheDocument();
-      expect(within(modelsSelect).queryByText("all-proxy-models")).not.toBeInTheDocument();
-    });
-  });
-
-  describe("user search debounce", () => {
-    const mockUserFilterUICall = vi.mocked(userFilterUICall);
-
-    beforeEach(() => {
-      vi.useFakeTimers();
-    });
-
-    afterEach(() => {
-      vi.runOnlyPendingTimers();
-      vi.useRealTimers();
-    });
-
-    const renderUserSearch = () => {
-      const view = renderWithProviders(
-        <CreateKey {...defaultProps} autoOpenCreate={true} prefillData={{ owned_by: "another_user" }} />,
-      );
-      return { input: screen.getByTestId("select-search-input"), unmount: view.unmount };
-    };
-
-    it("should not fire the search before the wait elapses", () => {
-      const { input } = renderUserSearch();
-
-      act(() => {
-        fireEvent.change(input, { target: { value: "alice" } });
-      });
-
-      expect(mockUserFilterUICall).not.toHaveBeenCalled();
-
-      act(() => {
-        vi.advanceTimersByTime(299);
-      });
-
-      expect(mockUserFilterUICall).not.toHaveBeenCalled();
-    });
-
-    it("should fire exactly one search carrying the last value after the wait", async () => {
-      const { input } = renderUserSearch();
-
-      act(() => {
-        fireEvent.change(input, { target: { value: "a" } });
-        vi.advanceTimersByTime(100);
-        fireEvent.change(input, { target: { value: "al" } });
-        vi.advanceTimersByTime(100);
-        fireEvent.change(input, { target: { value: "alice" } });
-      });
-
-      expect(mockUserFilterUICall).not.toHaveBeenCalled();
-
-      await act(async () => {
-        vi.advanceTimersByTime(300);
-      });
-
-      expect(mockUserFilterUICall).toHaveBeenCalledTimes(1);
-      const params = mockUserFilterUICall.mock.calls[0][1] as URLSearchParams;
-      expect(params.get("user_email")).toBe("alice");
-    });
-
-    it("should fire nothing when unmounted mid-wait", () => {
-      const { input, unmount } = renderUserSearch();
-
-      act(() => {
-        fireEvent.change(input, { target: { value: "alice" } });
-      });
-
-      unmount();
-
-      act(() => {
-        vi.advanceTimersByTime(1000);
-      });
-
-      expect(mockUserFilterUICall).not.toHaveBeenCalled();
-    });
-  });
-
-  describe("tags dropdown", () => {
-    it("should populate tags dropdown with options from useTags hook", async () => {
-      renderWithProviders(<CreateKey {...defaultProps} />);
-
-      act(() => {
-        fireEvent.click(screen.getByRole("button", { name: /create new key/i }));
-      });
-
-      await openOptionalSettings();
-
-      await waitFor(() => {
-        expect(screen.getByText("production")).toBeInTheDocument();
-        expect(screen.getByText("staging")).toBeInTheDocument();
-      });
-    });
-  });
-
-  describe("policy and prompt fields", () => {
-    const POLICIES_PLACEHOLDER = "Premium feature - Upgrade to set policies by key";
-    const PROMPTS_PLACEHOLDER = "Premium feature - Upgrade to set prompts by key";
-
-    const openModal = async () => {
-      renderWithProviders(<CreateKey {...defaultProps} />);
-      act(() => {
-        fireEvent.click(screen.getByRole("button", { name: /create new key/i }));
-      });
-      await openOptionalSettings();
-    };
-
-    beforeEach(() => {
-      vi.mocked(getPoliciesList).mockResolvedValue({ policies: [{ policy_name: "policy-a" }] });
-      vi.mocked(getPromptsList).mockResolvedValue({ prompts: [{ prompt_id: "prompt-a" }] } as any);
-    });
-
-    it("should load and offer both selectors for an admin", async () => {
-      await openModal();
-
-      await waitFor(() => {
-        expect(screen.getByRole("option", { name: "policy-a" })).toBeInTheDocument();
-        expect(screen.getByRole("option", { name: "prompt-a" })).toBeInTheDocument();
-      });
-      expect(getPoliciesList).toHaveBeenCalledWith("test-token");
-      expect(getPromptsList).toHaveBeenCalledWith("test-token");
-      expect(screen.getByPlaceholderText(POLICIES_PLACEHOLDER)).toBeInTheDocument();
-      expect(screen.getByPlaceholderText(PROMPTS_PLACEHOLDER)).toBeInTheDocument();
-    });
-
-    it("should omit both selectors and fire neither admin-only request for an internal user", async () => {
-      authorizedState = { ...defaultAuthorizedState, userRole: "Internal User" };
-
-      await openModal();
-
-      expect(await screen.findByTestId("org-dropdown")).toBeInTheDocument();
-
-      expect(getPoliciesList).not.toHaveBeenCalled();
-      expect(getPromptsList).not.toHaveBeenCalled();
-      expect(screen.queryByPlaceholderText(POLICIES_PLACEHOLDER)).not.toBeInTheDocument();
-      expect(screen.queryByPlaceholderText(PROMPTS_PLACEHOLDER)).not.toBeInTheDocument();
-    });
-  });
-
-  describe("budget reset", () => {
-    const openModal = async () => {
-      renderWithProviders(<CreateKey {...defaultProps} />);
-
-      act(() => {
-        fireEvent.click(screen.getByRole("button", { name: /create new key/i }));
-      });
-
-      await openOptionalSettings();
-
-      await waitFor(() => {
-        expect(screen.getByTestId("budget-duration-dropdown")).toBeInTheDocument();
-      });
-    };
-
-    const submit = async () => {
-      act(() => {
-        fireEvent.click(screen.getByRole("button", { name: /create key/i }));
-      });
-
-      await waitFor(() => {
-        expect(mockKeyCreateCall).toHaveBeenCalled();
-      });
-
-      return mockKeyCreateCall.mock.calls[0][2];
-    };
-
-    it("should send an explicit null budget_duration when 'Never resets' is selected", async () => {
-      await openModal();
-
-      expect(screen.getByRole("option", { name: "Never resets" })).toBeInTheDocument();
-
-      act(() => {
-        fireEvent.change(screen.getByTestId("budget-duration-dropdown"), { target: { value: "none" } });
-        formMock.setFieldValue("key_alias", "Never Resets Key");
-      });
-
-      const formValues = await submit();
-
-      expect("budget_duration" in formValues).toBe(true);
-      expect(formValues.budget_duration).toBeNull();
-    });
-
-    it("should label the omit option distinctly from 'Never resets'", async () => {
-      await openModal();
-
-      const optionLabels = Array.from(
-        screen.getByTestId("budget-duration-dropdown").querySelectorAll("option"),
-        (option) => option.textContent,
-      );
-
-      expect(optionLabels).toContain("Never resets");
-      expect(new Set(optionLabels).size).toBe(optionLabels.length);
-      expect(screen.getByRole("option", { name: "Never resets" })).toHaveValue("none");
-    });
-
-    it("should omit budget_duration entirely when the reset dropdown is untouched", async () => {
-      await openModal();
-
-      act(() => {
-        formMock.setFieldValue("key_alias", "Inherits Default Key");
-      });
-
-      const formValues = await submit();
-
-      expect("budget_duration" in formValues).toBe(false);
-    });
+    await expect(fetchTeamModels("user-1", "Admin", "token-1", "team-1")).resolves.toStrictEqual([]);
+  });
+});
+
+describe("fetchUserModels", () => {
+  beforeEach(() => {
+    vi.mocked(modelAvailableCall).mockReset();
+  });
+
+  it("hands the returned ids to the setter without the team-scoped arguments", async () => {
+    vi.mocked(modelAvailableCall).mockResolvedValue({ data: [{ id: "gpt-4" }] });
+    const setUserModels = vi.fn();
+
+    await fetchUserModels("user-1", "Admin", "token-1", setUserModels);
+
+    expect(modelAvailableCall).toHaveBeenCalledWith("token-1", "user-1", "Admin");
+    expect(setUserModels).toHaveBeenCalledWith(["gpt-4"]);
+  });
+
+  it("leaves the setter untouched when the lookup fails", async () => {
+    vi.mocked(modelAvailableCall).mockRejectedValue(new Error("proxy down"));
+    const setUserModels = vi.fn();
+
+    await fetchUserModels("user-1", "Admin", "token-1", setUserModels);
+
+    expect(setUserModels).not.toHaveBeenCalled();
+  });
+
+  it("makes no call when the user role is null", async () => {
+    const setUserModels = vi.fn();
+
+    await fetchUserModels("user-1", null as unknown as string, "token-1", setUserModels);
+
+    expect(modelAvailableCall).not.toHaveBeenCalled();
+    expect(setUserModels).not.toHaveBeenCalled();
   });
 });
diff --git a/ui/litellm-dashboard/src/components/organisms/create_key_button.tsx b/ui/litellm-dashboard/src/components/organisms/create_key_button.tsx
index 9bb5ed51bfa..ad7869202dc 100644
--- a/ui/litellm-dashboard/src/components/organisms/create_key_button.tsx
+++ b/ui/litellm-dashboard/src/components/organisms/create_key_button.tsx
@@ -12,30 +12,27 @@ import { useQueryClient } from "@tanstack/react-query";
 import { Button } from "@/components/ui/button";
 import { Collapsible, CollapsibleContent, CollapsibleTrigger } from "@/components/ui/collapsible";
 import { Input } from "@/components/ui/input";
-import {
-  Button as Button2,
-  Form,
-  Input as AntdInput,
-  Modal,
-  Radio,
-  Select,
-  Switch,
-  Tag,
-  Tooltip,
-  Typography,
-} from "antd";
+import { Field, FieldLabel } from "@/components/shared/form/field";
+import { Button as Button2, Input as AntdInput, Modal, Radio, Select, Switch, Tag, Tooltip, Typography } from "antd";
 import { ChevronDown } from "lucide-react";
 import { useDebouncedCallback } from "@tanstack/react-pacer/debouncer";
 import { DEBOUNCE_WAIT_MS } from "@/utils/debounceConstants";
-import React, { useEffect, useState } from "react";
+import React, { useEffect, useMemo, useState } from "react";
+import { type Control, useForm, useWatch, type UseFormSetValue } from "react-hook-form";
 import { rolesWithWriteAccess } from "../../utils/roles";
 import AgentSelector from "../agent_management/AgentSelector";
-import { mapDisplayToInternalNames } from "../callback_info_helpers";
 import AccessGroupSelector from "../common_components/AccessGroupSelector";
-import BudgetDurationDropdown, { NEVER_RESETS_BUDGET_DURATION } from "../common_components/budget_duration_dropdown";
+import BudgetDurationDropdown from "../common_components/budget_duration_dropdown";
 import SchemaFormFields from "../common_components/check_openapi_schema";
 import KeyLifecycleSettings from "../common_components/KeyLifecycleSettings";
 import ModelAliasManager from "../common_components/ModelAliasManager";
+import {
+  MountedFormField,
+  MountedFormProvider,
+  projectMountedValues,
+  useMountRegistry,
+  type MountedFormValues,
+} from "../common_components/MountedFormField";
 import PassThroughRoutesSelector from "../common_components/PassThroughRoutesSelector";
 import PremiumLoggingSettings from "../common_components/PremiumLoggingSettings";
 import RateLimitTypeFormItem from "../common_components/RateLimitTypeFormItem";
@@ -46,7 +43,7 @@ import ProjectDropdown from "../common_components/ProjectDropdown";
 import { CreateUserButton } from "../CreateUserButton";
 import { BudgetFallbacksEditor } from "../key_team_helpers/BudgetFallbacksEditor";
 import { BudgetWindowEntry, BudgetWindowsEditor } from "../key_team_helpers/BudgetWindowsEditor";
-import { TagRateLimitEditor, TagRateLimitEntry, tagRowsToLimits } from "../key_team_helpers/TagRateLimitEditor";
+import { TagRateLimitEditor, TagRateLimitEntry } from "../key_team_helpers/TagRateLimitEditor";
 import {
   excludeProxyWideSentinel,
   getModelDisplayName,
@@ -72,13 +69,53 @@ import {
 import CreatedKeyDisplay from "../shared/CreatedKeyDisplay";
 import NumericalInput from "../shared/numerical_input";
 import VectorStoreSelector from "../vector_store_management/VectorStoreSelector";
+import { buildKeyCreatePayload, type KeyCreateInput } from "./createKeyPayload";
 import { simplifyKeyGenerateError } from "./utils";
 
 const { Option } = Select;
 
 const SECTION_HEADER_CLASS = "group/section flex w-full items-center justify-between px-4 py-3 text-left";
 const SECTION_CHEVRON_CLASS =
-  "size-5 shrink-0 text-gray-500 transition-transform group-data-[panel-open]/section:rotate-180";
+  "size-5 shrink-0 text-muted-foreground transition-transform group-data-[panel-open]/section:rotate-180";
+
+type FieldWrite = (value: unknown) => void;
+
+type McpSelectorValue = { servers: string[]; accessGroups: string[]; toolsets?: string[] };
+
+type AgentSelectorValue = { agents: string[]; accessGroups: string[] };
+
+const isBlank = (value: unknown): boolean => value === undefined || value === null || value === "";
+
+const requiredRule = (required: boolean, message: string) => ({
+  validate: (value: unknown) => (required && isBlank(value) ? message : true),
+});
+
+const ceilingRule = (ceiling: number | null | undefined, message: (limit: number) => string) => ({
+  validate: (value: unknown) =>
+    value && ceiling !== null && ceiling !== undefined && (value as number) > ceiling ? message(ceiling) : true,
+});
+
+interface McpToolPermissionsFieldProps {
+  readonly accessToken: string;
+  readonly control: Control<MountedFormValues>;
+  readonly setValue: UseFormSetValue<MountedFormValues>;
+}
+
+const McpToolPermissionsField: React.FC<McpToolPermissionsFieldProps> = ({ accessToken, control, setValue }) => {
+  const selection = useWatch({ control, name: "allowed_mcp_servers_and_groups" }) as { servers?: string[] } | undefined;
+  const toolPermissions = useWatch({ control, name: "mcp_tool_permissions" }) as Record<string, string[]> | undefined;
+
+  return (
+    <div className="mt-6">
+      <MCPToolPermissions
+        accessToken={accessToken}
+        selectedServers={(selection?.servers || []).filter((s: string) => s !== NO_MCP_SERVERS_SENTINEL)}
+        toolPermissions={toolPermissions || {}}
+        onChange={(toolPerms) => setValue("mcp_tool_permissions", toolPerms)}
+      />
+    </div>
+  );
+};
 
 /**
  * Interface for pre-filling the create key form from URL parameters
@@ -176,7 +213,21 @@ const CreateKey: React.FC<CreateKeyProps> = ({ team, teams, data, addKey, autoOp
   const disableCustomApiKeys = Boolean(uiSettingsData?.values?.disable_custom_api_keys);
   const tagOptions = tagsData ? Object.values(tagsData).map((tag) => ({ value: tag.name, label: tag.name })) : [];
   const queryClient = useQueryClient();
-  const [form] = Form.useForm();
+  const [formDefaults] = useState<MountedFormValues>(() => ({
+    team_id: team ? team.team_id : null,
+    key_type: "llm_api",
+    tpm_limit_type: null,
+    rpm_limit_type: null,
+    mcp_tool_permissions: {},
+    duration: "",
+  }));
+  const form = useForm<MountedFormValues>({
+    mode: "onChange",
+    shouldUnregister: false,
+    defaultValues: formDefaults,
+  });
+  const registry = useMountRegistry();
+  const mountedForm = useMemo(() => ({ control: form.control, registry }), [form.control, registry]);
   const [isModalVisible, setIsModalVisible] = useState(false);
   const [apiKey, setApiKey] = useState(null);
   const [userModels, setUserModels] = useState<string[]>([]);
@@ -208,10 +259,10 @@ const CreateKey: React.FC<CreateKeyProps> = ({ team, teams, data, addKey, autoOp
   const [routerSettingsKey, setRouterSettingsKey] = useState<number>(0);
   const [agentsList, setAgentsList] = useState<{ agent_id: string; agent_name: string }[]>([]);
   const [selectedAgentId, setSelectedAgentId] = useState<string | null>(null);
-  const selectedModels: string[] = Form.useWatch("models", form) ?? [];
+  const selectedModels: string[] = (useWatch({ control: form.control, name: "models" }) as string[] | undefined) ?? [];
   const handleOk = () => {
     setIsModalVisible(false);
-    form.resetFields();
+    form.reset(formDefaults);
     setLoggingSettings([]);
     setDisabledCallbacks([]);
     setKeyType("llm_api");
@@ -233,7 +284,7 @@ const CreateKey: React.FC<CreateKeyProps> = ({ team, teams, data, addKey, autoOp
     setIsModalVisible(false);
     setApiKey(null);
     setSelectedCreateKeyTeam(null);
-    form.resetFields();
+    form.reset(formDefaults);
     setLoggingSettings([]);
     setDisabledCallbacks([]);
     setKeyType("llm_api");
@@ -348,14 +399,14 @@ const CreateKey: React.FC<CreateKeyProps> = ({ team, teams, data, addKey, autoOp
           const selectedTeam = teams?.find((t) => t.team_id === prefillData.team_id) || null;
           if (selectedTeam) {
             setSelectedCreateKeyTeam(selectedTeam);
-            form.setFieldsValue({ team_id: prefillData.team_id });
+            form.setValue("team_id", prefillData.team_id);
           }
           // Silently ignore invalid team_id - don't prefill with a team user doesn't have access to
         }
 
         // Set key alias
         if (prefillData.key_alias) {
-          form.setFieldsValue({ key_alias: prefillData.key_alias });
+          form.setValue("key_alias", prefillData.key_alias);
         }
 
         // Defer model selection until we load the allowed model list.
@@ -366,7 +417,7 @@ const CreateKey: React.FC<CreateKeyProps> = ({ team, teams, data, addKey, autoOp
         // Set key type
         if (prefillData.key_type) {
           setKeyType(prefillData.key_type);
-          form.setFieldsValue({ key_type: prefillData.key_type });
+          form.setValue("key_type", prefillData.key_type);
         }
       }
     }
@@ -376,200 +427,44 @@ const CreateKey: React.FC<CreateKeyProps> = ({ team, teams, data, addKey, autoOp
   const isTeamSelectionRequired = modelsToPick.includes("no-default-models");
   const isFormDisabled = isTeamSelectionRequired && !selectedCreateKeyTeam;
 
-  const handleCreate = async (formValues: Record<string, any>) => {
+  const handleCreate = async (formValues: MountedFormValues) => {
     try {
-      const newKeyAlias = formValues?.key_alias ?? "";
-      const newKeyTeamId = formValues?.team_id ?? null;
-
-      const existingKeyAliases = data?.filter((k) => k.team_id === newKeyTeamId).map((k) => k.key_alias) ?? [];
-
-      if (existingKeyAliases.includes(newKeyAlias)) {
+      const input: KeyCreateInput = {
+        formValues,
+        existingKeys: data,
+        keyOwner,
+        userID,
+        selectedAgentId,
+        loggingSettings,
+        disabledCallbacks,
+        autoRotationEnabled,
+        rotationInterval,
+        modelAliases,
+        routerSettings,
+        budgetLimits,
+        tagRateLimits,
+        budgetFallbacks,
+      };
+      const built = buildKeyCreatePayload(input);
+      if (built.kind === "duplicate_alias") {
         throw new Error(
-          `Key alias ${newKeyAlias} already exists for team with ID ${newKeyTeamId}, please provide another key alias`,
+          `Key alias ${built.alias} already exists for team with ID ${built.teamId}, please provide another key alias`,
         );
       }
 
       toast.info("Making API Call");
       setIsModalVisible(true);
 
-      if (keyOwner === "you") {
-        formValues.user_id = userID;
-      } else if (keyOwner === "agent") {
-        if (!selectedAgentId) {
-          toast.fromError("Please select an agent");
-          return;
-        }
-        formValues.agent_id = selectedAgentId;
+      if (built.kind === "agent_not_selected") {
+        toast.fromError("Please select an agent");
+        return;
       }
+      const { payload, endpoint } = built;
 
-      // Handle metadata for all key types
-      let metadata: Record<string, any> = {};
-      try {
-        metadata = JSON.parse(formValues.metadata || "{}");
-      } catch (error) {
-        console.error("Error parsing metadata:", error);
-      }
-
-      // If it's a service account, add the service_account_id to the metadata
-      if (keyOwner === "service_account") {
-        metadata["service_account_id"] = formValues.key_alias;
-      }
-
-      // Add logging settings to the metadata
-      if (loggingSettings.length > 0) {
-        metadata = {
-          ...metadata,
-          logging: loggingSettings.filter((config) => config.callback_name),
-        };
-      }
-
-      // Add disabled callbacks to the metadata
-      if (disabledCallbacks.length > 0) {
-        // Map display names to internal callback values
-        const mappedDisabledCallbacks = mapDisplayToInternalNames(disabledCallbacks);
-        metadata = {
-          ...metadata,
-          litellm_disabled_callbacks: mappedDisabledCallbacks,
-        };
-      }
-
-      // Add auto-rotation settings as top-level fields
-      if (autoRotationEnabled) {
-        formValues.auto_rotate = true;
-        formValues.rotation_interval = rotationInterval;
-      }
-
-      // Handle duration field for key expiry - convert empty string to null
-      if (!formValues.duration || formValues.duration.trim() === "") {
-        formValues.duration = null;
-      }
-
-      // Update the formValues with the final metadata
-      formValues.metadata = JSON.stringify(metadata);
-
-      // disable_global_guardrails is premium-gated server-side; only send it when enabled
-      // so non-premium key creation isn't blocked by that gate.
-      if (!formValues.disable_global_guardrails) {
-        delete formValues.disable_global_guardrails;
-      }
-
-      // Transform allowed_vector_store_ids and allowed_mcp_servers_and_groups into object_permission format
-      if (formValues.allowed_vector_store_ids && formValues.allowed_vector_store_ids.length > 0) {
-        formValues.object_permission = {
-          vector_stores: formValues.allowed_vector_store_ids,
-        };
-        // Remove the original field as it's now part of object_permission
-        delete formValues.allowed_vector_store_ids;
-      }
-
-      // Transform allowed_mcp_servers_and_groups into object_permission format
-      if (
-        formValues.allowed_mcp_servers_and_groups &&
-        (formValues.allowed_mcp_servers_and_groups.servers?.length > 0 ||
-          formValues.allowed_mcp_servers_and_groups.accessGroups?.length > 0 ||
-          formValues.allowed_mcp_servers_and_groups.toolsets?.length > 0)
-      ) {
-        if (!formValues.object_permission) {
-          formValues.object_permission = {};
-        }
-        const { servers, accessGroups, toolsets } = formValues.allowed_mcp_servers_and_groups;
-        if (servers && servers.length > 0) {
-          formValues.object_permission.mcp_servers = servers;
-        }
-        if (accessGroups && accessGroups.length > 0) {
-          formValues.object_permission.mcp_access_groups = accessGroups;
-        }
-        if (toolsets && toolsets.length > 0) {
-          formValues.object_permission.mcp_toolsets = toolsets;
-        }
-        // Remove the original field as it's now part of object_permission
-        delete formValues.allowed_mcp_servers_and_groups;
-      }
-
-      // Add MCP tool permissions to object_permission
-      const mcpToolPermissions = formValues.mcp_tool_permissions || {};
-      if (Object.keys(mcpToolPermissions).length > 0) {
-        if (!formValues.object_permission) {
-          formValues.object_permission = {};
-        }
-        formValues.object_permission.mcp_tool_permissions = mcpToolPermissions;
-      }
-      delete formValues.mcp_tool_permissions;
-
-      // Transform allowed_mcp_access_groups into object_permission format
-      if (formValues.allowed_mcp_access_groups && formValues.allowed_mcp_access_groups.length > 0) {
-        if (!formValues.object_permission) {
-          formValues.object_permission = {};
-        }
-        formValues.object_permission.mcp_access_groups = formValues.allowed_mcp_access_groups;
-        // Remove the original field as it's now part of object_permission
-        delete formValues.allowed_mcp_access_groups;
-      }
-
-      // Transform allowed_agents_and_groups into object_permission format
-      if (
-        formValues.allowed_agents_and_groups &&
-        (formValues.allowed_agents_and_groups.agents?.length > 0 ||
-          formValues.allowed_agents_and_groups.accessGroups?.length > 0)
-      ) {
-        if (!formValues.object_permission) {
-          formValues.object_permission = {};
-        }
-        const { agents, accessGroups } = formValues.allowed_agents_and_groups;
-        if (agents && agents.length > 0) {
-          formValues.object_permission.agents = agents;
-        }
-        if (accessGroups && accessGroups.length > 0) {
-          formValues.object_permission.agent_access_groups = accessGroups;
-        }
-        // Remove the original field as it's now part of object_permission
-        delete formValues.allowed_agents_and_groups;
-      }
-
-      // Add model_aliases if any are defined
-      if (Object.keys(modelAliases).length > 0) {
-        formValues.aliases = JSON.stringify(modelAliases);
-      }
-
-      // Add router_settings if any are defined
-      if (routerSettings?.router_settings) {
-        // Only include router_settings if it has at least one non-null value
-        const hasValues = Object.values(routerSettings.router_settings).some(
-          (value) => value !== null && value !== undefined && value !== "",
-        );
-        if (hasValues) {
-          formValues.router_settings = routerSettings.router_settings;
-        }
-      }
-
-      // Add multi-window budget limits (filter out incomplete entries)
-      const validWindows = budgetLimits.filter(
-        (w) => w.budget_duration && w.max_budget !== null && w.max_budget !== undefined,
-      );
-      if (validWindows.length > 0) {
-        formValues.budget_limits = validWindows;
-      }
-
-      // Add per-tag rate limits (only when at least one row is configured)
-      const { tag_rpm_limit } = tagRowsToLimits(tagRateLimits);
-      if (Object.keys(tag_rpm_limit).length > 0) {
-        formValues.tag_rpm_limit = tag_rpm_limit;
-      }
-
-      if (Object.keys(budgetFallbacks).length > 0) {
-        formValues.budget_fallbacks = budgetFallbacks;
-      }
-
-      if (formValues.budget_duration === NEVER_RESETS_BUDGET_DURATION) {
-        formValues.budget_duration = null;
-      }
-
-      let response;
-      if (keyOwner === "service_account") {
-        response = await keyCreateServiceAccountCall(accessToken, formValues);
-      } else {
-        response = await keyCreateCall(accessToken, userID, formValues);
-      }
+      const response =
+        endpoint === "service_account"
+          ? await keyCreateServiceAccountCall(accessToken, payload)
+          : await keyCreateCall(accessToken, userID, payload);
 
       // Add the data to the state in the parent component
       // Also directly update the keys list in VirtualKeysTable without an API call
@@ -581,7 +476,7 @@ const CreateKey: React.FC<CreateKeyProps> = ({ team, teams, data, addKey, autoOp
 
       setApiKey(response["key"]);
       toast.success("Virtual Key Created");
-      form.resetFields();
+      form.reset(formDefaults);
       setBudgetLimits([]);
       setTagRateLimits([]);
       setBudgetFallbacks({});
@@ -593,6 +488,8 @@ const CreateKey: React.FC<CreateKeyProps> = ({ team, teams, data, addKey, autoOp
     }
   };
 
+  const handleSubmit = form.handleSubmit(() => handleCreate(projectMountedValues(registry, form.getValues)));
+
   // Fetch available models when team or auth changes.
   // Note: Model prefill from URL params is handled by the useEffect below, which
   // watches for pendingPrefillModels + modelsToPick to both be populated.
@@ -602,7 +499,7 @@ const CreateKey: React.FC<CreateKeyProps> = ({ team, teams, data, addKey, autoOp
       const project = projects?.find((p) => p.project_id === selectedProjectId);
       const projectModels = project?.models ?? [];
       setModelsToPick(projectModels);
-      form.setFieldValue("models", []);
+      form.setValue("models", []);
       return;
     }
     if (userID && userRole && accessToken) {
@@ -615,10 +512,10 @@ const CreateKey: React.FC<CreateKeyProps> = ({ team, teams, data, addKey, autoOp
     }
     // Only clear models if we don't have pending prefill models
     if (!pendingPrefillModels) {
-      form.setFieldValue("models", []);
+      form.setValue("models", []);
     }
     // Clear MCP server selection when team changes (available servers may differ)
-    form.setFieldValue("allowed_mcp_servers_and_groups", { servers: [], accessGroups: [] });
+    form.setValue("allowed_mcp_servers_and_groups", { servers: [], accessGroups: [] });
   }, [selectedCreateKeyTeam, selectedProjectId, accessToken, userID, userRole, form]);
 
   // Apply deferred model prefill once the available model list arrives.
@@ -633,7 +530,7 @@ const CreateKey: React.FC<CreateKeyProps> = ({ team, teams, data, addKey, autoOp
 
     const validModels = pendingPrefillModels.filter((model) => modelsToPick.includes(model));
     if (validModels.length > 0) {
-      form.setFieldsValue({ models: validModels });
+      form.setValue("models", validModels);
     }
     setPendingPrefillModels(null);
   }, [pendingPrefillModels, modelsToPick, form]);
@@ -648,13 +545,13 @@ const CreateKey: React.FC<CreateKeyProps> = ({ team, teams, data, addKey, autoOp
     const projectTeam = teams.find((t) => t.team_id === project.team_id) || null;
     if (projectTeam) {
       setSelectedCreateKeyTeam(projectTeam);
-      form.setFieldValue("team_id", projectTeam.team_id);
+      form.setValue("team_id", projectTeam.team_id);
     }
   }, [teams, selectedProjectId, projects]);
 
   // Add a callback function to handle user creation
   const handleUserCreated = (userId: string) => {
-    form.setFieldsValue({ user_id: userId });
+    form.setValue("user_id", userId);
     setIsCreateUserModalVisible(false);
   };
 
@@ -693,9 +590,51 @@ const CreateKey: React.FC<CreateKeyProps> = ({ team, teams, data, addKey, autoOp
 
   const handleUserSelect = (_value: string, option: UserOption): void => {
     const selectedUser = option.user;
-    form.setFieldsValue({
-      user_id: selectedUser.user_id,
-    });
+    form.setValue("user_id", selectedUser.user_id);
+  };
+
+  const changeOrganization = (write: FieldWrite) => (orgId: string) => {
+    write(orgId);
+    setSelectedOrganizationId(orgId || null);
+    // Clear team and project when org changes
+    setSelectedCreateKeyTeam(null);
+    setSelectedProjectId(null);
+    form.setValue("team_id", undefined);
+    form.setValue("project_id", undefined);
+  };
+
+  const selectTeam = (team: Team | null) => {
+    setSelectedCreateKeyTeam(team);
+    setSelectedProjectId(null);
+    form.setValue("project_id", undefined);
+    // Auto-populate org from team for non-admin users
+    if (team?.organization_id) {
+      setSelectedOrganizationId(team.organization_id);
+      form.setValue("organization_id", team.organization_id);
+    } else if (!team) {
+      setSelectedOrganizationId(null);
+      form.setValue("organization_id", undefined);
+    }
+  };
+
+  const changeProject = (write: FieldWrite) => (projectId: string) => {
+    write(projectId);
+    if (!projectId) {
+      setSelectedProjectId(null);
+      setSelectedCreateKeyTeam(null);
+      form.setValue("team_id", undefined);
+      return;
+    }
+    setSelectedProjectId(projectId);
+  };
+
+  const changeKeyType = (write: FieldWrite) => (value: string) => {
+    write(value);
+    setKeyType(value);
+    // Clear models field and disable if management or read_only
+    if (value === "management" || value === "read_only") {
+      form.setValue("models", []);
+    }
   };
 
   return (
@@ -706,1027 +645,1093 @@ const CreateKey: React.FC<CreateKeyProps> = ({ team, teams, data, addKey, autoOp
         </Button>
       )}
       <Modal open={isModalVisible} width={1000} footer={null} onOk={handleOk} onCancel={handleCancel}>
-        <Form form={form} onFinish={handleCreate} labelCol={{ span: 8 }} wrapperCol={{ span: 16 }} labelAlign="left">
-          {/* Section 1: Key Ownership */}
-          <div className="mb-8">
-            <h3 className="text-lg font-medium text-gray-900 mb-4">Key Ownership</h3>
-            <Form.Item
-              label={
-                <span>
-                  Owned By{" "}
-                  <Tooltip title="Select who will own this Virtual Key">
-                    <InfoCircleOutlined style={{ marginLeft: "4px" }} />
-                  </Tooltip>
-                </span>
-              }
-              className="mb-4"
-            >
-              <Radio.Group onChange={(e) => setKeyOwner(e.target.value)} value={keyOwner}>
-                <Radio value="you">You</Radio>
-                <Radio value="service_account">Service Account</Radio>
-                {userRole === "Admin" && <Radio value="another_user">Another User</Radio>}
-                <Radio value="agent">
-                  Agent <Tag color="purple">New</Tag>
-                </Radio>
-              </Radio.Group>
-            </Form.Item>
+        <MountedFormProvider value={mountedForm}>
+          <form onSubmit={handleSubmit}>
+            {/* Section 1: Key Ownership */}
+            <div className="mb-8">
+              <h3 className="text-lg font-medium text-foreground mb-4">Key Ownership</h3>
+              <Field className="mb-4">
+                <FieldLabel>
+                  <span>
+                    Owned By{" "}
+                    <Tooltip title="Select who will own this Virtual Key">
+                      <InfoCircleOutlined style={{ marginLeft: "4px" }} />
+                    </Tooltip>
+                  </span>
+                </FieldLabel>
+                <Radio.Group onChange={(e) => setKeyOwner(e.target.value)} value={keyOwner}>
+                  <Radio value="you">You</Radio>
+                  <Radio value="service_account">Service Account</Radio>
+                  {userRole === "Admin" && <Radio value="another_user">Another User</Radio>}
+                  <Radio value="agent">
+                    Agent <Tag color="purple">New</Tag>
+                  </Radio>
+                </Radio.Group>
+              </Field>
 
-            {keyOwner === "another_user" && (
-              <Form.Item
+              {keyOwner === "another_user" && (
+                <MountedFormField
+                  label={
+                    <span>
+                      User ID{" "}
+                      <Tooltip title="The user who will own this key and be responsible for its usage">
+                        <InfoCircleOutlined style={{ marginLeft: "4px" }} />
+                      </Tooltip>
+                    </span>
+                  }
+                  name="user_id"
+                  className="mt-4"
+                  required
+                  rules={requiredRule(
+                    keyOwner === "another_user",
+                    `Please input the user ID of the user you are assigning the key to`,
+                  )}
+                >
+                  {(control) => (
+                    <div
+                      id={control.id}
+                      aria-required={control["aria-required"]}
+                      aria-invalid={control["aria-invalid"]}
+                      aria-describedby={control["aria-describedby"]}
+                      onChange={control.onChange}
+                    >
+                      <div style={{ display: "flex", marginBottom: "8px" }}>
+                        <Select
+                          showSearch
+                          placeholder="Type email to search for users"
+                          filterOption={false}
+                          onSearch={handleUserSearch}
+                          onSelect={(value, option) => handleUserSelect(value, option as UserOption)}
+                          options={userOptions}
+                          loading={userSearchLoading}
+                          allowClear
+                          style={{ width: "100%" }}
+                          notFoundContent={userSearchLoading ? "Searching..." : "No users found"}
+                        />
+                        <Button2 onClick={() => setIsCreateUserModalVisible(true)} style={{ marginLeft: "8px" }}>
+                          Create User
+                        </Button2>
+                      </div>
+                      <div className="text-xs text-muted-foreground">Search by email to find users</div>
+                    </div>
+                  )}
+                </MountedFormField>
+              )}
+              {keyOwner === "agent" && (
+                <div className="mt-4 p-4 bg-purple-50 border border-purple-200 rounded-md">
+                  <div className="mb-3">
+                    <span className="text-sm font-medium text-foreground">
+                      Select Agent <span className="text-destructive">*</span>
+                    </span>
+                  </div>
+                  <Select
+                    showSearch
+                    placeholder="Select an agent"
+                    style={{ width: "100%" }}
+                    value={selectedAgentId}
+                    onChange={(value) => setSelectedAgentId(value)}
+                    filterOption={(input, option) =>
+                      (option?.label as string)?.toLowerCase().includes(input.toLowerCase())
+                    }
+                    options={agentsList.map((a) => ({
+                      label: a.agent_name || a.agent_id,
+                      value: a.agent_id,
+                    }))}
+                  />
+                  <div className="text-xs text-muted-foreground mt-2">
+                    This key will be used by the selected agent to make requests to LiteLLM
+                  </div>
+                </div>
+              )}
+              <MountedFormField
                 label={
                   <span>
-                    User ID{" "}
-                    <Tooltip title="The user who will own this key and be responsible for its usage">
+                    Organization{" "}
+                    <Tooltip title="The organization this key belongs to. Selecting an organization filters the available teams.">
                       <InfoCircleOutlined style={{ marginLeft: "4px" }} />
                     </Tooltip>
                   </span>
                 }
-                name="user_id"
+                name="organization_id"
                 className="mt-4"
-                rules={[
-                  {
-                    required: keyOwner === "another_user",
-                    message: `Please input the user ID of the user you are assigning the key to`,
-                  },
-                ]}
               >
-                <div>
-                  <div style={{ display: "flex", marginBottom: "8px" }}>
-                    <Select
-                      showSearch
-                      placeholder="Type email to search for users"
-                      filterOption={false}
-                      onSearch={handleUserSearch}
-                      onSelect={(value, option) => handleUserSelect(value, option as UserOption)}
-                      options={userOptions}
-                      loading={userSearchLoading}
-                      allowClear
-                      style={{ width: "100%" }}
-                      notFoundContent={userSearchLoading ? "Searching..." : "No users found"}
-                    />
-                    <Button2 onClick={() => setIsCreateUserModalVisible(true)} style={{ marginLeft: "8px" }}>
-                      Create User
-                    </Button2>
-                  </div>
-                  <div className="text-xs text-gray-500">Search by email to find users</div>
-                </div>
-              </Form.Item>
-            )}
-            {keyOwner === "agent" && (
-              <div className="mt-4 p-4 bg-purple-50 border border-purple-200 rounded-md">
-                <div className="mb-3">
-                  <span className="text-sm font-medium text-gray-700">
-                    Select Agent <span className="text-red-500">*</span>
+                {(control) => (
+                  <OrganizationDropdown
+                    id={control.id}
+                    value={control.value as string | undefined}
+                    organizations={organizations}
+                    loading={isOrganizationsLoading}
+                    disabled={userRole !== "Admin"}
+                    onChange={changeOrganization(control.onChange)}
+                  />
+                )}
+              </MountedFormField>
+              <MountedFormField
+                label={
+                  <span>
+                    Team{" "}
+                    <Tooltip title="The team this key belongs to, which determines available models and budget limits">
+                      <InfoCircleOutlined style={{ marginLeft: "4px" }} />
+                    </Tooltip>
                   </span>
-                </div>
-                <Select
-                  showSearch
-                  placeholder="Select an agent"
-                  style={{ width: "100%" }}
-                  value={selectedAgentId}
-                  onChange={(value) => setSelectedAgentId(value)}
-                  filterOption={(input, option) =>
-                    (option?.label as string)?.toLowerCase().includes(input.toLowerCase())
+                }
+                name="team_id"
+                className="mt-4"
+                required={keyOwner === "service_account"}
+                rules={requiredRule(keyOwner === "service_account", "Please select a team for the service account")}
+                help={keyOwner === "service_account" ? "required" : ""}
+              >
+                {(control) => (
+                  <TeamDropdown
+                    id={control.id}
+                    value={control.value as string | undefined}
+                    onChange={control.onChange}
+                    disabled={selectedProjectId !== null}
+                    organizationId={selectedOrganizationId}
+                    onTeamSelect={selectTeam}
+                  />
+                )}
+              </MountedFormField>
+              {enableProjectsUI && (
+                <MountedFormField
+                  label={
+                    <span>
+                      Project{" "}
+                      <Tooltip title="Assign this key to a project. Selecting a project will lock the team to the project's team.">
+                        <InfoCircleOutlined style={{ marginLeft: "4px" }} />
+                      </Tooltip>
+                    </span>
                   }
-                  options={agentsList.map((a) => ({
-                    label: a.agent_name || a.agent_id,
-                    value: a.agent_id,
-                  }))}
-                />
-                <div className="text-xs text-gray-500 mt-2">
-                  This key will be used by the selected agent to make requests to LiteLLM
-                </div>
+                  name="project_id"
+                  className="mt-4"
+                >
+                  {(control) => (
+                    <ProjectDropdown
+                      id={control.id}
+                      value={control.value as string | undefined}
+                      projects={projects}
+                      teamId={selectedCreateKeyTeam?.team_id}
+                      loading={isProjectsLoading || !teams}
+                      onChange={changeProject(control.onChange)}
+                    />
+                  )}
+                </MountedFormField>
+              )}
+            </div>
+
+            {/* Show message when team selection is required */}
+            {isFormDisabled && (
+              <div className="mb-8 p-4 bg-blue-50 border border-blue-200 rounded-md">
+                <p className="text-blue-800 text-sm">
+                  Please select a team to continue configuring your Virtual Key. If you do not see any teams, please
+                  contact your Proxy Admin to either provide you with access to models or to add you to a team.
+                </p>
               </div>
             )}
-            <Form.Item
-              label={
-                <span>
-                  Organization{" "}
-                  <Tooltip title="The organization this key belongs to. Selecting an organization filters the available teams.">
-                    <InfoCircleOutlined style={{ marginLeft: "4px" }} />
-                  </Tooltip>
-                </span>
-              }
-              name="organization_id"
-              className="mt-4"
-            >
-              <OrganizationDropdown
-                organizations={organizations}
-                loading={isOrganizationsLoading}
-                disabled={userRole !== "Admin"}
-                onChange={(orgId) => {
-                  setSelectedOrganizationId(orgId || null);
-                  // Clear team and project when org changes
-                  setSelectedCreateKeyTeam(null);
-                  setSelectedProjectId(null);
-                  form.setFieldValue("team_id", undefined);
-                  form.setFieldValue("project_id", undefined);
-                }}
-              />
-            </Form.Item>
-            <Form.Item
-              label={
-                <span>
-                  Team{" "}
-                  <Tooltip title="The team this key belongs to, which determines available models and budget limits">
-                    <InfoCircleOutlined style={{ marginLeft: "4px" }} />
-                  </Tooltip>
-                </span>
-              }
-              name="team_id"
-              initialValue={team ? team.team_id : null}
-              className="mt-4"
-              rules={[
-                {
-                  required: keyOwner === "service_account",
-                  message: "Please select a team for the service account",
-                },
-              ]}
-              help={keyOwner === "service_account" ? "required" : ""}
-            >
-              <TeamDropdown
-                disabled={selectedProjectId !== null}
-                organizationId={selectedOrganizationId}
-                onTeamSelect={(team) => {
-                  setSelectedCreateKeyTeam(team);
-                  setSelectedProjectId(null);
-                  form.setFieldValue("project_id", undefined);
-                  // Auto-populate org from team for non-admin users
-                  if (team?.organization_id) {
-                    setSelectedOrganizationId(team.organization_id);
-                    form.setFieldValue("organization_id", team.organization_id);
-                  } else if (!team) {
-                    setSelectedOrganizationId(null);
-                    form.setFieldValue("organization_id", undefined);
+
+            {/* Section 2: Key Details */}
+            {!isFormDisabled && (
+              <div className="mb-8">
+                <h3 className="text-lg font-medium text-foreground mb-4">Key Details</h3>
+                <MountedFormField
+                  label={
+                    <span>
+                      {keyOwner === "you" || keyOwner === "another_user" ? "Key Name" : "Service Account ID"}{" "}
+                      <Tooltip
+                        title={
+                          keyOwner === "you" || keyOwner === "another_user"
+                            ? "A descriptive name to identify this key"
+                            : "Unique identifier for this service account"
+                        }
+                      >
+                        <InfoCircleOutlined style={{ marginLeft: "4px" }} />
+                      </Tooltip>
+                    </span>
                   }
-                }}
-              />
-            </Form.Item>
-            {enableProjectsUI && (
-              <Form.Item
-                label={
-                  <span>
-                    Project{" "}
-                    <Tooltip title="Assign this key to a project. Selecting a project will lock the team to the project's team.">
-                      <InfoCircleOutlined style={{ marginLeft: "4px" }} />
-                    </Tooltip>
-                  </span>
-                }
-                name="project_id"
-                className="mt-4"
-              >
-                <ProjectDropdown
-                  projects={projects}
-                  teamId={selectedCreateKeyTeam?.team_id}
-                  loading={isProjectsLoading || !teams}
-                  onChange={(projectId) => {
-                    if (!projectId) {
-                      setSelectedProjectId(null);
-                      setSelectedCreateKeyTeam(null);
-                      form.setFieldValue("team_id", undefined);
-                      return;
-                    }
-                    setSelectedProjectId(projectId);
-                  }}
-                />
-              </Form.Item>
+                  name="key_alias"
+                  required
+                  rules={requiredRule(true, `Please input a ${keyOwner === "you" ? "key name" : "service account ID"}`)}
+                  help="required"
+                >
+                  {(control) => <Input {...control} value={(control.value as string | undefined) ?? ""} />}
+                </MountedFormField>
+
+                <MountedFormField
+                  label={
+                    <span>
+                      Models{" "}
+                      <Tooltip title="Select which models this key can access. Choose 'All Team Models' to grant access to all models available to the team. Leave empty to allow access to all models.">
+                        <InfoCircleOutlined style={{ marginLeft: "4px" }} />
+                      </Tooltip>
+                    </span>
+                  }
+                  name="models"
+                  help={
+                    keyType === "management" || keyType === "read_only"
+                      ? "Models field is disabled for this key type"
+                      : "optional - leave empty to allow access to all models"
+                  }
+                  className="mt-4"
+                >
+                  {(control) => (
+                    <Select
+                      {...control}
+                      value={control.value as string[] | undefined}
+                      mode="multiple"
+                      placeholder="Select models"
+                      style={{ width: "100%" }}
+                      disabled={keyType === "management" || keyType === "read_only"}
+                      onChange={(values: string[]) => {
+                        control.onChange(values);
+                        if (values.includes("all-team-models")) {
+                          form.setValue("models", ["all-team-models"]);
+                        } else if (values.includes("all-proxy-models")) {
+                          form.setValue("models", ["all-proxy-models"]);
+                        }
+                      }}
+                    >
+                      {!selectedProjectId && selectedCreateKeyTeam && (
+                        <Option key="all-team-models" value="all-team-models">
+                          All Team Models
+                        </Option>
+                      )}
+                      {!selectedProjectId && !selectedCreateKeyTeam && (
+                        <Option key="all-proxy-models" value="all-proxy-models">
+                          All Proxy Models
+                        </Option>
+                      )}
+                      {modelsToPick.map((model: string) => (
+                        <Option key={model} value={model} disabled={hasAllModelsSentinel(selectedModels)}>
+                          {getModelDisplayName(model)}
+                        </Option>
+                      ))}
+                    </Select>
+                  )}
+                </MountedFormField>
+
+                <MountedFormField
+                  label={
+                    <span>
+                      Key Type{" "}
+                      <Tooltip title="Select the type of key to determine what routes and operations this key can access">
+                        <InfoCircleOutlined style={{ marginLeft: "4px" }} />
+                      </Tooltip>
+                    </span>
+                  }
+                  name="key_type"
+                  className="mt-4"
+                >
+                  {(control) => (
+                    <Select
+                      {...control}
+                      value={control.value as string | undefined}
+                      placeholder="Select key type"
+                      style={{ width: "100%" }}
+                      optionLabelProp="label"
+                      onChange={changeKeyType(control.onChange)}
+                    >
+                      <Option value="llm_api" label="AI APIs">
+                        <div style={{ padding: "4px 0" }}>
+                          <Typography.Text strong>AI APIs</Typography.Text>
+                          <Typography.Paragraph type="secondary" style={{ fontSize: 11, margin: "2px 0 0" }}>
+                            Can call only AI API routes (chat/completions, embeddings, etc.)
+                          </Typography.Paragraph>
+                        </div>
+                      </Option>
+                      <Option value="management" label="Management">
+                        <div style={{ padding: "4px 0" }}>
+                          <Typography.Text strong>Management</Typography.Text>
+                          <Typography.Paragraph type="secondary" style={{ fontSize: 11, margin: "2px 0 0" }}>
+                            Can call only management routes (user/team/key management)
+                          </Typography.Paragraph>
+                        </div>
+                      </Option>
+                      <Option value="default" label="Full Access">
+                        <div style={{ padding: "4px 0" }}>
+                          <Typography.Text strong>Full Access</Typography.Text>
+                          <Typography.Paragraph type="secondary" style={{ fontSize: 11, margin: "2px 0 0" }}>
+                            Can call all routes (AI APIs, Management, and read-only)
+                          </Typography.Paragraph>
+                        </div>
+                      </Option>
+                    </Select>
+                  )}
+                </MountedFormField>
+              </div>
             )}
-          </div>
 
-          {/* Show message when team selection is required */}
-          {isFormDisabled && (
-            <div className="mb-8 p-4 bg-blue-50 border border-blue-200 rounded-md">
-              <p className="text-blue-800 text-sm">
-                Please select a team to continue configuring your Virtual Key. If you do not see any teams, please
-                contact your Proxy Admin to either provide you with access to models or to add you to a team.
-              </p>
-            </div>
-          )}
-
-          {/* Section 2: Key Details */}
-          {!isFormDisabled && (
-            <div className="mb-8">
-              <h3 className="text-lg font-medium text-gray-900 mb-4">Key Details</h3>
-              <Form.Item
-                label={
-                  <span>
-                    {keyOwner === "you" || keyOwner === "another_user" ? "Key Name" : "Service Account ID"}{" "}
-                    <Tooltip
-                      title={
-                        keyOwner === "you" || keyOwner === "another_user"
-                          ? "A descriptive name to identify this key"
-                          : "Unique identifier for this service account"
-                      }
-                    >
-                      <InfoCircleOutlined style={{ marginLeft: "4px" }} />
-                    </Tooltip>
-                  </span>
-                }
-                name="key_alias"
-                rules={[
-                  {
-                    required: true,
-                    message: `Please input a ${keyOwner === "you" ? "key name" : "service account ID"}`,
-                  },
-                ]}
-                help="required"
-              >
-                <Input />
-              </Form.Item>
-
-              <Form.Item
-                label={
-                  <span>
-                    Models{" "}
-                    <Tooltip title="Select which models this key can access. Choose 'All Team Models' to grant access to all models available to the team. Leave empty to allow access to all models.">
-                      <InfoCircleOutlined style={{ marginLeft: "4px" }} />
-                    </Tooltip>
-                  </span>
-                }
-                name="models"
-                rules={[]}
-                help={
-                  keyType === "management" || keyType === "read_only"
-                    ? "Models field is disabled for this key type"
-                    : "optional - leave empty to allow access to all models"
-                }
-                className="mt-4"
-              >
-                <Select
-                  mode="multiple"
-                  placeholder="Select models"
-                  style={{ width: "100%" }}
-                  disabled={keyType === "management" || keyType === "read_only"}
-                  onChange={(values) => {
-                    if (values.includes("all-team-models")) {
-                      form.setFieldsValue({ models: ["all-team-models"] });
-                    } else if (values.includes("all-proxy-models")) {
-                      form.setFieldsValue({ models: ["all-proxy-models"] });
-                    }
-                  }}
-                >
-                  {!selectedProjectId && selectedCreateKeyTeam && (
-                    <Option key="all-team-models" value="all-team-models">
-                      All Team Models
-                    </Option>
-                  )}
-                  {!selectedProjectId && !selectedCreateKeyTeam && (
-                    <Option key="all-proxy-models" value="all-proxy-models">
-                      All Proxy Models
-                    </Option>
-                  )}
-                  {modelsToPick.map((model: string) => (
-                    <Option key={model} value={model} disabled={hasAllModelsSentinel(selectedModels)}>
-                      {getModelDisplayName(model)}
-                    </Option>
-                  ))}
-                </Select>
-              </Form.Item>
-
-              <Form.Item
-                label={
-                  <span>
-                    Key Type{" "}
-                    <Tooltip title="Select the type of key to determine what routes and operations this key can access">
-                      <InfoCircleOutlined style={{ marginLeft: "4px" }} />
-                    </Tooltip>
-                  </span>
-                }
-                name="key_type"
-                initialValue="llm_api"
-                className="mt-4"
-              >
-                <Select
-                  defaultValue="llm_api"
-                  placeholder="Select key type"
-                  style={{ width: "100%" }}
-                  optionLabelProp="label"
-                  onChange={(value) => {
-                    setKeyType(value);
-                    // Clear models field and disable if management or read_only
-                    if (value === "management" || value === "read_only") {
-                      form.setFieldsValue({ models: [] });
-                    }
-                  }}
-                >
-                  <Option value="llm_api" label="AI APIs">
-                    <div style={{ padding: "4px 0" }}>
-                      <Typography.Text strong>AI APIs</Typography.Text>
-                      <Typography.Paragraph type="secondary" style={{ fontSize: 11, margin: "2px 0 0" }}>
-                        Can call only AI API routes (chat/completions, embeddings, etc.)
-                      </Typography.Paragraph>
-                    </div>
-                  </Option>
-                  <Option value="management" label="Management">
-                    <div style={{ padding: "4px 0" }}>
-                      <Typography.Text strong>Management</Typography.Text>
-                      <Typography.Paragraph type="secondary" style={{ fontSize: 11, margin: "2px 0 0" }}>
-                        Can call only management routes (user/team/key management)
-                      </Typography.Paragraph>
-                    </div>
-                  </Option>
-                  <Option value="default" label="Full Access">
-                    <div style={{ padding: "4px 0" }}>
-                      <Typography.Text strong>Full Access</Typography.Text>
-                      <Typography.Paragraph type="secondary" style={{ fontSize: 11, margin: "2px 0 0" }}>
-                        Can call all routes (AI APIs, Management, and read-only)
-                      </Typography.Paragraph>
-                    </div>
-                  </Option>
-                </Select>
-              </Form.Item>
-            </div>
-          )}
-
-          {/* Section 3: Optional Settings */}
-          {!isFormDisabled && (
-            <div className="mb-8">
-              <Collapsible className="mt-4 mb-4 overflow-hidden rounded-lg border">
-                <h3 className="m-0 text-lg font-medium text-gray-900">
-                  <CollapsibleTrigger className={SECTION_HEADER_CLASS}>
-                    Optional Settings
-                    <ChevronDown className={SECTION_CHEVRON_CLASS} />
-                  </CollapsibleTrigger>
-                </h3>
-                <CollapsibleContent className="px-4 pb-3">
-                  <Form.Item
-                    className="mt-4"
-                    label={
-                      <span>
-                        Max Budget (USD){" "}
-                        <Tooltip title="Maximum amount in USD this key can spend. When reached, the key will be blocked from making further requests">
-                          <InfoCircleOutlined style={{ marginLeft: "4px" }} />
-                        </Tooltip>
-                      </span>
-                    }
-                    name="max_budget"
-                    help={`Budget cannot exceed team max budget: $${team?.max_budget !== null && team?.max_budget !== undefined ? team?.max_budget : "unlimited"}`}
-                    rules={[
-                      {
-                        validator: async (_, value) => {
-                          if (value && team && team.max_budget !== null && value > team.max_budget) {
-                            throw new Error(
-                              `Budget cannot exceed team max budget: $${formatNumberWithCommas(team.max_budget, 4)}`,
-                            );
-                          }
-                        },
-                      },
-                    ]}
-                  >
-                    <NumericalInput step={0.01} precision={2} width={200} />
-                  </Form.Item>
-                  <Form.Item
-                    className="mt-4"
-                    label={
-                      <span>
-                        Reset Budget{" "}
-                        <Tooltip title="How often the budget should reset. For example, setting 'daily' will reset the budget every 24 hours">
-                          <InfoCircleOutlined style={{ marginLeft: "4px" }} />
-                        </Tooltip>
-                      </span>
-                    }
-                    name="budget_duration"
-                    help={`Team Reset Budget: ${team?.budget_duration !== null && team?.budget_duration !== undefined ? team?.budget_duration : "None"}`}
-                  >
-                    <BudgetDurationDropdown
-                      showNeverResets
-                      placeholder="Not set"
-                      onChange={(value) => form.setFieldValue("budget_duration", value)}
-                    />
-                  </Form.Item>
-                  <Form.Item
-                    className="mt-4"
-                    label={
-                      <span>
-                        Budget Windows{" "}
-                        <Tooltip title="Set multiple independent budget windows (e.g., hourly $10 AND monthly $200). Each window tracks spend separately and resets on its own schedule.">
-                          <InfoCircleOutlined style={{ marginLeft: "4px" }} />
-                        </Tooltip>
-                      </span>
-                    }
-                  >
-                    <BudgetWindowsEditor value={budgetLimits} onChange={setBudgetLimits} />
-                  </Form.Item>
-                  <Form.Item
-                    className="mt-4"
-                    label={
-                      <span>
-                        Budget Fallbacks{" "}
-                        <Tooltip title="When a model exceeds its per-model budget (model_max_budget), requests automatically reroute to fallback models instead of failing. Configure per-model budgets in Advanced Settings.">
-                          <InfoCircleOutlined style={{ marginLeft: "4px" }} />
-                        </Tooltip>
-                      </span>
-                    }
-                  >
-                    <BudgetFallbacksEditor
-                      key={budgetFallbacksKey}
-                      value={budgetFallbacks}
-                      onChange={setBudgetFallbacks}
-                      availableModels={modelsToPick}
-                    />
-                  </Form.Item>
-                  <Form.Item
-                    className="mt-4"
-                    label={
-                      <span>
-                        Tokens per minute Limit (TPM){" "}
-                        <Tooltip title="Maximum number of tokens this key can process per minute. Helps control usage and costs">
-                          <InfoCircleOutlined style={{ marginLeft: "4px" }} />
-                        </Tooltip>
-                      </span>
-                    }
-                    name="tpm_limit"
-                    help={`TPM cannot exceed team TPM limit: ${team?.tpm_limit !== null && team?.tpm_limit !== undefined ? team?.tpm_limit : "unlimited"}`}
-                    rules={[
-                      {
-                        validator: async (_, value) => {
-                          if (value && team && team.tpm_limit !== null && value > team.tpm_limit) {
-                            throw new Error(`TPM limit cannot exceed team TPM limit: ${team.tpm_limit}`);
-                          }
-                        },
-                      },
-                    ]}
-                  >
-                    <NumericalInput step={1} width={400} />
-                  </Form.Item>
-                  <Form.Item name="tpm_limit_type" initialValue={null} noStyle>
-                    <RateLimitTypeFormItem type="tpm" name="tpm_limit_type" className="mt-4" showDetailedDescriptions />
-                  </Form.Item>
-                  <Form.Item
-                    className="mt-4"
-                    label={
-                      <span>
-                        Requests per minute Limit (RPM){" "}
-                        <Tooltip title="Maximum number of API requests this key can make per minute. Helps prevent abuse and manage load">
-                          <InfoCircleOutlined style={{ marginLeft: "4px" }} />
-                        </Tooltip>
-                      </span>
-                    }
-                    name="rpm_limit"
-                    help={`RPM cannot exceed team RPM limit: ${team?.rpm_limit !== null && team?.rpm_limit !== undefined ? team?.rpm_limit : "unlimited"}`}
-                    rules={[
-                      {
-                        validator: async (_, value) => {
-                          if (value && team && team.rpm_limit !== null && value > team.rpm_limit) {
-                            throw new Error(`RPM limit cannot exceed team RPM limit: ${team.rpm_limit}`);
-                          }
-                        },
-                      },
-                    ]}
-                  >
-                    <NumericalInput step={1} width={400} />
-                  </Form.Item>
-                  <Form.Item name="rpm_limit_type" initialValue={null} noStyle>
-                    <RateLimitTypeFormItem type="rpm" name="rpm_limit_type" className="mt-4" showDetailedDescriptions />
-                  </Form.Item>
-                  <Form.Item
-                    className="mt-4"
-                    label={
-                      <span>
-                        Per-Tag Rate Limits{" "}
-                        <Tooltip title="Scope rate limits to a request tag so each tag (e.g. a cell or group) gets its own RPM counter. Requests without a matching tag fall back to the key-level limit.">
-                          <InfoCircleOutlined style={{ marginLeft: "4px" }} />
-                        </Tooltip>
-                      </span>
-                    }
-                  >
-                    <TagRateLimitEditor value={tagRateLimits} onChange={setTagRateLimits} />
-                  </Form.Item>
-                  <Form.Item
-                    className="mt-4"
-                    label={
-                      <span>
-                        Throttle on budget exceeded{" "}
-                        <Tooltip title="When this key exceeds its max budget, throttle its TPM/RPM to the globally configured percentage instead of blocking access entirely. Requires budget_exceeded_throttle_percentage in litellm_settings and a TPM/RPM limit on the key.">
-                          <InfoCircleOutlined style={{ marginLeft: "4px" }} />
-                        </Tooltip>
-                      </span>
-                    }
-                    name="throttle_on_budget_exceeded"
-                    valuePropName="checked"
-                  >
-                    <Switch checkedChildren="Yes" unCheckedChildren="No" />
-                  </Form.Item>
-                  <Form.Item
-                    className="mt-4"
-                    label={
-                      <span>
-                        Enable Prompt Caching{" "}
-                        <Tooltip title="Automatically add prompt caching breakpoints (cache_control markers) to requests made with this key, cutting input cost on repeated prompts. Applies to Anthropic and Bedrock Claude models; requests that already set their own cache_control markers are left untouched.">
-                          <InfoCircleOutlined style={{ marginLeft: "4px" }} />
-                        </Tooltip>
-                      </span>
-                    }
-                    name="enable_prompt_caching"
-                    valuePropName="checked"
-                  >
-                    <Switch checkedChildren="Yes" unCheckedChildren="No" />
-                  </Form.Item>
-                  <Form.Item
-                    label={
-                      <span>
-                        Guardrails{" "}
-                        <Tooltip title="Apply safety guardrails to this key to filter content or enforce policies">
-                          <a
-                            href="https://docs.litellm.ai/docs/proxy/guardrails/quick_start"
-                            target="_blank"
-                            rel="noopener noreferrer"
-                            onClick={(e) => e.stopPropagation()} // Prevent accordion from collapsing when clicking link
-                          >
-                            <InfoCircleOutlined style={{ marginLeft: "4px" }} />
-                          </a>
-                        </Tooltip>
-                      </span>
-                    }
-                    name="guardrails"
-                    className="mt-4"
-                    help={
-                      canEditGuardrails
-                        ? "Select existing guardrails or enter new ones"
-                        : "Premium feature - Upgrade to set guardrails by key"
-                    }
-                  >
-                    <Select
-                      mode="tags"
-                      style={{ width: "100%" }}
-                      disabled={!canEditGuardrails}
-                      placeholder={
-                        !canEditGuardrails
-                          ? "Premium feature - Upgrade to set guardrails by key"
-                          : "Select or enter guardrails"
-                      }
-                      options={guardrailsList.map((name) => ({ value: name, label: name }))}
-                    />
-                  </Form.Item>
-                  <Form.Item
-                    label={
-                      <span>
-                        Disable Global Guardrails{" "}
-                        <Tooltip title="When enabled, this key will bypass any guardrails configured to run on every request (global guardrails)">
-                          <a
-                            href="https://docs.litellm.ai/docs/proxy/guardrails/quick_start"
-                            target="_blank"
-                            rel="noopener noreferrer"
-                            onClick={(e) => e.stopPropagation()} // Prevent accordion from collapsing when clicking link
-                          >
-                            <InfoCircleOutlined style={{ marginLeft: "4px" }} />
-                          </a>
-                        </Tooltip>
-                      </span>
-                    }
-                    name="disable_global_guardrails"
-                    className="mt-4"
-                    valuePropName="checked"
-                    help={
-                      canEditGuardrails
-                        ? "Bypass global guardrails for this key"
-                        : "Premium feature - Upgrade to disable global guardrails by key"
-                    }
-                  >
-                    <Switch disabled={!canEditGuardrails} checkedChildren="Yes" unCheckedChildren="No" />
-                  </Form.Item>
-                  {canViewPolicies && (
-                    <Form.Item
-                      label={
-                        <span>
-                          Policies{" "}
-                          <Tooltip title="Apply policies to this key to control guardrails and other settings">
-                            <a
-                              href="https://docs.litellm.ai/docs/proxy/guardrails/guardrail_policies"
-                              target="_blank"
-                              rel="noopener noreferrer"
-                              onClick={(e) => e.stopPropagation()} // Prevent accordion from collapsing when clicking link
-                            >
-                              <InfoCircleOutlined style={{ marginLeft: "4px" }} />
-                            </a>
-                          </Tooltip>
-                        </span>
-                      }
-                      name="policies"
-                      className="mt-4"
-                      help={
-                        premiumUser
-                          ? "Select existing policies or enter new ones"
-                          : "Premium feature - Upgrade to set policies by key"
-                      }
-                    >
-                      <Select
-                        mode="tags"
-                        style={{ width: "100%" }}
-                        disabled={!premiumUser}
-                        placeholder={
-                          !premiumUser ? "Premium feature - Upgrade to set policies by key" : "Select or enter policies"
-                        }
-                        options={policiesList.map((name) => ({ value: name, label: name }))}
-                      />
-                    </Form.Item>
-                  )}
-                  {canViewPrompts && (
-                    <Form.Item
-                      label={
-                        <span>
-                          Prompts{" "}
-                          <Tooltip title="Allow this key to use specific prompt templates">
-                            <a
-                              href="https://docs.litellm.ai/docs/proxy/prompt_management"
-                              target="_blank"
-                              rel="noopener noreferrer"
-                              onClick={(e) => e.stopPropagation()} // Prevent accordion from collapsing when clicking link
-                            >
-                              <InfoCircleOutlined style={{ marginLeft: "4px" }} />
-                            </a>
-                          </Tooltip>
-                        </span>
-                      }
-                      name="prompts"
-                      className="mt-4"
-                      help={
-                        premiumUser
-                          ? "Select existing prompts or enter new ones"
-                          : "Premium feature - Upgrade to set prompts by key"
-                      }
-                    >
-                      <Select
-                        mode="tags"
-                        style={{ width: "100%" }}
-                        disabled={!premiumUser}
-                        placeholder={
-                          !premiumUser ? "Premium feature - Upgrade to set prompts by key" : "Select or enter prompts"
-                        }
-                        options={promptsList.map((name) => ({ value: name, label: name }))}
-                      />
-                    </Form.Item>
-                  )}
-                  <Form.Item
-                    label={
-                      <span>
-                        Access Groups{" "}
-                        <Tooltip title="Assign access groups to this key. Access groups control which models, MCP servers, and agents this key can use">
-                          <InfoCircleOutlined style={{ marginLeft: "4px" }} />
-                        </Tooltip>
-                      </span>
-                    }
-                    name="access_group_ids"
-                    className="mt-4"
-                    help="Select access groups to assign to this key"
-                  >
-                    <AccessGroupSelector placeholder="Select access groups (optional)" />
-                  </Form.Item>
-                  <Form.Item
-                    label={
-                      <span>
-                        Allowed Pass Through Routes{" "}
-                        <Tooltip title="Allow this key to use specific pass through routes">
-                          <a
-                            href="https://docs.litellm.ai/docs/proxy/pass_through"
-                            target="_blank"
-                            rel="noopener noreferrer"
-                            onClick={(e) => e.stopPropagation()} // Prevent accordion from collapsing when clicking link
-                          >
-                            <InfoCircleOutlined style={{ marginLeft: "4px" }} />
-                          </a>
-                        </Tooltip>
-                      </span>
-                    }
-                    name="allowed_passthrough_routes"
-                    className="mt-4"
-                    help={
-                      premiumUser
-                        ? "Select existing pass through routes or enter new ones"
-                        : "Premium feature - Upgrade to set pass through routes by key"
-                    }
-                  >
-                    <PassThroughRoutesSelector
-                      accessToken={accessToken}
-                      placeholder={
-                        !premiumUser
-                          ? "Premium feature - Upgrade to set pass through routes by key"
-                          : "Select or enter pass through routes"
-                      }
-                      disabled={!premiumUser}
-                      teamId={selectedCreateKeyTeam ? selectedCreateKeyTeam.team_id : null}
-                    />
-                  </Form.Item>
-                  <Form.Item
-                    label={
-                      <span>
-                        Allowed Vector Stores{" "}
-                        <Tooltip title="Select which vector stores this key can access. If none selected, the key will have access to all available vector stores">
-                          <InfoCircleOutlined style={{ marginLeft: "4px" }} />
-                        </Tooltip>
-                      </span>
-                    }
-                    name="allowed_vector_store_ids"
-                    className="mt-4"
-                    help="Select vector stores this key can access. Leave empty for access to all vector stores"
-                  >
-                    <VectorStoreSelector
-                      onChange={(values: string[]) => form.setFieldValue("allowed_vector_store_ids", values)}
-                      value={form.getFieldValue("allowed_vector_store_ids")}
-                      accessToken={accessToken}
-                      placeholder="Select vector stores (optional)"
-                    />
-                  </Form.Item>
-                  <Form.Item
-                    label={
-                      <span>
-                        Metadata{" "}
-                        <Tooltip title="JSON object with additional information about this key. Used for tracking or custom logic">
-                          <InfoCircleOutlined style={{ marginLeft: "4px" }} />
-                        </Tooltip>
-                      </span>
-                    }
-                    name="metadata"
-                    className="mt-4"
-                  >
-                    <AntdInput.TextArea rows={4} placeholder="Enter metadata as JSON" />
-                  </Form.Item>
-                  <Form.Item
-                    label={
-                      <span>
-                        Tags{" "}
-                        <Tooltip title="Tags for tracking spend and/or doing tag-based routing. Used for analytics and filtering">
-                          <InfoCircleOutlined style={{ marginLeft: "4px" }} />
-                        </Tooltip>
-                      </span>
-                    }
-                    name="tags"
-                    className="mt-4"
-                    help={`Tags for tracking spend and/or doing tag-based routing.`}
-                  >
-                    <Select
-                      mode="tags"
-                      style={{ width: "100%" }}
-                      placeholder="Select or enter tags"
-                      tokenSeparators={[","]}
-                      options={tagOptions}
-                    />
-                  </Form.Item>
-                  <Collapsible className="mt-4 mb-4 overflow-hidden rounded-lg border">
+            {/* Section 3: Optional Settings */}
+            {!isFormDisabled && (
+              <div className="mb-8">
+                <Collapsible className="mt-4 mb-4 overflow-hidden rounded-lg border">
+                  <h3 className="m-0 text-lg font-medium text-foreground">
                     <CollapsibleTrigger className={SECTION_HEADER_CLASS}>
-                      <b>MCP Settings</b>
+                      Optional Settings
                       <ChevronDown className={SECTION_CHEVRON_CLASS} />
                     </CollapsibleTrigger>
-                    <CollapsibleContent className="px-4 pb-3">
-                      <Form.Item
+                  </h3>
+                  <CollapsibleContent className="px-4 pb-3">
+                    <MountedFormField
+                      className="mt-4"
+                      label={
+                        <span>
+                          Max Budget (USD){" "}
+                          <Tooltip title="Maximum amount in USD this key can spend. When reached, the key will be blocked from making further requests">
+                            <InfoCircleOutlined style={{ marginLeft: "4px" }} />
+                          </Tooltip>
+                        </span>
+                      }
+                      name="max_budget"
+                      help={`Budget cannot exceed team max budget: $${team?.max_budget !== null && team?.max_budget !== undefined ? team?.max_budget : "unlimited"}`}
+                      rules={ceilingRule(
+                        team?.max_budget,
+                        (limit) => `Budget cannot exceed team max budget: $${formatNumberWithCommas(limit, 4)}`,
+                      )}
+                    >
+                      {(control) => (
+                        <NumericalInput
+                          {...control}
+                          value={control.value as number | string | undefined}
+                          step={0.01}
+                          precision={2}
+                          width={200}
+                        />
+                      )}
+                    </MountedFormField>
+                    <MountedFormField
+                      className="mt-4"
+                      label={
+                        <span>
+                          Reset Budget{" "}
+                          <Tooltip title="How often the budget should reset. For example, setting 'daily' will reset the budget every 24 hours">
+                            <InfoCircleOutlined style={{ marginLeft: "4px" }} />
+                          </Tooltip>
+                        </span>
+                      }
+                      name="budget_duration"
+                      help={`Team Reset Budget: ${team?.budget_duration !== null && team?.budget_duration !== undefined ? team?.budget_duration : "None"}`}
+                    >
+                      {(control) => (
+                        <BudgetDurationDropdown
+                          id={control.id}
+                          value={control.value as string | null | undefined}
+                          showNeverResets
+                          placeholder="Not set"
+                          onChange={control.onChange}
+                        />
+                      )}
+                    </MountedFormField>
+                    <Field className="mt-4">
+                      <FieldLabel>
+                        <span>
+                          Budget Windows{" "}
+                          <Tooltip title="Set multiple independent budget windows (e.g., hourly $10 AND monthly $200). Each window tracks spend separately and resets on its own schedule.">
+                            <InfoCircleOutlined style={{ marginLeft: "4px" }} />
+                          </Tooltip>
+                        </span>
+                      </FieldLabel>
+                      <BudgetWindowsEditor value={budgetLimits} onChange={setBudgetLimits} />
+                    </Field>
+                    <Field className="mt-4">
+                      <FieldLabel>
+                        <span>
+                          Budget Fallbacks{" "}
+                          <Tooltip title="When a model exceeds its per-model budget (model_max_budget), requests automatically reroute to fallback models instead of failing. Configure per-model budgets in Advanced Settings.">
+                            <InfoCircleOutlined style={{ marginLeft: "4px" }} />
+                          </Tooltip>
+                        </span>
+                      </FieldLabel>
+                      <BudgetFallbacksEditor
+                        key={budgetFallbacksKey}
+                        value={budgetFallbacks}
+                        onChange={setBudgetFallbacks}
+                        availableModels={modelsToPick}
+                      />
+                    </Field>
+                    <MountedFormField
+                      className="mt-4"
+                      label={
+                        <span>
+                          Tokens per minute Limit (TPM){" "}
+                          <Tooltip title="Maximum number of tokens this key can process per minute. Helps control usage and costs">
+                            <InfoCircleOutlined style={{ marginLeft: "4px" }} />
+                          </Tooltip>
+                        </span>
+                      }
+                      name="tpm_limit"
+                      help={`TPM cannot exceed team TPM limit: ${team?.tpm_limit !== null && team?.tpm_limit !== undefined ? team?.tpm_limit : "unlimited"}`}
+                      rules={ceilingRule(
+                        team?.tpm_limit,
+                        (limit) => `TPM limit cannot exceed team TPM limit: ${limit}`,
+                      )}
+                    >
+                      {(control) => (
+                        <NumericalInput
+                          {...control}
+                          value={control.value as number | string | undefined}
+                          step={1}
+                          width={400}
+                        />
+                      )}
+                    </MountedFormField>
+                    <MountedFormField name="tpm_limit_type" bare>
+                      {(control) => (
+                        <RateLimitTypeFormItem
+                          type="tpm"
+                          name="tpm_limit_type"
+                          className="mt-4"
+                          showDetailedDescriptions
+                          id={control.id}
+                          value={control.value as string | null | undefined}
+                          onChange={control.onChange}
+                          aria-invalid={control["aria-invalid"] ? true : undefined}
+                          aria-describedby={control["aria-describedby"]}
+                        />
+                      )}
+                    </MountedFormField>
+                    <MountedFormField
+                      className="mt-4"
+                      label={
+                        <span>
+                          Requests per minute Limit (RPM){" "}
+                          <Tooltip title="Maximum number of API requests this key can make per minute. Helps prevent abuse and manage load">
+                            <InfoCircleOutlined style={{ marginLeft: "4px" }} />
+                          </Tooltip>
+                        </span>
+                      }
+                      name="rpm_limit"
+                      help={`RPM cannot exceed team RPM limit: ${team?.rpm_limit !== null && team?.rpm_limit !== undefined ? team?.rpm_limit : "unlimited"}`}
+                      rules={ceilingRule(
+                        team?.rpm_limit,
+                        (limit) => `RPM limit cannot exceed team RPM limit: ${limit}`,
+                      )}
+                    >
+                      {(control) => (
+                        <NumericalInput
+                          {...control}
+                          value={control.value as number | string | undefined}
+                          step={1}
+                          width={400}
+                        />
+                      )}
+                    </MountedFormField>
+                    <MountedFormField name="rpm_limit_type" bare>
+                      {(control) => (
+                        <RateLimitTypeFormItem
+                          type="rpm"
+                          name="rpm_limit_type"
+                          className="mt-4"
+                          showDetailedDescriptions
+                          id={control.id}
+                          value={control.value as string | null | undefined}
+                          onChange={control.onChange}
+                          aria-invalid={control["aria-invalid"] ? true : undefined}
+                          aria-describedby={control["aria-describedby"]}
+                        />
+                      )}
+                    </MountedFormField>
+                    <Field className="mt-4">
+                      <FieldLabel>
+                        <span>
+                          Per-Tag Rate Limits{" "}
+                          <Tooltip title="Scope rate limits to a request tag so each tag (e.g. a cell or group) gets its own RPM counter. Requests without a matching tag fall back to the key-level limit.">
+                            <InfoCircleOutlined style={{ marginLeft: "4px" }} />
+                          </Tooltip>
+                        </span>
+                      </FieldLabel>
+                      <TagRateLimitEditor value={tagRateLimits} onChange={setTagRateLimits} />
+                    </Field>
+                    <MountedFormField
+                      className="mt-4"
+                      label={
+                        <span>
+                          Throttle on budget exceeded{" "}
+                          <Tooltip title="When this key exceeds its max budget, throttle its TPM/RPM to the globally configured percentage instead of blocking access entirely. Requires budget_exceeded_throttle_percentage in litellm_settings and a TPM/RPM limit on the key.">
+                            <InfoCircleOutlined style={{ marginLeft: "4px" }} />
+                          </Tooltip>
+                        </span>
+                      }
+                      name="throttle_on_budget_exceeded"
+                    >
+                      {(control) => (
+                        <Switch
+                          id={control.id}
+                          checked={control.value as boolean | undefined}
+                          onChange={control.onChange}
+                          checkedChildren="Yes"
+                          unCheckedChildren="No"
+                        />
+                      )}
+                    </MountedFormField>
+                    <MountedFormField
+                      className="mt-4"
+                      label={
+                        <span>
+                          Enable Prompt Caching{" "}
+                          <Tooltip title="Automatically add prompt caching breakpoints (cache_control markers) to requests made with this key, cutting input cost on repeated prompts. Applies to Anthropic and Bedrock Claude models; requests that already set their own cache_control markers are left untouched.">
+                            <InfoCircleOutlined style={{ marginLeft: "4px" }} />
+                          </Tooltip>
+                        </span>
+                      }
+                      name="enable_prompt_caching"
+                    >
+                      {(control) => (
+                        <Switch
+                          id={control.id}
+                          checked={control.value as boolean | undefined}
+                          onChange={control.onChange}
+                          checkedChildren="Yes"
+                          unCheckedChildren="No"
+                        />
+                      )}
+                    </MountedFormField>
+                    <MountedFormField
+                      label={
+                        <span>
+                          Guardrails{" "}
+                          <Tooltip title="Apply safety guardrails to this key to filter content or enforce policies">
+                            <a
+                              href="https://docs.litellm.ai/docs/proxy/guardrails/quick_start"
+                              target="_blank"
+                              rel="noopener noreferrer"
+                              onClick={(e) => e.stopPropagation()} // Prevent accordion from collapsing when clicking link
+                            >
+                              <InfoCircleOutlined style={{ marginLeft: "4px" }} />
+                            </a>
+                          </Tooltip>
+                        </span>
+                      }
+                      name="guardrails"
+                      className="mt-4"
+                      help={
+                        canEditGuardrails
+                          ? "Select existing guardrails or enter new ones"
+                          : "Premium feature - Upgrade to set guardrails by key"
+                      }
+                    >
+                      {(control) => (
+                        <Select
+                          {...control}
+                          value={control.value as string[] | undefined}
+                          mode="tags"
+                          style={{ width: "100%" }}
+                          disabled={!canEditGuardrails}
+                          placeholder={
+                            !canEditGuardrails
+                              ? "Premium feature - Upgrade to set guardrails by key"
+                              : "Select or enter guardrails"
+                          }
+                          options={guardrailsList.map((name) => ({ value: name, label: name }))}
+                        />
+                      )}
+                    </MountedFormField>
+                    <MountedFormField
+                      label={
+                        <span>
+                          Disable Global Guardrails{" "}
+                          <Tooltip title="When enabled, this key will bypass any guardrails configured to run on every request (global guardrails)">
+                            <a
+                              href="https://docs.litellm.ai/docs/proxy/guardrails/quick_start"
+                              target="_blank"
+                              rel="noopener noreferrer"
+                              onClick={(e) => e.stopPropagation()} // Prevent accordion from collapsing when clicking link
+                            >
+                              <InfoCircleOutlined style={{ marginLeft: "4px" }} />
+                            </a>
+                          </Tooltip>
+                        </span>
+                      }
+                      name="disable_global_guardrails"
+                      className="mt-4"
+                      help={
+                        canEditGuardrails
+                          ? "Bypass global guardrails for this key"
+                          : "Premium feature - Upgrade to disable global guardrails by key"
+                      }
+                    >
+                      {(control) => (
+                        <Switch
+                          id={control.id}
+                          checked={control.value as boolean | undefined}
+                          onChange={control.onChange}
+                          disabled={!canEditGuardrails}
+                          checkedChildren="Yes"
+                          unCheckedChildren="No"
+                        />
+                      )}
+                    </MountedFormField>
+                    {canViewPolicies && (
+                      <MountedFormField
                         label={
                           <span>
-                            Allowed MCP Servers{" "}
-                            <Tooltip title="Select which MCP servers or access groups this key can access">
-                              <InfoCircleOutlined style={{ marginLeft: "4px" }} />
+                            Policies{" "}
+                            <Tooltip title="Apply policies to this key to control guardrails and other settings">
+                              <a
+                                href="https://docs.litellm.ai/docs/proxy/guardrails/guardrail_policies"
+                                target="_blank"
+                                rel="noopener noreferrer"
+                                onClick={(e) => e.stopPropagation()} // Prevent accordion from collapsing when clicking link
+                              >
+                                <InfoCircleOutlined style={{ marginLeft: "4px" }} />
+                              </a>
                             </Tooltip>
                           </span>
                         }
-                        name="allowed_mcp_servers_and_groups"
-                        help="Select MCP servers or access groups this key can access"
-                      >
-                        <MCPServerSelector
-                          onChange={(val: any) => form.setFieldValue("allowed_mcp_servers_and_groups", val)}
-                          value={form.getFieldValue("allowed_mcp_servers_and_groups")}
-                          accessToken={accessToken}
-                          teamId={selectedCreateKeyTeam?.team_id ?? null}
-                          placeholder="Select MCP servers or access groups (optional)"
-                          allowNoMcpServers
-                        />
-                      </Form.Item>
-
-                      {/* Hidden field to register mcp_tool_permissions with the form */}
-                      <Form.Item name="mcp_tool_permissions" initialValue={{}} hidden>
-                        <AntdInput type="hidden" />
-                      </Form.Item>
-
-                      <Form.Item
-                        noStyle
-                        shouldUpdate={(prevValues, currentValues) =>
-                          prevValues.allowed_mcp_servers_and_groups !== currentValues.allowed_mcp_servers_and_groups ||
-                          prevValues.mcp_tool_permissions !== currentValues.mcp_tool_permissions
+                        name="policies"
+                        className="mt-4"
+                        help={
+                          premiumUser
+                            ? "Select existing policies or enter new ones"
+                            : "Premium feature - Upgrade to set policies by key"
                         }
                       >
-                        {() => (
-                          <div className="mt-6">
-                            <MCPToolPermissions
-                              accessToken={accessToken}
-                              selectedServers={(
-                                form.getFieldValue("allowed_mcp_servers_and_groups")?.servers || []
-                              ).filter((s: string) => s !== NO_MCP_SERVERS_SENTINEL)}
-                              toolPermissions={form.getFieldValue("mcp_tool_permissions") || {}}
-                              onChange={(toolPerms) => form.setFieldsValue({ mcp_tool_permissions: toolPerms })}
-                            />
-                          </div>
+                        {(control) => (
+                          <Select
+                            {...control}
+                            value={control.value as string[] | undefined}
+                            mode="tags"
+                            style={{ width: "100%" }}
+                            disabled={!premiumUser}
+                            placeholder={
+                              !premiumUser
+                                ? "Premium feature - Upgrade to set policies by key"
+                                : "Select or enter policies"
+                            }
+                            options={policiesList.map((name) => ({ value: name, label: name }))}
+                          />
                         )}
-                      </Form.Item>
-                    </CollapsibleContent>
-                  </Collapsible>
-
-                  <Collapsible className="mt-4 mb-4 overflow-hidden rounded-lg border">
-                    <CollapsibleTrigger className={SECTION_HEADER_CLASS}>
-                      <b>Agent Settings</b>
-                      <ChevronDown className={SECTION_CHEVRON_CLASS} />
-                    </CollapsibleTrigger>
-                    <CollapsibleContent className="px-4 pb-3">
-                      <Form.Item
+                      </MountedFormField>
+                    )}
+                    {canViewPrompts && (
+                      <MountedFormField
                         label={
                           <span>
-                            Allowed Agents{" "}
-                            <Tooltip title="Select which agents or access groups this key can access">
-                              <InfoCircleOutlined style={{ marginLeft: "4px" }} />
+                            Prompts{" "}
+                            <Tooltip title="Allow this key to use specific prompt templates">
+                              <a
+                                href="https://docs.litellm.ai/docs/proxy/prompt_management"
+                                target="_blank"
+                                rel="noopener noreferrer"
+                                onClick={(e) => e.stopPropagation()} // Prevent accordion from collapsing when clicking link
+                              >
+                                <InfoCircleOutlined style={{ marginLeft: "4px" }} />
+                              </a>
                             </Tooltip>
                           </span>
                         }
-                        name="allowed_agents_and_groups"
-                        help="Select agents or access groups this key can access"
+                        name="prompts"
+                        className="mt-4"
+                        help={
+                          premiumUser
+                            ? "Select existing prompts or enter new ones"
+                            : "Premium feature - Upgrade to set prompts by key"
+                        }
                       >
-                        <AgentSelector
-                          onChange={(val: any) => form.setFieldValue("allowed_agents_and_groups", val)}
-                          value={form.getFieldValue("allowed_agents_and_groups")}
-                          accessToken={accessToken}
-                          placeholder="Select agents or access groups (optional)"
+                        {(control) => (
+                          <Select
+                            {...control}
+                            value={control.value as string[] | undefined}
+                            mode="tags"
+                            style={{ width: "100%" }}
+                            disabled={!premiumUser}
+                            placeholder={
+                              !premiumUser
+                                ? "Premium feature - Upgrade to set prompts by key"
+                                : "Select or enter prompts"
+                            }
+                            options={promptsList.map((name) => ({ value: name, label: name }))}
+                          />
+                        )}
+                      </MountedFormField>
+                    )}
+                    <MountedFormField
+                      label={
+                        <span>
+                          Access Groups{" "}
+                          <Tooltip title="Assign access groups to this key. Access groups control which models, MCP servers, and agents this key can use">
+                            <InfoCircleOutlined style={{ marginLeft: "4px" }} />
+                          </Tooltip>
+                        </span>
+                      }
+                      name="access_group_ids"
+                      className="mt-4"
+                      help="Select access groups to assign to this key"
+                    >
+                      {(control) => (
+                        <AccessGroupSelector
+                          value={control.value as string[] | undefined}
+                          onChange={control.onChange}
+                          placeholder="Select access groups (optional)"
                         />
-                      </Form.Item>
-                    </CollapsibleContent>
-                  </Collapsible>
-
-                  {premiumUser ? (
+                      )}
+                    </MountedFormField>
+                    <MountedFormField
+                      label={
+                        <span>
+                          Allowed Pass Through Routes{" "}
+                          <Tooltip title="Allow this key to use specific pass through routes">
+                            <a
+                              href="https://docs.litellm.ai/docs/proxy/pass_through"
+                              target="_blank"
+                              rel="noopener noreferrer"
+                              onClick={(e) => e.stopPropagation()} // Prevent accordion from collapsing when clicking link
+                            >
+                              <InfoCircleOutlined style={{ marginLeft: "4px" }} />
+                            </a>
+                          </Tooltip>
+                        </span>
+                      }
+                      name="allowed_passthrough_routes"
+                      className="mt-4"
+                      help={
+                        premiumUser
+                          ? "Select existing pass through routes or enter new ones"
+                          : "Premium feature - Upgrade to set pass through routes by key"
+                      }
+                    >
+                      {(control) => (
+                        <PassThroughRoutesSelector
+                          value={control.value as string[] | undefined}
+                          onChange={control.onChange}
+                          accessToken={accessToken}
+                          placeholder={
+                            !premiumUser
+                              ? "Premium feature - Upgrade to set pass through routes by key"
+                              : "Select or enter pass through routes"
+                          }
+                          disabled={!premiumUser}
+                          teamId={selectedCreateKeyTeam ? selectedCreateKeyTeam.team_id : null}
+                        />
+                      )}
+                    </MountedFormField>
+                    <MountedFormField
+                      label={
+                        <span>
+                          Allowed Vector Stores{" "}
+                          <Tooltip title="Select which vector stores this key can access. If none selected, the key will have access to all available vector stores">
+                            <InfoCircleOutlined style={{ marginLeft: "4px" }} />
+                          </Tooltip>
+                        </span>
+                      }
+                      name="allowed_vector_store_ids"
+                      className="mt-4"
+                      help="Select vector stores this key can access. Leave empty for access to all vector stores"
+                    >
+                      {(control) => (
+                        <VectorStoreSelector
+                          onChange={control.onChange}
+                          value={control.value as string[] | undefined}
+                          accessToken={accessToken}
+                          placeholder="Select vector stores (optional)"
+                        />
+                      )}
+                    </MountedFormField>
+                    <MountedFormField
+                      label={
+                        <span>
+                          Metadata{" "}
+                          <Tooltip title="JSON object with additional information about this key. Used for tracking or custom logic">
+                            <InfoCircleOutlined style={{ marginLeft: "4px" }} />
+                          </Tooltip>
+                        </span>
+                      }
+                      name="metadata"
+                      className="mt-4"
+                    >
+                      {(control) => (
+                        <AntdInput.TextArea
+                          {...control}
+                          value={control.value as string | undefined}
+                          rows={4}
+                          placeholder="Enter metadata as JSON"
+                        />
+                      )}
+                    </MountedFormField>
+                    <MountedFormField
+                      label={
+                        <span>
+                          Tags{" "}
+                          <Tooltip title="Tags for tracking spend and/or doing tag-based routing. Used for analytics and filtering">
+                            <InfoCircleOutlined style={{ marginLeft: "4px" }} />
+                          </Tooltip>
+                        </span>
+                      }
+                      name="tags"
+                      className="mt-4"
+                      help={`Tags for tracking spend and/or doing tag-based routing.`}
+                    >
+                      {(control) => (
+                        <Select
+                          {...control}
+                          value={control.value as string[] | undefined}
+                          mode="tags"
+                          style={{ width: "100%" }}
+                          placeholder="Select or enter tags"
+                          tokenSeparators={[","]}
+                          options={tagOptions}
+                        />
+                      )}
+                    </MountedFormField>
                     <Collapsible className="mt-4 mb-4 overflow-hidden rounded-lg border">
                       <CollapsibleTrigger className={SECTION_HEADER_CLASS}>
-                        <b>Logging Settings</b>
+                        <b>MCP Settings</b>
                         <ChevronDown className={SECTION_CHEVRON_CLASS} />
                       </CollapsibleTrigger>
                       <CollapsibleContent className="px-4 pb-3">
-                        <div className="mt-4">
-                          <PremiumLoggingSettings
-                            value={loggingSettings}
-                            onChange={setLoggingSettings}
-                            premiumUser={true}
-                            disabledCallbacks={disabledCallbacks}
-                            onDisabledCallbacksChange={setDisabledCallbacks}
+                        <MountedFormField
+                          label={
+                            <span>
+                              Allowed MCP Servers{" "}
+                              <Tooltip title="Select which MCP servers or access groups this key can access">
+                                <InfoCircleOutlined style={{ marginLeft: "4px" }} />
+                              </Tooltip>
+                            </span>
+                          }
+                          name="allowed_mcp_servers_and_groups"
+                          help="Select MCP servers or access groups this key can access"
+                        >
+                          {(control) => (
+                            <MCPServerSelector
+                              onChange={control.onChange}
+                              value={control.value as McpSelectorValue | undefined}
+                              accessToken={accessToken}
+                              teamId={selectedCreateKeyTeam?.team_id ?? null}
+                              placeholder="Select MCP servers or access groups (optional)"
+                              allowNoMcpServers
+                            />
+                          )}
+                        </MountedFormField>
+
+                        {/* Hidden field to register mcp_tool_permissions with the form */}
+                        <MountedFormField name="mcp_tool_permissions" bare>
+                          {(control) => <input type="hidden" id={control.id} name={control.name} />}
+                        </MountedFormField>
+
+                        <McpToolPermissionsField
+                          accessToken={accessToken}
+                          control={form.control}
+                          setValue={form.setValue}
+                        />
+                      </CollapsibleContent>
+                    </Collapsible>
+
+                    <Collapsible className="mt-4 mb-4 overflow-hidden rounded-lg border">
+                      <CollapsibleTrigger className={SECTION_HEADER_CLASS}>
+                        <b>Agent Settings</b>
+                        <ChevronDown className={SECTION_CHEVRON_CLASS} />
+                      </CollapsibleTrigger>
+                      <CollapsibleContent className="px-4 pb-3">
+                        <MountedFormField
+                          label={
+                            <span>
+                              Allowed Agents{" "}
+                              <Tooltip title="Select which agents or access groups this key can access">
+                                <InfoCircleOutlined style={{ marginLeft: "4px" }} />
+                              </Tooltip>
+                            </span>
+                          }
+                          name="allowed_agents_and_groups"
+                          help="Select agents or access groups this key can access"
+                        >
+                          {(control) => (
+                            <AgentSelector
+                              onChange={control.onChange}
+                              value={control.value as AgentSelectorValue | undefined}
+                              accessToken={accessToken}
+                              placeholder="Select agents or access groups (optional)"
+                            />
+                          )}
+                        </MountedFormField>
+                      </CollapsibleContent>
+                    </Collapsible>
+
+                    {premiumUser ? (
+                      <Collapsible className="mt-4 mb-4 overflow-hidden rounded-lg border">
+                        <CollapsibleTrigger className={SECTION_HEADER_CLASS}>
+                          <b>Logging Settings</b>
+                          <ChevronDown className={SECTION_CHEVRON_CLASS} />
+                        </CollapsibleTrigger>
+                        <CollapsibleContent className="px-4 pb-3">
+                          <div className="mt-4">
+                            <PremiumLoggingSettings
+                              value={loggingSettings}
+                              onChange={setLoggingSettings}
+                              premiumUser={true}
+                              disabledCallbacks={disabledCallbacks}
+                              onDisabledCallbacksChange={setDisabledCallbacks}
+                            />
+                          </div>
+                        </CollapsibleContent>
+                      </Collapsible>
+                    ) : (
+                      <Tooltip
+                        title={
+                          <span>
+                            Key-level logging settings is an enterprise feature, get in touch -
+                            <a href="https://www.litellm.ai/enterprise" target="_blank">
+                              https://www.litellm.ai/enterprise
+                            </a>
+                          </span>
+                        }
+                        placement="top"
+                      >
+                        <div style={{ position: "relative" }}>
+                          <div style={{ opacity: 0.5 }}>
+                            <Collapsible className="mt-4 mb-4 overflow-hidden rounded-lg border">
+                              <CollapsibleTrigger className={SECTION_HEADER_CLASS}>
+                                <b>Logging Settings</b>
+                                <ChevronDown className={SECTION_CHEVRON_CLASS} />
+                              </CollapsibleTrigger>
+                              <CollapsibleContent className="px-4 pb-3">
+                                <div className="mt-4">
+                                  <PremiumLoggingSettings
+                                    value={loggingSettings}
+                                    onChange={setLoggingSettings}
+                                    premiumUser={false}
+                                    disabledCallbacks={disabledCallbacks}
+                                    onDisabledCallbacksChange={setDisabledCallbacks}
+                                  />
+                                </div>
+                              </CollapsibleContent>
+                            </Collapsible>
+                          </div>
+                          <div style={{ position: "absolute", inset: 0, cursor: "not-allowed" }} />
+                        </div>
+                      </Tooltip>
+                    )}
+
+                    <Collapsible
+                      key={`router-settings-accordion-${routerSettingsKey}`}
+                      className="mt-4 mb-4 overflow-hidden rounded-lg border"
+                    >
+                      <CollapsibleTrigger className={SECTION_HEADER_CLASS}>
+                        <b>Router Settings</b>
+                        <ChevronDown className={SECTION_CHEVRON_CLASS} />
+                      </CollapsibleTrigger>
+                      <CollapsibleContent className="px-4 pb-3">
+                        <div className="mt-4 w-full">
+                          <RouterSettingsAccordion
+                            key={routerSettingsKey}
+                            accessToken={accessToken || ""}
+                            value={routerSettings || undefined}
+                            onChange={setRouterSettings}
+                            modelData={
+                              userModels.length > 0
+                                ? { data: userModels.map((model) => ({ model_name: model })) }
+                                : undefined
+                            }
                           />
                         </div>
                       </CollapsibleContent>
                     </Collapsible>
-                  ) : (
-                    <Tooltip
-                      title={
-                        <span>
-                          Key-level logging settings is an enterprise feature, get in touch -
-                          <a href="https://www.litellm.ai/enterprise" target="_blank">
-                            https://www.litellm.ai/enterprise
-                          </a>
-                        </span>
-                      }
-                      placement="top"
-                    >
-                      <div style={{ position: "relative" }}>
-                        <div style={{ opacity: 0.5 }}>
-                          <Collapsible className="mt-4 mb-4 overflow-hidden rounded-lg border">
-                            <CollapsibleTrigger className={SECTION_HEADER_CLASS}>
-                              <b>Logging Settings</b>
-                              <ChevronDown className={SECTION_CHEVRON_CLASS} />
-                            </CollapsibleTrigger>
-                            <CollapsibleContent className="px-4 pb-3">
-                              <div className="mt-4">
-                                <PremiumLoggingSettings
-                                  value={loggingSettings}
-                                  onChange={setLoggingSettings}
-                                  premiumUser={false}
-                                  disabledCallbacks={disabledCallbacks}
-                                  onDisabledCallbacksChange={setDisabledCallbacks}
-                                />
-                              </div>
-                            </CollapsibleContent>
-                          </Collapsible>
-                        </div>
-                        <div style={{ position: "absolute", inset: 0, cursor: "not-allowed" }} />
-                      </div>
-                    </Tooltip>
-                  )}
 
-                  <Collapsible
-                    key={`router-settings-accordion-${routerSettingsKey}`}
-                    className="mt-4 mb-4 overflow-hidden rounded-lg border"
-                  >
-                    <CollapsibleTrigger className={SECTION_HEADER_CLASS}>
-                      <b>Router Settings</b>
-                      <ChevronDown className={SECTION_CHEVRON_CLASS} />
-                    </CollapsibleTrigger>
-                    <CollapsibleContent className="px-4 pb-3">
-                      <div className="mt-4 w-full">
-                        <RouterSettingsAccordion
-                          key={routerSettingsKey}
-                          accessToken={accessToken || ""}
-                          value={routerSettings || undefined}
-                          onChange={setRouterSettings}
-                          modelData={
-                            userModels.length > 0
-                              ? { data: userModels.map((model) => ({ model_name: model })) }
-                              : undefined
-                          }
-                        />
-                      </div>
-                    </CollapsibleContent>
-                  </Collapsible>
-
-                  <Collapsible className="mt-4 mb-4 overflow-hidden rounded-lg border">
-                    <CollapsibleTrigger className={SECTION_HEADER_CLASS}>
-                      <b>Model Aliases</b>
-                      <ChevronDown className={SECTION_CHEVRON_CLASS} />
-                    </CollapsibleTrigger>
-                    <CollapsibleContent className="px-4 pb-3">
-                      <div className="mt-4">
-                        <p className="text-sm text-gray-600 mb-4">
-                          Create custom aliases for models that can be used in API calls. This allows you to create
-                          shortcuts for specific models.
-                        </p>
-                        <ModelAliasManager
-                          accessToken={accessToken}
-                          initialModelAliases={modelAliases}
-                          onAliasUpdate={setModelAliases}
-                          showExampleConfig={false}
-                        />
-                      </div>
-                    </CollapsibleContent>
-                  </Collapsible>
-
-                  <Collapsible className="mt-4 mb-4 overflow-hidden rounded-lg border">
-                    <CollapsibleTrigger className={SECTION_HEADER_CLASS}>
-                      <b>Key Lifecycle</b>
-                      <ChevronDown className={SECTION_CHEVRON_CLASS} />
-                    </CollapsibleTrigger>
-                    <CollapsibleContent className="px-4 pb-3">
-                      <div className="mt-4">
-                        <Form.Item name="duration" initialValue="" noStyle>
-                          <KeyLifecycleSettings
-                            autoRotationEnabled={autoRotationEnabled}
-                            onAutoRotationChange={setAutoRotationEnabled}
-                            rotationInterval={rotationInterval}
-                            onRotationIntervalChange={setRotationInterval}
-                            isCreateMode={true}
+                    <Collapsible className="mt-4 mb-4 overflow-hidden rounded-lg border">
+                      <CollapsibleTrigger className={SECTION_HEADER_CLASS}>
+                        <b>Model Aliases</b>
+                        <ChevronDown className={SECTION_CHEVRON_CLASS} />
+                      </CollapsibleTrigger>
+                      <CollapsibleContent className="px-4 pb-3">
+                        <div className="mt-4">
+                          <p className="text-sm text-muted-foreground mb-4">
+                            Create custom aliases for models that can be used in API calls. This allows you to create
+                            shortcuts for specific models.
+                          </p>
+                          <ModelAliasManager
+                            accessToken={accessToken}
+                            initialModelAliases={modelAliases}
+                            onAliasUpdate={setModelAliases}
+                            showExampleConfig={false}
                           />
-                        </Form.Item>
-                      </div>
-                    </CollapsibleContent>
-                  </Collapsible>
-                  <Collapsible className="mt-4 mb-4 overflow-hidden rounded-lg border">
-                    <CollapsibleTrigger className={SECTION_HEADER_CLASS}>
-                      <div className="flex items-center gap-2">
-                        <b>Advanced Settings</b>
-                        <Tooltip
-                          title={
-                            <span>
-                              Learn more about advanced settings in our{" "}
-                              <a
-                                href={
-                                  proxyBaseUrl
-                                    ? `${proxyBaseUrl}/#/key%20management/generate_key_fn_key_generate_post`
-                                    : `/#/key%20management/generate_key_fn_key_generate_post`
-                                }
-                                target="_blank"
-                                rel="noopener noreferrer"
-                                className="text-blue-400 hover:text-blue-300"
-                              >
-                                documentation
-                              </a>
-                            </span>
-                          }
-                        >
-                          <InfoCircleOutlined className="text-gray-400 hover:text-gray-300 cursor-help" />
-                        </Tooltip>
-                      </div>
-                      <ChevronDown className={SECTION_CHEVRON_CLASS} />
-                    </CollapsibleTrigger>
-                    <CollapsibleContent className="px-4 pb-3">
-                      <SchemaFormFields
-                        schemaComponent="GenerateKeyRequest"
-                        form={form}
-                        excludedFields={[
-                          "key_alias",
-                          "team_id",
-                          "organization_id",
-                          "models",
-                          "duration",
-                          "metadata",
-                          "tags",
-                          "guardrails",
-                          "max_budget",
-                          "budget_duration",
-                          "tpm_limit",
-                          "rpm_limit",
-                          ...(disableCustomApiKeys ? ["key"] : []),
-                        ]}
-                      />
-                    </CollapsibleContent>
-                  </Collapsible>
-                </CollapsibleContent>
-              </Collapsible>
-            </div>
-          )}
+                        </div>
+                      </CollapsibleContent>
+                    </Collapsible>
 
-          <div style={{ textAlign: "right", marginTop: "10px" }}>
-            <Button2 htmlType="submit" disabled={isFormDisabled} style={{ opacity: isFormDisabled ? 0.5 : 1 }}>
-              Create Key
-            </Button2>
-          </div>
-        </Form>
+                    <Collapsible className="mt-4 mb-4 overflow-hidden rounded-lg border">
+                      <CollapsibleTrigger className={SECTION_HEADER_CLASS}>
+                        <b>Key Lifecycle</b>
+                        <ChevronDown className={SECTION_CHEVRON_CLASS} />
+                      </CollapsibleTrigger>
+                      <CollapsibleContent className="px-4 pb-3">
+                        <div className="mt-4">
+                          <MountedFormField name="duration" bare>
+                            {(control) => (
+                              <KeyLifecycleSettings
+                                id={control.id}
+                                value={control.value as string | undefined}
+                                onChange={control.onChange}
+                                autoRotationEnabled={autoRotationEnabled}
+                                onAutoRotationChange={setAutoRotationEnabled}
+                                rotationInterval={rotationInterval}
+                                onRotationIntervalChange={setRotationInterval}
+                                isCreateMode={true}
+                              />
+                            )}
+                          </MountedFormField>
+                        </div>
+                      </CollapsibleContent>
+                    </Collapsible>
+                    <Collapsible className="mt-4 mb-4 overflow-hidden rounded-lg border">
+                      <CollapsibleTrigger className={SECTION_HEADER_CLASS}>
+                        <div className="flex items-center gap-2">
+                          <b>Advanced Settings</b>
+                          <Tooltip
+                            title={
+                              <span>
+                                Learn more about advanced settings in our{" "}
+                                <a
+                                  href={
+                                    proxyBaseUrl
+                                      ? `${proxyBaseUrl}/#/key%20management/generate_key_fn_key_generate_post`
+                                      : `/#/key%20management/generate_key_fn_key_generate_post`
+                                  }
+                                  target="_blank"
+                                  rel="noopener noreferrer"
+                                  className="text-blue-400 hover:text-blue-300"
+                                >
+                                  documentation
+                                </a>
+                              </span>
+                            }
+                          >
+                            <InfoCircleOutlined className="text-muted-foreground hover:text-foreground cursor-help" />
+                          </Tooltip>
+                        </div>
+                        <ChevronDown className={SECTION_CHEVRON_CLASS} />
+                      </CollapsibleTrigger>
+                      <CollapsibleContent className="px-4 pb-3">
+                        <SchemaFormFields
+                          schemaComponent="GenerateKeyRequest"
+                          setValue={form.setValue}
+                          excludedFields={[
+                            "key_alias",
+                            "team_id",
+                            "organization_id",
+                            "models",
+                            "duration",
+                            "metadata",
+                            "tags",
+                            "guardrails",
+                            "max_budget",
+                            "budget_duration",
+                            "tpm_limit",
+                            "rpm_limit",
+                            ...(disableCustomApiKeys ? ["key"] : []),
+                          ]}
+                        />
+                      </CollapsibleContent>
+                    </Collapsible>
+                  </CollapsibleContent>
+                </Collapsible>
+              </div>
+            )}
+
+            <div style={{ textAlign: "right", marginTop: "10px" }}>
+              <Button2 htmlType="submit" disabled={isFormDisabled} style={{ opacity: isFormDisabled ? 0.5 : 1 }}>
+                Create Key
+              </Button2>
+            </div>
+          </form>
+        </MountedFormProvider>
       </Modal>
 
       {/* Add the Create User Modal */}
@@ -1751,7 +1756,7 @@ const CreateKey: React.FC<CreateKeyProps> = ({ team, teams, data, addKey, autoOp
       {apiKey && (
         <Modal open={isModalVisible} onOk={handleOk} onCancel={handleCancel} footer={null}>
           <div className="grid grid-cols-1 gap-2 w-full">
-            <h3 className="text-lg font-medium text-gray-900">Save your Key</h3>
+            <h3 className="text-lg font-medium text-foreground">Save your Key</h3>
             {apiKey != null ? (
               <CreatedKeyDisplay apiKey={apiKey} />
             ) : (
diff --git a/ui/litellm-dashboard/src/components/shared/Alert.tsx b/ui/litellm-dashboard/src/components/shared/Alert.tsx
index 6acf5a987d9..718957b4f08 100644
--- a/ui/litellm-dashboard/src/components/shared/Alert.tsx
+++ b/ui/litellm-dashboard/src/components/shared/Alert.tsx
@@ -9,9 +9,8 @@ const alertVariants = cva({
     variant: {
       default: "bg-card text-card-foreground",
       destructive: "bg-card text-destructive *:data-[slot=alert-description]:text-destructive/90 *:[svg]:text-current",
-      info: "border-blue-200 bg-blue-50 text-blue-900 *:data-[slot=alert-description]:text-blue-800 *:[svg]:text-blue-600",
-      warning:
-        "border-amber-200 bg-amber-50 text-amber-900 *:data-[slot=alert-description]:text-amber-800 *:[svg]:text-amber-600",
+      info: "border-info/20 bg-info/5 text-info *:[svg]:text-current",
+      warning: "border-warning/20 bg-warning/5 text-warning *:[svg]:text-current",
       error: "border-red-200 bg-red-50 text-red-900 *:data-[slot=alert-description]:text-red-800 *:[svg]:text-red-600",
     },
   },
diff --git a/ui/litellm-dashboard/src/components/shared/InheritedBudgetHint.tsx b/ui/litellm-dashboard/src/components/shared/InheritedBudgetHint.tsx
index 6be1dad564f..5fc80758cfd 100644
--- a/ui/litellm-dashboard/src/components/shared/InheritedBudgetHint.tsx
+++ b/ui/litellm-dashboard/src/components/shared/InheritedBudgetHint.tsx
@@ -1,6 +1,6 @@
 "use client";
 
-import { Tooltip } from "@/components/atoms/Tooltip";
+import { SimpleTooltip } from "@/components/ui/tooltip";
 import type { Team } from "@/components/key_team_helpers/key_list";
 import type { Organization } from "@/components/networking";
 import { formatNumberWithCommas } from "@/utils/dataUtils";
@@ -53,7 +53,7 @@ interface InheritedBudgetHintProps {
 export function InheritedBudgetHint({ gates }: InheritedBudgetHintProps) {
   if (gates.length === 0) return null;
   return (
-    <Tooltip
+    <SimpleTooltip
       content={
         <div data-testid="inherited-budget-hint" className="flex flex-col gap-1">
           <span>This key has no budget of its own, but its spend still counts toward:</span>
diff --git a/ui/litellm-dashboard/src/components/shared/MultiSelect.test.tsx b/ui/litellm-dashboard/src/components/shared/MultiSelect.test.tsx
index 908c22b5d67..6fe2f0fe51c 100644
--- a/ui/litellm-dashboard/src/components/shared/MultiSelect.test.tsx
+++ b/ui/litellm-dashboard/src/components/shared/MultiSelect.test.tsx
@@ -92,4 +92,18 @@ describe("MultiSelect", () => {
     expect(screen.queryByText('Create "vs-typed"')).not.toBeInTheDocument();
     expect(await screen.findByText("No options found")).toBeInTheDocument();
   });
+
+  it("marks a disabled option as disabled and refuses to select it", async () => {
+    const { onValueChange, input } = renderMultiSelect({
+      options: [OPTIONS[0], { ...OPTIONS[1], disabled: true }],
+    });
+
+    await openPopup(input);
+    const disabledOption = screen.getByRole("option", { name: /beta-kb/ });
+    expect(disabledOption).toHaveAttribute("aria-disabled", "true");
+
+    await userEvent.click(disabledOption);
+
+    expect(onValueChange).not.toHaveBeenCalled();
+  });
 });
diff --git a/ui/litellm-dashboard/src/components/shared/MultiSelect.tsx b/ui/litellm-dashboard/src/components/shared/MultiSelect.tsx
index 49695b56d44..c60a019db06 100644
--- a/ui/litellm-dashboard/src/components/shared/MultiSelect.tsx
+++ b/ui/litellm-dashboard/src/components/shared/MultiSelect.tsx
@@ -18,6 +18,7 @@ export interface MultiSelectOption {
   label: string;
   value: string;
   description?: string;
+  disabled?: boolean;
 }
 
 interface MultiSelectProps {
@@ -116,7 +117,7 @@ export function MultiSelect({
         <ComboboxEmpty>{emptyText}</ComboboxEmpty>
         <ComboboxList>
           {(option: MultiSelectOption) => (
-            <ComboboxItem key={option.value} value={option}>
+            <ComboboxItem key={option.value} value={option} disabled={option.disabled}>
               <span className="min-w-0">
                 <span className="block truncate">{option.label}</span>
                 {option.description && (
diff --git a/ui/litellm-dashboard/src/components/shared/form/LabelWithHint.tsx b/ui/litellm-dashboard/src/components/shared/form/LabelWithHint.tsx
new file mode 100644
index 00000000000..475351e6272
--- /dev/null
+++ b/ui/litellm-dashboard/src/components/shared/form/LabelWithHint.tsx
@@ -0,0 +1,34 @@
+"use client";
+
+import { CircleHelp } from "lucide-react";
+import React from "react";
+
+import { Tooltip, TooltipContent, TooltipTrigger } from "@/components/ui/tooltip";
+
+const hintIconClassName = "size-3.5 shrink-0 cursor-help text-muted-foreground";
+
+export const labelWithHint = (label: React.ReactNode, hint: React.ReactNode): React.ReactNode => (
+  <>
+    {label}
+    <Tooltip>
+      <TooltipTrigger render={<CircleHelp className={hintIconClassName} />} />
+      <TooltipContent>{hint}</TooltipContent>
+    </Tooltip>
+  </>
+);
+
+export const labelWithDocsHint = (label: React.ReactNode, hint: React.ReactNode, href: string): React.ReactNode => (
+  <>
+    {label}
+    <Tooltip>
+      <TooltipTrigger
+        render={
+          <a href={href} target="_blank" rel="noopener noreferrer" onClick={(event) => event.stopPropagation()}>
+            <CircleHelp className={hintIconClassName} />
+          </a>
+        }
+      />
+      <TooltipContent>{hint}</TooltipContent>
+    </Tooltip>
+  </>
+);
diff --git a/ui/litellm-dashboard/src/components/shared/numerical_input.tsx b/ui/litellm-dashboard/src/components/shared/numerical_input.tsx
index 2356bd5600f..604651f3d15 100644
--- a/ui/litellm-dashboard/src/components/shared/numerical_input.tsx
+++ b/ui/litellm-dashboard/src/components/shared/numerical_input.tsx
@@ -22,17 +22,13 @@ interface NumericalInputProps {
  * @param {Function} [props.onChange] - On change handler
  * @param {any} props.rest - Additional props passed to Input
  */
-const NumericalInput: React.FC<NumericalInputProps> = ({
-  step = 0.01,
-  style = { width: "100%" },
-  placeholder = "Enter a numerical value",
-  min,
-  max,
-  onChange,
-  ...rest
-}) => {
-  return (
+const NumericalInput = React.forwardRef<HTMLInputElement, NumericalInputProps>(
+  (
+    { step = 0.01, style = { width: "100%" }, placeholder = "Enter a numerical value", min, max, onChange, ...rest },
+    ref,
+  ) => (
     <Input
+      ref={ref}
       type="number"
       onWheel={(event) => event.currentTarget.blur()}
       step={step}
@@ -43,7 +39,8 @@ const NumericalInput: React.FC<NumericalInputProps> = ({
       onChange={onChange}
       {...rest}
     />
-  );
-};
+  ),
+);
+NumericalInput.displayName = "NumericalInput";
 
 export default NumericalInput;
diff --git a/ui/litellm-dashboard/src/components/team/GuardrailsSelect.tsx b/ui/litellm-dashboard/src/components/team/GuardrailsSelect.tsx
new file mode 100644
index 00000000000..74d5048d82b
--- /dev/null
+++ b/ui/litellm-dashboard/src/components/team/GuardrailsSelect.tsx
@@ -0,0 +1,133 @@
+"use client";
+
+import { Globe } from "lucide-react";
+import React, { useState } from "react";
+
+import {
+  Combobox,
+  ComboboxChip,
+  ComboboxChips,
+  ComboboxChipsInput,
+  ComboboxCollection,
+  ComboboxContent,
+  ComboboxEmpty,
+  ComboboxGroup,
+  ComboboxItem,
+  ComboboxLabel,
+  ComboboxList,
+  ComboboxValue,
+  useComboboxAnchor,
+} from "@/components/ui/combobox";
+
+export interface GuardrailOption {
+  name: string;
+  disabled: boolean;
+}
+
+interface GuardrailGroup {
+  label: string;
+  icon: boolean;
+  items: GuardrailOption[];
+}
+
+interface GuardrailsSelectProps {
+  id?: string;
+  value: string[];
+  onValueChange: (value: string[]) => void;
+  globalGuardrails: readonly GuardrailOption[];
+  otherGuardrails: readonly GuardrailOption[];
+  globalGuardrailNames: ReadonlySet<string>;
+  placeholder?: string;
+  emptyText?: string;
+}
+
+const matchesQuery = (option: GuardrailOption, query: string): boolean =>
+  option.name.toLowerCase().includes(query.trim().toLowerCase());
+
+export const GuardrailsSelect: React.FC<GuardrailsSelectProps> = ({
+  id,
+  value,
+  onValueChange,
+  globalGuardrails,
+  otherGuardrails,
+  globalGuardrailNames,
+  placeholder = "Select guardrails",
+  emptyText = "No guardrails found",
+}) => {
+  const anchor = useComboboxAnchor();
+  const [query, setQuery] = useState("");
+
+  const known = [...globalGuardrails, ...otherGuardrails];
+  const selected = value.map((name) => known.find((option) => option.name === name) ?? { name, disabled: false });
+  const grouped = globalGuardrails.length > 0 && otherGuardrails.length > 0;
+  const groups: GuardrailGroup[] = grouped
+    ? [
+        { label: "Global", icon: true, items: [...globalGuardrails] },
+        { label: "Other", icon: false, items: [...otherGuardrails] },
+      ]
+    : [{ label: "", icon: false, items: known }];
+
+  return (
+    <Combobox
+      multiple
+      items={groups}
+      value={selected}
+      onValueChange={(next: GuardrailOption[]) => {
+        setQuery("");
+        onValueChange(next.map((option) => option.name));
+      }}
+      inputValue={query}
+      onInputValueChange={setQuery}
+      isItemEqualToValue={(option: GuardrailOption, other: GuardrailOption) => option.name === other.name}
+      itemToStringLabel={(option: GuardrailOption) => option.name}
+      filter={matchesQuery}
+      openOnInputClick
+    >
+      <ComboboxChips render={<div ref={anchor} />} className="min-h-8 py-1 text-sm">
+        <ComboboxValue>
+          {(chips: GuardrailOption[]) => (
+            <>
+              {chips.map((option) => (
+                <ComboboxChip key={option.name} aria-label={option.name}>
+                  {globalGuardrailNames.has(option.name) && <Globe className="size-3" aria-label="Global guardrail" />}
+                  {option.name}
+                </ComboboxChip>
+              ))}
+              <ComboboxChipsInput id={id} placeholder={placeholder} className="min-w-24" aria-label={placeholder} />
+            </>
+          )}
+        </ComboboxValue>
+      </ComboboxChips>
+      <ComboboxContent anchor={anchor}>
+        <ComboboxEmpty>{emptyText}</ComboboxEmpty>
+        <ComboboxList>
+          {(group: GuardrailGroup) => (
+            <ComboboxGroup key={group.label} items={group.items}>
+              {group.label !== "" && (
+                <ComboboxLabel>
+                  {group.icon ? <Globe className="mr-1 inline size-3" aria-hidden="true" /> : null}
+                  {group.label}
+                </ComboboxLabel>
+              )}
+              <ComboboxCollection>
+                {(option: GuardrailOption) => (
+                  <ComboboxItem
+                    key={option.name}
+                    value={option}
+                    title={option.name}
+                    disabled={option.disabled}
+                    aria-label={option.name}
+                  >
+                    {option.name}
+                  </ComboboxItem>
+                )}
+              </ComboboxCollection>
+            </ComboboxGroup>
+          )}
+        </ComboboxList>
+      </ComboboxContent>
+    </Combobox>
+  );
+};
+
+export default GuardrailsSelect;
diff --git a/ui/litellm-dashboard/src/components/team/LoggingSettings.test.tsx b/ui/litellm-dashboard/src/components/team/LoggingSettings.test.tsx
index 17f20ad0dcc..ae02a26ddb0 100644
--- a/ui/litellm-dashboard/src/components/team/LoggingSettings.test.tsx
+++ b/ui/litellm-dashboard/src/components/team/LoggingSettings.test.tsx
@@ -1,9 +1,19 @@
+import { readFileSync } from "fs";
+import { resolve } from "path";
 import React from "react";
 import { describe, it, expect, vi, beforeEach } from "vitest";
 import userEvent from "@testing-library/user-event";
 import { renderWithProviders, screen, fireEvent } from "../../../tests/test-utils";
 import LoggingSettings from "./LoggingSettings";
 
+const SOURCE_PATH = resolve(process.cwd(), "src/components/team/LoggingSettings.tsx");
+
+const HARDCODED_PALETTE =
+  /\b(?:text|bg|border|hover:bg|hover:text|hover:border|dark:bg|dark:text|dark:border|ring|divide|fill|stroke)-(?:gray|slate|zinc|neutral|stone|red|blue|green|yellow|amber|orange|indigo|purple|pink|rose|teal|cyan|sky|violet|fuchsia|lime|emerald)-\d+(?:\/\d+)?\b/g;
+
+const SEMANTIC_TOKEN =
+  /\b(?:text|bg|border|hover:bg|hover:text|ring|divide|fill|stroke)-(?:foreground|muted-foreground|muted|background|card|popover|primary|secondary|destructive|border|input|accent|ring)(?:-foreground)?(?:\/\d+)?\b/g;
+
 describe("LoggingSettings", () => {
   beforeEach(() => {
     vi.clearAllMocks();
@@ -163,6 +173,33 @@ describe("LoggingSettings", () => {
     expect(screen.getByText("C")).toBeInTheDocument();
   });
 
+  it("styles itself from semantic tokens instead of hardcoded palette classes", () => {
+    const source = readFileSync(SOURCE_PATH, "utf8");
+
+    expect(source).toContain("const LoggingSettings");
+    expect(source.match(SEMANTIC_TOKEN) ?? []).not.toHaveLength(0);
+    expect(source.match(HARDCODED_PALETTE) ?? []).toHaveLength(0);
+  });
+
+  it("reports the chosen event type when a different option is picked", async () => {
+    const user = userEvent.setup({ delay: null });
+    const mockOnChange = vi.fn();
+    const initialValue = [
+      {
+        callback_name: "langsmith",
+        callback_type: "success",
+        callback_vars: {},
+      },
+    ];
+
+    renderWithProviders(<LoggingSettings value={initialValue} onChange={mockOnChange} />);
+
+    await user.click(screen.getByTitle("Success Only"));
+    await user.click(await screen.findByTitle("Failure Only"));
+
+    expect(mockOnChange).toHaveBeenCalledWith([expect.objectContaining({ callback_type: "failure" })]);
+  });
+
   it("correctly handles numerical input with decimal values", () => {
     const mockOnChange = vi.fn();
 
diff --git a/ui/litellm-dashboard/src/components/team/LoggingSettings.tsx b/ui/litellm-dashboard/src/components/team/LoggingSettings.tsx
index eee6e76569d..159f8fa0b74 100644
--- a/ui/litellm-dashboard/src/components/team/LoggingSettings.tsx
+++ b/ui/litellm-dashboard/src/components/team/LoggingSettings.tsx
@@ -1,8 +1,10 @@
 /* eslint-disable react/no-unescaped-entities */
 import React from "react";
-import { Select, Tooltip, Divider } from "antd";
+import { SimpleTooltip } from "@/components/ui/tooltip";
+import { Select, Divider } from "antd";
 import { InfoCircleOutlined } from "@ant-design/icons";
 import { Button } from "@/components/ui/button";
+import { Badge } from "@/components/ui/badge";
 import { Card } from "@/components/ui/card";
 import { Input } from "@/components/ui/input";
 import { InputGroup, InputGroupAddon, InputGroupButton, InputGroupInput } from "@/components/ui/input-group";
@@ -142,30 +144,24 @@ const LoggingSettings: React.FC<LoggingSettingsProps> = ({
     if (Object.keys(dynamicParams).length === 0) return null;
 
     return (
-      <div className="mt-6 pt-4 border-t border-gray-100">
+      <div className="mt-6 pt-4 border-t border-border">
         <div className="flex items-center space-x-2 mb-4">
-          <div className="w-3 h-3 bg-blue-100 rounded-full flex items-center justify-center">
-            <div className="w-1.5 h-1.5 bg-blue-500 rounded-full"></div>
+          <div className="w-3 h-3 bg-muted rounded-full flex items-center justify-center">
+            <div className="w-1.5 h-1.5 bg-primary rounded-full"></div>
           </div>
-          <span className="text-sm font-medium text-gray-700">Integration Parameters</span>
+          <span className="text-sm font-medium text-foreground">Integration Parameters</span>
         </div>
         <div className="grid grid-cols-1 gap-4">
           {Object.entries(dynamicParams).map(([paramName, paramType]) => (
             <div key={paramName} className="space-y-2">
-              <label className="text-sm font-medium text-gray-700 capitalize flex items-center space-x-1">
+              <label className="text-sm font-medium text-foreground capitalize flex items-center space-x-1">
                 <span>{paramName.replace(/_/g, " ")}</span>
-                {paramType === "password" && (
-                  <span className="inline-flex items-center px-2 py-0.5 rounded-sm text-xs font-medium bg-yellow-100 text-yellow-800">
-                    Sensitive
-                  </span>
-                )}
-                {paramType === "number" && (
-                  <span className="inline-flex items-center px-2 py-0.5 rounded-sm text-xs font-medium bg-yellow-100 text-yellow-800">
-                    Number
-                  </span>
-                )}
+                {paramType === "password" && <Badge variant="secondary">Sensitive</Badge>}
+                {paramType === "number" && <Badge variant="secondary">Number</Badge>}
               </label>
-              {paramType === "number" && <span className="text-xs text-gray-500">Value must be between 0 and 1</span>}
+              {paramType === "number" && (
+                <span className="text-xs text-muted-foreground">Value must be between 0 and 1</span>
+              )}
               {paramType === "number" ? (
                 <NumericalInput
                   step={0.01}
@@ -194,15 +190,15 @@ const LoggingSettings: React.FC<LoggingSettingsProps> = ({
       {/* Disabled Callbacks Section */}
       <div className="space-y-4">
         <div className="flex items-center space-x-2">
-          <BanIcon className="w-5 h-5 text-red-500" />
-          <span className="text-base font-semibold text-gray-800">Disabled Callbacks</span>
-          <Tooltip title="Select callbacks to disable for this key. Disabled callbacks will not receive any logging data.">
-            <InfoCircleOutlined className="text-gray-400 cursor-help" />
-          </Tooltip>
+          <BanIcon className="w-5 h-5 text-destructive" />
+          <span className="text-base font-semibold text-foreground">Disabled Callbacks</span>
+          <SimpleTooltip content="Select callbacks to disable for this key. Disabled callbacks will not receive any logging data.">
+            <InfoCircleOutlined className="text-muted-foreground cursor-help" />
+          </SimpleTooltip>
         </div>
 
         <div className="space-y-2">
-          <label className="text-sm font-medium text-gray-700">Disabled Callbacks</label>
+          <label className="text-sm font-medium text-foreground">Disabled Callbacks</label>
           <Select
             mode="multiple"
             placeholder="Select callbacks to disable"
@@ -215,7 +211,7 @@ const LoggingSettings: React.FC<LoggingSettingsProps> = ({
               const description = callbackInfo[callbackName]?.description;
               return (
                 <Option key={callbackName} value={callbackName} label={callbackName}>
-                  <Tooltip title={description} placement="right">
+                  <SimpleTooltip content={description} side="right">
                     <div className="flex items-center space-x-2">
                       <Logo
                         src={callbackInfo[callbackName]?.logo}
@@ -224,12 +220,12 @@ const LoggingSettings: React.FC<LoggingSettingsProps> = ({
                       />
                       <span>{callbackName}</span>
                     </div>
-                  </Tooltip>
+                  </SimpleTooltip>
                 </Option>
               );
             })}
           </Select>
-          <div className="text-xs text-gray-500">
+          <div className="text-xs text-muted-foreground">
             Select callbacks that should be disabled for this key. These callbacks will not receive any logging data.
           </div>
         </div>
@@ -240,19 +236,13 @@ const LoggingSettings: React.FC<LoggingSettingsProps> = ({
       {/* Logging Integrations Section */}
       <div className="flex justify-between items-center">
         <div className="flex items-center space-x-2">
-          <CogIcon className="w-5 h-5 text-blue-500" />
-          <span className="text-base font-semibold text-gray-800">Logging Integrations</span>
-          <Tooltip title="Configure callback logging integrations for this team.">
-            <InfoCircleOutlined className="text-gray-400 cursor-help" />
-          </Tooltip>
+          <CogIcon className="w-5 h-5 text-foreground" />
+          <span className="text-base font-semibold text-foreground">Logging Integrations</span>
+          <SimpleTooltip content="Configure callback logging integrations for this team.">
+            <InfoCircleOutlined className="text-muted-foreground cursor-help" />
+          </SimpleTooltip>
         </div>
-        <Button
-          variant="secondary"
-          onClick={addLoggingConfig}
-          size="sm"
-          className="hover:border-blue-400 hover:text-blue-500"
-          type="button"
-        >
+        <Button variant="secondary" onClick={addLoggingConfig} size="sm" type="button">
           <Plus />
           Add Integration
         </Button>
@@ -267,7 +257,7 @@ const LoggingSettings: React.FC<LoggingSettingsProps> = ({
           return (
             <Card
               key={index}
-              className="block p-6 border border-gray-200 shadow-xs hover:shadow-md transition-shadow duration-200"
+              className="block p-6 border border-border shadow-xs hover:shadow-md transition-shadow duration-200"
             >
               <div className="flex justify-between items-start mb-4">
                 <div className="flex items-center space-x-2">
@@ -284,7 +274,7 @@ const LoggingSettings: React.FC<LoggingSettingsProps> = ({
                   variant="ghost"
                   onClick={() => removeLoggingConfig(index)}
                   size="sm"
-                  className="text-red-500 hover:bg-red-50 hover:text-red-500"
+                  className="text-destructive hover:bg-destructive/10 hover:text-destructive"
                   type="button"
                 >
                   <Trash2 />
@@ -294,7 +284,7 @@ const LoggingSettings: React.FC<LoggingSettingsProps> = ({
               <div className="space-y-4">
                 <div className="grid grid-cols-1 md:grid-cols-2 gap-4">
                   <div className="space-y-2">
-                    <label className="text-sm font-medium text-gray-700">Integration Type</label>
+                    <label className="text-sm font-medium text-foreground">Integration Type</label>
                     <Select
                       value={callbackDisplayName}
                       placeholder="Select integration"
@@ -306,7 +296,7 @@ const LoggingSettings: React.FC<LoggingSettingsProps> = ({
                         const description = callbackInfo[callbackName]?.description;
                         return (
                           <Option key={callbackName} value={callbackName} label={callbackName}>
-                            <Tooltip title={description} placement="right">
+                            <SimpleTooltip content={description} side="right">
                               <div className="flex items-center space-x-2">
                                 <Logo
                                   src={callbackInfo[callbackName]?.logo}
@@ -315,7 +305,7 @@ const LoggingSettings: React.FC<LoggingSettingsProps> = ({
                                 />
                                 <span>{callbackName}</span>
                               </div>
-                            </Tooltip>
+                            </SimpleTooltip>
                           </Option>
                         );
                       })}
@@ -323,30 +313,15 @@ const LoggingSettings: React.FC<LoggingSettingsProps> = ({
                   </div>
 
                   <div className="space-y-2">
-                    <label className="text-sm font-medium text-gray-700">Event Type</label>
+                    <label className="text-sm font-medium text-foreground">Event Type</label>
                     <Select
                       value={config.callback_type}
                       onChange={(value) => updateLoggingConfig(index, "callback_type", value)}
                       className="w-full"
                     >
-                      <Option value="success">
-                        <div className="flex items-center space-x-2">
-                          <div className="w-2 h-2 bg-green-500 rounded-full"></div>
-                          <span>Success Only</span>
-                        </div>
-                      </Option>
-                      <Option value="failure">
-                        <div className="flex items-center space-x-2">
-                          <div className="w-2 h-2 bg-red-500 rounded-full"></div>
-                          <span>Failure Only</span>
-                        </div>
-                      </Option>
-                      <Option value="success_and_failure">
-                        <div className="flex items-center space-x-2">
-                          <div className="w-2 h-2 bg-blue-500 rounded-full"></div>
-                          <span>Success & Failure</span>
-                        </div>
-                      </Option>
+                      <Option value="success">Success Only</Option>
+                      <Option value="failure">Failure Only</Option>
+                      <Option value="success_and_failure">Success &amp; Failure</Option>
                     </Select>
                   </div>
                 </div>
@@ -359,10 +334,12 @@ const LoggingSettings: React.FC<LoggingSettingsProps> = ({
       </div>
 
       {value.length === 0 && (
-        <div className="text-center py-12 text-gray-500 border-2 border-dashed border-gray-200 rounded-lg bg-gray-50/50">
-          <CogIcon className="w-12 h-12 text-gray-300 mb-3 mx-auto" />
+        <div className="text-center py-12 text-muted-foreground border-2 border-dashed border-border rounded-lg bg-muted/30">
+          <CogIcon className="w-12 h-12 text-muted-foreground mb-3 mx-auto" />
           <div className="text-base font-medium mb-1">No logging integrations configured</div>
-          <div className="text-sm text-gray-400">Click "Add Integration" to configure logging for this team</div>
+          <div className="text-sm text-muted-foreground">
+            Click "Add Integration" to configure logging for this team
+          </div>
         </div>
       )}
     </div>
diff --git a/ui/litellm-dashboard/src/components/team/MyUserTab.tsx b/ui/litellm-dashboard/src/components/team/MyUserTab.tsx
index fd40c30e93b..9aae6a25dc2 100644
--- a/ui/litellm-dashboard/src/components/team/MyUserTab.tsx
+++ b/ui/litellm-dashboard/src/components/team/MyUserTab.tsx
@@ -1,6 +1,6 @@
 import { formatBudgetReset } from "@/utils/budgetUtils";
 import { formatNumberWithCommas } from "@/utils/dataUtils";
-import { Tooltip } from "@/components/atoms/Tooltip";
+import { SimpleTooltip } from "@/components/ui/tooltip";
 import { Badge } from "@/components/ui/badge";
 import { Card, CardContent } from "@/components/ui/card";
 import { CircleHelp } from "lucide-react";
@@ -14,9 +14,9 @@ interface MyUserTabProps {
 const labelWithTooltip = (label: string, tooltip: string) => (
   <span className="flex items-center gap-1 text-muted-foreground">
     {label}
-    <Tooltip content={tooltip}>
+    <SimpleTooltip content={tooltip}>
       <CircleHelp className="size-4" aria-label={`${label} information`} />
-    </Tooltip>
+    </SimpleTooltip>
   </span>
 );
 
diff --git a/ui/litellm-dashboard/src/components/team/TeamInfo.test.tsx b/ui/litellm-dashboard/src/components/team/TeamInfo.test.tsx
index 9df13a982ed..aeba85088bb 100644
--- a/ui/litellm-dashboard/src/components/team/TeamInfo.test.tsx
+++ b/ui/litellm-dashboard/src/components/team/TeamInfo.test.tsx
@@ -122,7 +122,9 @@ vi.mock("@/components/common_components/ModelAliasManager", () => ({
     <div>
       <div data-testid="alias-editor-initial">{JSON.stringify(initialModelAliases)}</div>
       <button onClick={() => onAliasUpdate({ "gpt-4o": "gpt-4" })}>Set Alias</button>
-      <button onClick={() => onAliasUpdate({})}>Clear Aliases</button>
+      <button type="button" onClick={() => onAliasUpdate({})}>
+        Clear Aliases
+      </button>
     </div>
   )),
 }));
@@ -658,7 +660,7 @@ describe("TeamInfoView", () => {
   });
 
   describe("settings and editing", () => {
-    const policiesFormFieldLabel = () => screen.queryByText("Policies", { selector: "span" });
+    const policiesFormFieldLabel = () => screen.queryByText("Policies", { selector: "label" });
 
     it("should offer the policies field and load it for a caller with the viewPolicies capability", async () => {
       const user = userEvent.setup({ delay: null });
@@ -1462,8 +1464,7 @@ describe("TeamInfoView", () => {
       await user.click(screen.getByLabelText(/^Guardrails/));
 
       const listbox = await screen.findByRole("listbox", {}, { timeout: 5000 });
-      // eslint-disable-next-line local/no-antd-class-selectors -- antd renders group headers outside the listbox and its popup container exposes no role or accessible name
-      return listbox.closest(".ant-select-dropdown") as HTMLElement;
+      return listbox.closest('[data-slot="combobox-content"]') as HTMLElement;
     };
 
     beforeEach(() => {
@@ -1660,3 +1661,310 @@ describe("TeamInfoView - which team member fields reach the update payload depen
     expect(payload.object_permission).toHaveProperty("search_tools");
   });
 });
+
+describe("TeamInfoView - the exact bytes the update call sends", () => {
+  const props = {
+    teamId: "123",
+    onUpdate: vi.fn(),
+    onClose: vi.fn(),
+    accessToken: "test-token",
+    is_team_admin: true,
+    is_proxy_admin: true,
+    userModels: ["gpt-4"],
+    editTeam: false,
+  };
+
+  beforeEach(seedDefaultMocks);
+
+  afterEach(() => {
+    vi.clearAllMocks();
+  });
+
+  const storedTeam = () =>
+    createMockTeamData({
+      models: ["gpt-4"],
+      max_budget: 100,
+      budget_duration: "1d",
+      tpm_limit: 1000,
+      rpm_limit: 1000,
+      team_member_budget_table: { max_budget: 42, budget_duration: "30d", tpm_limit: 11, rpm_limit: 22 },
+      default_team_member_models: ["gpt-4"],
+      object_permission: { search_tools: ["tool-a"], vector_stores: ["vs-1"] },
+    });
+
+  const openEditor = async (user: ReturnType<typeof userEvent.setup>) => {
+    vi.mocked(networking.teamInfoCall).mockResolvedValue(storedTeam());
+    vi.mocked(networking.teamUpdateCall).mockResolvedValue({ data: {}, team_id: "123" } as any);
+
+    renderWithProviders(<TeamInfoView {...props} />);
+    await waitFor(() => expect(screen.queryAllByText("Test Team").length).toBeGreaterThan(0));
+    await user.click(screen.getByRole("tab", { name: "Settings" }));
+    await user.click(await screen.findByRole("button", { name: /edit settings/i }));
+    await screen.findByLabelText("Team Name");
+  };
+
+  const save = async (user: ReturnType<typeof userEvent.setup>) => {
+    await user.click(screen.getByRole("button", { name: /save changes/i }));
+    await waitFor(() => expect(networking.teamUpdateCall).toHaveBeenCalled());
+    return vi.mocked(networking.teamUpdateCall).mock.calls[0][1] as Record<string, unknown>;
+  };
+
+  const wireBody = (payload: Record<string, unknown>) => JSON.parse(JSON.stringify(payload)) as Record<string, unknown>;
+
+  const alwaysSent = {
+    team_id: "123",
+    team_alias: "Test Team",
+    models: ["gpt-4"],
+    tpm_limit: 1000,
+    rpm_limit: 1000,
+    model_tpm_limit: {},
+    model_rpm_limit: {},
+    max_budget: 100,
+    soft_budget: null,
+    budget_duration: "1d",
+    metadata: {
+      allowed_passthrough_routes: [],
+      guardrails: [],
+      opted_out_global_guardrails: [],
+      disable_global_guardrails: false,
+      soft_budget_alerting_emails: [],
+    },
+    access_group_ids: [],
+  };
+
+  const mcpPermissions = {
+    mcp_servers: [],
+    mcp_access_groups: [],
+    mcp_tool_permissions: {},
+    mcp_toolsets: [],
+    vector_stores: ["vs-1"],
+  };
+
+  it("leaves every team member key out of the request body for an untouched save with both sections closed", async () => {
+    const user = userEvent.setup({ delay: null });
+    await openEditor(user);
+
+    const payload = await save(user);
+
+    expect(payload).toStrictEqual({
+      ...alwaysSent,
+      team_member_budget_duration: undefined,
+      object_permission: mcpPermissions,
+    });
+    expect(wireBody(payload)).toStrictEqual({
+      ...alwaysSent,
+      object_permission: mcpPermissions,
+    });
+  });
+
+  it("resends every stored value once both sections are opened", async () => {
+    const user = userEvent.setup({ delay: null });
+    await openEditor(user);
+
+    await user.click(screen.getByText("Team Member Settings"));
+    await screen.findByLabelText("Default Budget (USD)");
+    await user.click(screen.getByText("Search Tool Settings"));
+    await screen.findByPlaceholderText("Select search tools (optional, empty = all allowed)");
+
+    const payload = await save(user);
+
+    const expected = {
+      ...alwaysSent,
+      team_member_budget_duration: "30d",
+      team_member_budget: 42,
+      team_member_tpm_limit: 11,
+      team_member_rpm_limit: 22,
+      default_team_member_models: ["gpt-4"],
+      object_permission: { ...mcpPermissions, search_tools: ["tool-a"] },
+    };
+    expect(payload).toStrictEqual(expected);
+    expect(wireBody(payload)).toStrictEqual(expected);
+  });
+
+  it("carries every typed value to the update payload at the type and shape antd sends today", async () => {
+    const user = userEvent.setup({ delay: null });
+    await openEditor(user);
+
+    const alias = screen.getByLabelText("Team Name");
+    await user.clear(alias);
+    await user.type(alias, "Renamed Team");
+
+    const softBudget = screen.getByLabelText("Soft Budget (USD)");
+    await user.clear(softBudget);
+    await user.type(softBudget, "9.5");
+
+    const emails = screen.getByLabelText(/Soft Budget Alerting Emails/);
+    await user.clear(emails);
+    await user.type(emails, "a@test.com,  b@test.com ");
+
+    const tpm = screen.getByLabelText("Tokens per minute Limit (TPM)");
+    await user.clear(tpm);
+    await user.type(tpm, "555");
+
+    const payload = await save(user);
+
+    expect(payload.team_alias).toBe("Renamed Team");
+    expect(payload.soft_budget).toBe("9.5");
+    expect(payload.tpm_limit).toBe("555");
+    expect((payload.metadata as Record<string, unknown>).soft_budget_alerting_emails).toStrictEqual([
+      "a@test.com",
+      "b@test.com",
+    ]);
+  });
+
+  it("builds model_tpm_limit and model_rpm_limit from the model-specific rate limit rows", async () => {
+    const user = userEvent.setup({ delay: null });
+    vi.mocked(networking.teamInfoCall).mockResolvedValue(
+      createMockTeamData({
+        models: ["gpt-4"],
+        max_budget: 100,
+        budget_duration: "1d",
+        tpm_limit: 1000,
+        rpm_limit: 1000,
+        object_permission: { vector_stores: ["vs-1"] },
+        metadata: { model_tpm_limit: { "gpt-4": 30 }, model_rpm_limit: { "gpt-4": 40 } },
+      }),
+    );
+    vi.mocked(networking.teamUpdateCall).mockResolvedValue({ data: {}, team_id: "123" } as any);
+
+    renderWithProviders(<TeamInfoView {...props} />);
+    await waitFor(() => expect(screen.queryAllByText("Test Team").length).toBeGreaterThan(0));
+    await user.click(screen.getByRole("tab", { name: "Settings" }));
+    await user.click(await screen.findByRole("button", { name: /edit settings/i }));
+    await screen.findByLabelText("Team Name");
+
+    const payload = await save(user);
+
+    expect(payload.model_tpm_limit).toStrictEqual({ "gpt-4": 30 });
+    expect(payload.model_rpm_limit).toStrictEqual({ "gpt-4": 40 });
+  });
+
+  it("keeps a team member budget edited before the section is collapsed and resends it on reopen", async () => {
+    const user = userEvent.setup({ delay: null });
+    await openEditor(user);
+
+    await user.click(screen.getByText("Team Member Settings"));
+    const budgetInput = await screen.findByLabelText("Default Budget (USD)");
+    await user.clear(budgetInput);
+    await user.type(budgetInput, "77");
+
+    await user.click(screen.getByText("Team Member Settings"));
+    await waitFor(() => expect(screen.queryByLabelText("Default Budget (USD)")).not.toBeInTheDocument());
+
+    await user.click(screen.getByText("Team Member Settings"));
+    expect(await screen.findByLabelText("Default Budget (USD)")).toHaveValue(77);
+
+    const payload = await save(user);
+    expect(payload.team_member_budget).toBe(77);
+  });
+
+  it("sends no team member key at all when the section is collapsed again after an edit", async () => {
+    const user = userEvent.setup({ delay: null });
+    await openEditor(user);
+
+    await user.click(screen.getByText("Team Member Settings"));
+    const budgetInput = await screen.findByLabelText("Default Budget (USD)");
+    await user.clear(budgetInput);
+    await user.type(budgetInput, "77");
+
+    await user.click(screen.getByText("Team Member Settings"));
+    await waitFor(() => expect(screen.queryByLabelText("Default Budget (USD)")).not.toBeInTheDocument());
+
+    const payload = await save(user);
+
+    expect(Object.keys(wireBody(payload)).filter((key) => key.startsWith("team_member"))).toEqual([]);
+    expect(wireBody(payload)).not.toHaveProperty("default_team_member_models");
+  });
+
+  it("puts the global guardrails back on the team when the kill switch is turned off again", async () => {
+    const user = userEvent.setup({ delay: null });
+    testQueryClient.clear();
+    vi.mocked(networking.getGuardrailsList).mockResolvedValue({
+      guardrails: [
+        { guardrail_name: "always-on", litellm_params: { default_on: true } },
+        { guardrail_name: "opt-in", litellm_params: { default_on: false } },
+      ],
+    });
+    vi.mocked(networking.teamInfoCall).mockResolvedValue(
+      createMockTeamData({
+        models: ["gpt-4"],
+        metadata: { guardrails: ["opt-in"], disable_global_guardrails: true },
+      }),
+    );
+    vi.mocked(networking.teamUpdateCall).mockResolvedValue({ data: {}, team_id: "123" } as any);
+
+    renderWithProviders(<TeamInfoView {...props} premiumUser={true} />);
+    await waitFor(() => expect(screen.queryAllByText("Test Team").length).toBeGreaterThan(0));
+    await user.click(screen.getByRole("tab", { name: "Settings" }));
+    await user.click(await screen.findByRole("button", { name: /edit settings/i }));
+    await screen.findByLabelText("Team Name");
+
+    expect(screen.queryAllByLabelText("always-on")).toHaveLength(0);
+
+    await user.click(screen.getByRole("switch", { name: /Disable all global guardrails/ }));
+
+    expect(await screen.findAllByLabelText("always-on")).toHaveLength(1);
+
+    const payload = await save(user);
+
+    expect(payload.metadata).toStrictEqual(
+      expect.objectContaining({
+        guardrails: ["opt-in"],
+        opted_out_global_guardrails: [],
+        disable_global_guardrails: false,
+      }),
+    );
+  });
+
+  it("sends a typed model rate limit as a number", async () => {
+    const user = userEvent.setup({ delay: null });
+    vi.mocked(networking.teamInfoCall).mockResolvedValue(
+      createMockTeamData({ models: ["gpt-4"], metadata: { model_tpm_limit: { "gpt-4": 30 } } }),
+    );
+    vi.mocked(networking.teamUpdateCall).mockResolvedValue({ data: {}, team_id: "123" } as any);
+
+    renderWithProviders(<TeamInfoView {...props} />);
+    await waitFor(() => expect(screen.queryAllByText("Test Team").length).toBeGreaterThan(0));
+    await user.click(screen.getByRole("tab", { name: "Settings" }));
+    await user.click(await screen.findByRole("button", { name: /edit settings/i }));
+    await screen.findByLabelText("Team Name");
+
+    const rpmInput = await screen.findByPlaceholderText("RPM Limit");
+    await user.clear(rpmInput);
+    await user.type(rpmInput, "45");
+
+    const payload = await save(user);
+
+    expect(payload.model_rpm_limit).toStrictEqual({ "gpt-4": 45 });
+    expect(payload.model_tpm_limit).toStrictEqual({ "gpt-4": 30 });
+  });
+
+  it("leaves stored policies out of the update body for a caller without the viewPolicies capability", async () => {
+    const user = userEvent.setup({ delay: null });
+    can.mockReturnValue(false);
+    vi.mocked(networking.teamInfoCall).mockResolvedValue(createMockTeamData({ models: ["gpt-4"], policies: ["pci"] }));
+    vi.mocked(networking.teamUpdateCall).mockResolvedValue({ data: {}, team_id: "123" } as any);
+
+    renderWithProviders(<TeamInfoView {...props} />);
+    await waitFor(() => expect(screen.queryAllByText("Test Team").length).toBeGreaterThan(0));
+    await user.click(screen.getByRole("tab", { name: "Settings" }));
+    await user.click(await screen.findByRole("button", { name: /edit settings/i }));
+    await screen.findByLabelText("Team Name");
+
+    const payload = await save(user);
+
+    expect(payload).toHaveProperty("team_alias");
+    expect(wireBody(payload)).not.toHaveProperty("policies");
+  });
+
+  it("blocks the save on an empty team name and names the rule", async () => {
+    const user = userEvent.setup({ delay: null });
+    await openEditor(user);
+
+    await user.clear(screen.getByLabelText("Team Name"));
+    await user.click(screen.getByRole("button", { name: /save changes/i }));
+
+    expect(await screen.findByText("Please input a team name")).toBeInTheDocument();
+    expect(networking.teamUpdateCall).not.toHaveBeenCalled();
+  });
+});
diff --git a/ui/litellm-dashboard/src/components/team/TeamInfo.tsx b/ui/litellm-dashboard/src/components/team/TeamInfo.tsx
index 0f1d22e5b9a..c20f47a155b 100644
--- a/ui/litellm-dashboard/src/components/team/TeamInfo.tsx
+++ b/ui/litellm-dashboard/src/components/team/TeamInfo.tsx
@@ -20,24 +20,32 @@ import { formatNumberWithCommas } from "@/utils/dataUtils";
 import { mapEmptyStringToNull } from "@/utils/keyUpdateUtils";
 import type { ObjectPermission } from "@/components/object_permission_types";
 import { isProxyAdminRole } from "@/utils/roles";
-import {
-  EditOutlined,
-  GlobalOutlined,
-  InfoCircleOutlined,
-  MinusCircleOutlined,
-  PlusOutlined,
-  SaveOutlined,
-} from "@ant-design/icons";
+import { EditOutlined, InfoCircleOutlined } from "@ant-design/icons";
 import { ArrowLeftIcon } from "@heroicons/react/outline";
 import { StatusBadge, type StatusTone } from "@/components/shared/table_cells/status_badge";
 import { Badge } from "@/components/ui/badge";
 import { Card } from "@/components/ui/card";
 import { Collapsible, CollapsibleContent, CollapsibleTrigger } from "@/components/ui/collapsible";
 import { Input as UIInput } from "@/components/ui/input";
-import { Button, Form, Input, InputNumber, Select, Space, Switch, Tabs, Tag, Tooltip } from "antd";
+import { Button as UIButton } from "@/components/ui/button";
+import { Switch } from "@/components/ui/switch";
+import { Textarea } from "@/components/ui/textarea";
+import { TooltipProvider } from "@/components/ui/tooltip";
+import { UiLoadingSpinner } from "@/components/ui/ui-loading-spinner";
+import { Field, FieldDescription, FieldGroup, FieldLabel } from "@/components/shared/form/field";
+import { FormField } from "@/components/shared/form/FormField";
+import { labelWithDocsHint, labelWithHint } from "@/components/shared/form/LabelWithHint";
+import { MultiSelect } from "@/components/shared/MultiSelect";
+import { SearchSelect } from "@/components/shared/SearchSelect";
+import { useZodForm } from "@/lib/forms/useZodForm";
+import { TagsInput } from "@/app/(dashboard)/guardrails/_components/content_filter/TagsInput";
+import { Button, Tabs, Tooltip } from "antd";
 import { toast } from "@/lib/toast";
-import { CheckIcon, ChevronDown, CopyIcon } from "lucide-react";
+import { CheckIcon, ChevronDown, CircleMinus, CopyIcon, Plus, Save } from "lucide-react";
 import React, { useEffect, useMemo, useState } from "react";
+import { useFieldArray } from "react-hook-form";
+import { z } from "zod/v4";
+import GuardrailsSelect from "./GuardrailsSelect";
 import { copyToClipboard as utilCopyToClipboard } from "../../utils/dataUtils";
 import AccessGroupSelector from "../common_components/AccessGroupSelector";
 import BudgetDurationDropdown from "../common_components/budget_duration_dropdown";
@@ -49,6 +57,7 @@ import {
 } from "./teamModelAccess";
 import MetadataKeyValueFields, {
   metadataObjectToPairs,
+  metadataPairsSchema,
   metadataPairsToObject,
 } from "../common_components/MetadataKeyValueFields";
 import { useTeamMetadataSchema } from "@/app/(dashboard)/hooks/teams/useTeamMetadataSchema";
@@ -63,7 +72,7 @@ import LoggingSettingsView from "../logging_settings_view";
 import MCPServerSelector from "../mcp_server_management/MCPServerSelector";
 import MCPToolPermissions from "../mcp_server_management/MCPToolPermissions";
 import { ModelSelect } from "../ModelSelect/ModelSelect";
-import { estimateRules, estimateTooltips } from "../templates/estimatedOutputTokens";
+import { estimateChecks, estimateTooltips } from "../templates/estimatedOutputTokens";
 import ObjectPermissionsView from "../object_permissions_view";
 import NumericalInput from "../shared/numerical_input";
 import VectorStoreSelector from "../vector_store_management/VectorStoreSelector";
@@ -182,6 +191,201 @@ export interface TeamInfoProps {
   premiumUser?: boolean;
 }
 
+const SUPPRESSED_BY_DESCRIPTION = "";
+
+const numericInputSchema = z.union([z.string(), z.number()]).nullish();
+
+const teamUpdateFieldsSchema = z.object({
+  team_alias: z.string().min(1, "Please input a team name"),
+  models: z.array(z.string()).optional(),
+  max_budget: numericInputSchema,
+  soft_budget: numericInputSchema,
+  soft_budget_alerting_emails: z.union([z.string(), z.array(z.string())]).optional(),
+  default_team_member_models: z.array(z.string()).optional(),
+  team_member_budget: numericInputSchema,
+  team_member_budget_duration: z.string().nullish(),
+  team_member_key_duration: z.string().optional(),
+  team_member_tpm_limit: numericInputSchema,
+  team_member_rpm_limit: numericInputSchema,
+  budget_duration: z.string().nullish(),
+  tpm_limit: numericInputSchema,
+  rpm_limit: numericInputSchema,
+  modelLimits: z
+    .array(
+      z.object({
+        model: z.string().min(1, "Missing model"),
+        tpm: z.number().nullish(),
+        rpm: z.number().nullish(),
+      }),
+    )
+    .superRefine((rows, ctx) => {
+      rows.forEach((row, index) => {
+        if (row.model && rows.filter((other) => other.model === row.model).length > 1) {
+          ctx.addIssue({ code: "custom", message: "Duplicate model", path: [index, "model"] });
+        }
+        if (row.model && row.tpm == null && row.rpm == null) {
+          ctx.addIssue({ code: "custom", message: "Set at least one of TPM or RPM", path: [index, "tpm"] });
+        }
+      });
+    }),
+  default_estimated_output_tokens: numericInputSchema.refine(
+    estimateChecks.positive.isValid,
+    estimateChecks.positive.message,
+  ),
+  default_estimated_output_tokens_per_model: z
+    .string()
+    .optional()
+    .refine(estimateChecks.perModel.isValid, estimateChecks.perModel.message),
+  guardrails: z.array(z.string()).optional(),
+  disable_global_guardrails: z.boolean().optional(),
+  policies: z.array(z.string()).optional(),
+  access_group_ids: z.array(z.string()).optional(),
+  vector_stores: z.array(z.string()).optional(),
+  allowed_passthrough_routes: z.array(z.string()).optional(),
+  mcp_servers_and_groups: z
+    .object({
+      servers: z.array(z.string()),
+      accessGroups: z.array(z.string()),
+      toolsets: z.array(z.string()).optional(),
+    })
+    .optional(),
+  mcp_tool_permissions: z.record(z.string(), z.array(z.string())).optional(),
+  agents_and_groups: z.object({ agents: z.array(z.string()), accessGroups: z.array(z.string()) }).optional(),
+  object_permission_search_tools: z.array(z.string()).optional(),
+  organization_id: z.string().nullish(),
+  logging_settings: z.array(z.unknown()).optional(),
+  secret_manager_settings: z.string().optional(),
+  metadata: metadataPairsSchema.optional(),
+});
+
+type TeamUpdateFormValues = z.infer<typeof teamUpdateFieldsSchema>;
+
+type TeamInfoRecord = TeamData["team_info"] & { team_member_key_duration?: string };
+
+const TEAM_MEMBER_SETTINGS_FIELDS = [
+  "default_team_member_models",
+  "team_member_budget",
+  "team_member_budget_duration",
+  "team_member_key_duration",
+  "team_member_tpm_limit",
+  "team_member_rpm_limit",
+] as const;
+const SEARCH_TOOL_SETTINGS_FIELDS = ["object_permission_search_tools"] as const;
+
+const EMPTY_TEAM_UPDATE_VALUES: TeamUpdateFormValues = {
+  team_alias: "",
+  models: [],
+  max_budget: undefined,
+  soft_budget: undefined,
+  soft_budget_alerting_emails: "",
+  default_team_member_models: [],
+  team_member_budget: undefined,
+  team_member_budget_duration: undefined,
+  team_member_key_duration: undefined,
+  team_member_tpm_limit: undefined,
+  team_member_rpm_limit: undefined,
+  budget_duration: undefined,
+  tpm_limit: undefined,
+  rpm_limit: undefined,
+  modelLimits: [],
+  default_estimated_output_tokens: undefined,
+  default_estimated_output_tokens_per_model: "",
+  guardrails: [],
+  disable_global_guardrails: false,
+  policies: [],
+  access_group_ids: [],
+  vector_stores: [],
+  allowed_passthrough_routes: [],
+  mcp_servers_and_groups: { servers: [], accessGroups: [], toolsets: [] },
+  mcp_tool_permissions: {},
+  agents_and_groups: { agents: [], accessGroups: [] },
+  object_permission_search_tools: [],
+  organization_id: null,
+  logging_settings: [],
+  secret_manager_settings: "",
+  metadata: [],
+};
+
+const computeEffectiveGuardrails = (info: TeamInfoRecord, globalGuardrailNames: ReadonlySet<string>): string[] => {
+  const optedOutGlobals = new Set<string>(
+    Array.isArray(info.metadata?.opted_out_global_guardrails) ? info.metadata.opted_out_global_guardrails : [],
+  );
+  const nonGlobalOptIns: string[] = (Array.isArray(info.metadata?.guardrails) ? info.metadata.guardrails : []).filter(
+    (name: string) => !globalGuardrailNames.has(name),
+  );
+  return info.metadata?.disable_global_guardrails === true
+    ? nonGlobalOptIns
+    : [...Array.from(globalGuardrailNames).filter((name) => !optedOutGlobals.has(name)), ...nonGlobalOptIns];
+};
+
+const toTeamFormValues = (info: TeamInfoRecord, effectiveGuardrails: string[]): TeamUpdateFormValues => ({
+  team_alias: info.team_alias,
+  models: info.models,
+  max_budget: info.max_budget,
+  soft_budget: info.soft_budget,
+  soft_budget_alerting_emails: Array.isArray(info.metadata?.soft_budget_alerting_emails)
+    ? info.metadata.soft_budget_alerting_emails.join(", ")
+    : "",
+  default_team_member_models: info.default_team_member_models || [],
+  team_member_budget: info.team_member_budget_table?.max_budget,
+  team_member_budget_duration: info.team_member_budget_table?.budget_duration,
+  team_member_key_duration: info.team_member_key_duration,
+  team_member_tpm_limit: info.team_member_budget_table?.tpm_limit,
+  team_member_rpm_limit: info.team_member_budget_table?.rpm_limit,
+  budget_duration: info.budget_duration,
+  tpm_limit: info.tpm_limit,
+  rpm_limit: info.rpm_limit,
+  modelLimits: Array.from(
+    new Set([
+      ...Object.keys(info.metadata?.model_tpm_limit ?? {}),
+      ...Object.keys(info.metadata?.model_rpm_limit ?? {}),
+    ]),
+  ).map((model) => ({
+    model,
+    tpm: info.metadata?.model_tpm_limit?.[model],
+    rpm: info.metadata?.model_rpm_limit?.[model],
+  })),
+  default_estimated_output_tokens: info.metadata?.default_estimated_output_tokens,
+  default_estimated_output_tokens_per_model: info.metadata?.default_estimated_output_tokens_per_model
+    ? JSON.stringify(info.metadata.default_estimated_output_tokens_per_model)
+    : "",
+  guardrails: effectiveGuardrails,
+  disable_global_guardrails: info.metadata?.disable_global_guardrails || false,
+  policies: info.policies || [],
+  access_group_ids: info.access_group_ids || [],
+  vector_stores: info.object_permission?.vector_stores || [],
+  allowed_passthrough_routes: info.metadata?.allowed_passthrough_routes || [],
+  mcp_servers_and_groups: {
+    servers: info.object_permission?.mcp_servers || [],
+    accessGroups: info.object_permission?.mcp_access_groups || [],
+    toolsets: info.object_permission?.mcp_toolsets || [],
+  },
+  mcp_tool_permissions: info.object_permission?.mcp_tool_permissions || {},
+  agents_and_groups: {
+    agents: info.object_permission?.agents || [],
+    accessGroups: info.object_permission?.agent_access_groups || [],
+  },
+  object_permission_search_tools: info.object_permission?.search_tools || [],
+  organization_id: info.organization_id,
+  logging_settings: info.metadata?.logging || [],
+  secret_manager_settings: info.metadata?.secret_manager_settings
+    ? JSON.stringify(info.metadata.secret_manager_settings, null, 2)
+    : "",
+  metadata: metadataObjectToPairs(info.metadata, UI_MANAGED_METADATA_KEYS),
+});
+
+const isParsableJson = (value: string | undefined): boolean => {
+  if (!value) {
+    return true;
+  }
+  try {
+    JSON.parse(value);
+    return true;
+  } catch {
+    return false;
+  }
+};
+
 const TeamInfoView: React.FC<TeamInfoProps> = ({
   teamId,
   onClose,
@@ -194,10 +398,26 @@ const TeamInfoView: React.FC<TeamInfoProps> = ({
   premiumUser = false,
   onUpdate,
 }) => {
+  const teamUpdateSchema = useMemo(
+    () =>
+      teamUpdateFieldsSchema.superRefine((values, ctx) => {
+        if (!isParsableJson(values.secret_manager_settings)) {
+          ctx.addIssue({ code: "custom", message: SUPPRESSED_BY_DESCRIPTION, path: ["secret_manager_settings"] });
+        }
+      }),
+    [],
+  );
   const [teamData, setTeamData] = useState<TeamData | null>(null);
   const [loading, setLoading] = useState(true);
   const [isAddMemberModalVisible, setIsAddMemberModalVisible] = useState(false);
-  const [form] = Form.useForm();
+  const form = useZodForm(teamUpdateSchema, { defaultValues: EMPTY_TEAM_UPDATE_VALUES });
+  const {
+    fields: modelLimitRows,
+    append: appendModelLimit,
+    remove: removeModelLimit,
+  } = useFieldArray({ control: form.control, name: "modelLimits" });
+  const [teamMemberSettingsOpen, setTeamMemberSettingsOpen] = useState(false);
+  const [searchToolSettingsOpen, setSearchToolSettingsOpen] = useState(false);
   const [isEditMemberModalVisible, setIsEditMemberModalVisible] = useState(false);
   const [selectedEditMember, setSelectedEditMember] = useState<Member | null>(null);
   const [isEditing, setIsEditing] = useState(false);
@@ -232,15 +452,17 @@ const TeamInfoView: React.FC<TeamInfoProps> = ({
 
   // Models currently selected in the team edit form, used to scope the per-model
   // rate limit dropdown to models this team actually has access to.
-  const selectedModelsInForm = Form.useWatch("models", form) as string[] | undefined;
-  const killSwitchOn = Form.useWatch("disable_global_guardrails", form) as boolean | undefined;
+  const watchedModels = form.watch("models");
+  const killSwitchOn = form.watch("disable_global_guardrails");
+  const watchedMcpSelection = form.watch("mcp_servers_and_groups");
+  const watchedToolPermissions = form.watch("mcp_tool_permissions");
   const availableRateLimitModels = useMemo(() => {
-    const selected = selectedModelsInForm ?? teamData?.team_info?.models ?? [];
+    const selected = watchedModels ?? teamData?.team_info?.models ?? [];
     if (selected.includes("all-proxy-models") || selected.includes("all-team-models")) {
       return userModels;
     }
     return unfurlWildcardModelsInList(selected, userModels);
-  }, [selectedModelsInForm, teamData, userModels]);
+  }, [watchedModels, teamData, userModels]);
 
   const isTeamAdminFromTeamData = useMemo(
     () =>
@@ -254,6 +476,37 @@ const TeamInfoView: React.FC<TeamInfoProps> = ({
   const visibleTabs = useMemo(() => getTeamInfoVisibleTabs(canEditTeam), [canEditTeam]);
   const defaultTabKey = useMemo(() => getTeamInfoDefaultTab(editTeam, canEditTeam), [editTeam, canEditTeam]);
 
+  const teamFormValues = (): TeamUpdateFormValues => {
+    const info = teamData?.team_info;
+    return info
+      ? toTeamFormValues(info, computeEffectiveGuardrails(info, globalGuardrailNames))
+      : EMPTY_TEAM_UPDATE_VALUES;
+  };
+
+  const startEditing = () => {
+    form.reset(teamFormValues());
+    setTeamMemberSettingsOpen(false);
+    setSearchToolSettingsOpen(false);
+    setIsEditing(true);
+  };
+
+  const applyKillSwitchToGuardrails = (checked: boolean) => {
+    const current = form.getValues("guardrails") ?? [];
+    const nonGlobals = current.filter((name) => !globalGuardrailNames.has(name));
+    form.setValue("guardrails", checked ? nonGlobals : [...Array.from(globalGuardrailNames), ...nonGlobals]);
+  };
+
+  const mountedUpdateValues = (values: TeamUpdateFormValues): Record<string, unknown> => {
+    const unmounted = new Set<string>([
+      ...(teamMemberSettingsOpen ? [] : TEAM_MEMBER_SETTINGS_FIELDS),
+      ...(canViewPolicies ? [] : ["policies"]),
+      ...(searchToolSettingsOpen ? [] : SEARCH_TOOL_SETTINGS_FIELDS),
+    ]);
+    return Object.fromEntries(Object.entries(values).filter(([key]) => !unmounted.has(key)));
+  };
+
+  const onTeamUpdateSubmit = (values: TeamUpdateFormValues) => handleTeamUpdate(mountedUpdateValues(values));
+
   const fetchTeamInfo = async () => {
     try {
       setLoading(true);
@@ -354,7 +607,7 @@ const TeamInfoView: React.FC<TeamInfoProps> = ({
 
       toast.success("Team member added successfully");
       setIsAddMemberModalVisible(false);
-      form.resetFields();
+      form.reset(teamFormValues());
 
       // Fetch updated team info
       const updatedTeamData = await teamInfoCall(accessToken, teamId);
@@ -678,47 +931,11 @@ const TeamInfoView: React.FC<TeamInfoProps> = ({
   const { team_info: info } = teamData;
 
   const initialKillSwitchOn = info.metadata?.disable_global_guardrails === true;
-  const optedOutGlobals = new Set<string>(
-    Array.isArray(info.metadata?.opted_out_global_guardrails) ? info.metadata.opted_out_global_guardrails : [],
-  );
-  const nonGlobalOptIns: string[] = (Array.isArray(info.metadata?.guardrails) ? info.metadata.guardrails : []).filter(
-    (n: string) => !globalGuardrailNames.has(n),
-  );
-  const effectiveGuardrails: string[] = initialKillSwitchOn
-    ? nonGlobalOptIns
-    : [...Array.from(globalGuardrailNames).filter((n) => !optedOutGlobals.has(n)), ...nonGlobalOptIns];
 
   const allGuardrails: GuardrailListItem[] = guardrailsData?.guardrails ?? [];
   const globalGuardrails = allGuardrails.filter((g) => g.litellm_params?.default_on);
   const otherGuardrails = allGuardrails.filter((g) => !g.litellm_params?.default_on);
 
-  const renderGuardrailOption = (g: GuardrailListItem, disabled: boolean) => (
-    <Select.Option key={g.guardrail_name} value={g.guardrail_name} label={g.guardrail_name} disabled={disabled}>
-      {g.guardrail_name}
-    </Select.Option>
-  );
-
-  const preventTagMouseDown = (e: React.MouseEvent) => {
-    e.preventDefault();
-    e.stopPropagation();
-  };
-
-  const renderGuardrailTag = ({ label, value, closable, onClose }: any) => {
-    const isGlobal = globalGuardrailNames.has(value);
-    return (
-      <Tag
-        color="blue"
-        closable={closable}
-        onClose={onClose}
-        onMouseDown={preventTagMouseDown}
-        style={{ marginInlineEnd: 4 }}
-      >
-        {isGlobal && <GlobalOutlined style={{ marginInlineEnd: 4 }} aria-label="Global guardrail" />}
-        {label}
-      </Tag>
-    );
-  };
-
   const copyToClipboard = async (text: string, key: string) => {
     const success = await utilCopyToClipboard(text);
     if (success) {
@@ -935,7 +1152,7 @@ const TeamInfoView: React.FC<TeamInfoProps> = ({
                       icon={<EditOutlined className="h-4 w-4" />}
                       onClick={() => {
                         setTeamModelAliases(info.litellm_model_table?.model_aliases ?? {});
-                        setIsEditing(true);
+                        startEditing();
                       }}
                     >
                       Edit Settings
@@ -946,600 +1163,608 @@ const TeamInfoView: React.FC<TeamInfoProps> = ({
                 {isEditing && isGuardrailsLoading ? (
                   <div className="p-4">Loading...</div>
                 ) : isEditing ? (
-                  <Form
-                    form={form}
-                    onFinish={handleTeamUpdate}
-                    onValuesChange={(changedValues) => {
-                      if ("disable_global_guardrails" in changedValues) {
-                        const checked = changedValues.disable_global_guardrails === true;
-                        const current = (form.getFieldValue("guardrails") || []) as string[];
-                        const nonGlobals = current.filter((n) => !globalGuardrailNames.has(n));
-                        form.setFieldValue(
-                          "guardrails",
-                          checked ? nonGlobals : [...Array.from(globalGuardrailNames), ...nonGlobals],
-                        );
-                      }
-                    }}
-                    initialValues={{
-                      ...info,
-                      team_alias: info.team_alias,
-                      models: info.models,
-                      tpm_limit: info.tpm_limit,
-                      rpm_limit: info.rpm_limit,
-                      object_permission_search_tools: info.object_permission?.search_tools || [],
-                      modelLimits: Array.from(
-                        new Set([
-                          ...Object.keys(info.metadata?.model_tpm_limit ?? {}),
-                          ...Object.keys(info.metadata?.model_rpm_limit ?? {}),
-                        ]),
-                      ).map((model) => ({
-                        model,
-                        tpm: info.metadata?.model_tpm_limit?.[model],
-                        rpm: info.metadata?.model_rpm_limit?.[model],
-                      })),
-                      max_budget: info.max_budget,
-                      soft_budget: info.soft_budget,
-                      budget_duration: info.budget_duration,
-                      team_member_tpm_limit: info.team_member_budget_table?.tpm_limit,
-                      team_member_rpm_limit: info.team_member_budget_table?.rpm_limit,
-                      team_member_budget: info.team_member_budget_table?.max_budget,
-                      team_member_budget_duration: info.team_member_budget_table?.budget_duration,
-                      guardrails: effectiveGuardrails,
-                      policies: info.policies || [],
-                      disable_global_guardrails: info.metadata?.disable_global_guardrails || false,
-                      soft_budget_alerting_emails: Array.isArray(info.metadata?.soft_budget_alerting_emails)
-                        ? info.metadata.soft_budget_alerting_emails.join(", ")
-                        : "",
-                      default_estimated_output_tokens: info.metadata?.default_estimated_output_tokens,
-                      default_estimated_output_tokens_per_model: info.metadata
-                        ?.default_estimated_output_tokens_per_model
-                        ? JSON.stringify(info.metadata.default_estimated_output_tokens_per_model)
-                        : "",
-                      metadata: metadataObjectToPairs(info.metadata, UI_MANAGED_METADATA_KEYS),
-                      logging_settings: info.metadata?.logging || [],
-                      secret_manager_settings: info.metadata?.secret_manager_settings
-                        ? JSON.stringify(info.metadata.secret_manager_settings, null, 2)
-                        : "",
-                      organization_id: info.organization_id,
-                      vector_stores: info.object_permission?.vector_stores || [],
-                      mcp_servers: info.object_permission?.mcp_servers || [],
-                      mcp_access_groups: info.object_permission?.mcp_access_groups || [],
-                      mcp_servers_and_groups: {
-                        servers: info.object_permission?.mcp_servers || [],
-                        accessGroups: info.object_permission?.mcp_access_groups || [],
-                        toolsets: info.object_permission?.mcp_toolsets || [],
-                      },
-                      mcp_tool_permissions: info.object_permission?.mcp_tool_permissions || {},
-                      agents_and_groups: {
-                        agents: info.object_permission?.agents || [],
-                        accessGroups: info.object_permission?.agent_access_groups || [],
-                      },
-                      access_group_ids: info.access_group_ids || [],
-                      default_team_member_models: info.default_team_member_models || [],
-                      allowed_passthrough_routes: info.metadata?.allowed_passthrough_routes || [],
-                    }}
-                    layout="vertical"
-                  >
-                    <Form.Item
-                      label="Team Name"
-                      name="team_alias"
-                      rules={[{ required: true, message: "Please input a team name" }]}
-                    >
-                      <Input type="" />
-                    </Form.Item>
+                  <TooltipProvider>
+                    <form onSubmit={(event) => void form.handleSubmit(onTeamUpdateSubmit)(event)}>
+                      <FieldGroup>
+                        <FormField control={form.control} name="team_alias" label="Team Name">
+                          {({ ref, value, ...field }) => <UIInput {...field} ref={ref} value={value ?? ""} />}
+                        </FormField>
 
-                    <Form.Item
-                      label="Models"
-                      name="models"
-                      extra="Leave empty to grant no models directly. The team keeps any models granted through its access groups"
-                    >
-                      <ModelSelect
-                        value={form.getFieldValue("models") || []}
-                        onChange={(values) => form.setFieldValue("models", values)}
-                        teamID={teamId}
-                        organizationID={teamData?.team_info?.organization_id || undefined}
-                        options={{
-                          includeSpecialOptions: true,
-                          includeUserModels: !teamData?.team_info?.organization_id,
-                          showAllProxyModelsOverride:
-                            isProxyAdminRole(userRole) && !teamData?.team_info?.organization_id,
-                        }}
-                        context="team"
-                        dataTestId="models-select"
-                      />
-                    </Form.Item>
-
-                    <Form.Item
-                      label={
-                        <span>
-                          Model Aliases{" "}
-                          <Tooltip title="Map a custom alias to an underlying model. Team members can call the alias in API requests instead of the real model name.">
-                            <InfoCircleOutlined style={{ marginLeft: "4px" }} />
-                          </Tooltip>
-                        </span>
-                      }
-                    >
-                      <ModelAliasManager
-                        accessToken={accessToken || ""}
-                        initialModelAliases={teamModelAliases}
-                        onAliasUpdate={setTeamModelAliases}
-                        showExampleConfig={false}
-                      />
-                    </Form.Item>
-
-                    <Form.Item label="Max Budget (USD)" name="max_budget">
-                      <NumericalInput step={0.01} precision={2} style={{ width: "100%" }} />
-                    </Form.Item>
-
-                    <Form.Item label="Soft Budget (USD)" name="soft_budget">
-                      <NumericalInput step={0.01} precision={2} style={{ width: "100%" }} />
-                    </Form.Item>
-
-                    <Form.Item
-                      label="Soft Budget Alerting Emails"
-                      name="soft_budget_alerting_emails"
-                      tooltip="Comma-separated email addresses to receive alerts when the soft budget is reached"
-                    >
-                      <Input placeholder="example1@test.com, example2@test.com" />
-                    </Form.Item>
-
-                    <Collapsible className="mt-4 mb-4 overflow-hidden rounded-lg border">
-                      <CollapsibleTrigger className="group/section flex w-full items-center justify-between px-4 py-3 text-left">
-                        <b>Team Member Settings</b>
-                        <ChevronDown className="size-5 shrink-0 text-gray-500 transition-transform group-data-[panel-open]/section:rotate-180" />
-                      </CollapsibleTrigger>
-                      <CollapsibleContent className="px-4 pb-3">
-                        <p className="text-xs text-gray-500 mb-4">
-                          Optional defaults applied when members join this team. All fields can be overridden per
-                          member.
-                        </p>
-                        <Form.Item
-                          label={
-                            <span>
-                              Default Model Access{" "}
-                              <Tooltip title="Optional. If set, new members can only access these models by default. Must be a subset of the team's models above. Leave empty to give all members access to all team models.">
-                                <InfoCircleOutlined style={{ marginLeft: "4px" }} />
-                              </Tooltip>
-                            </span>
-                          }
-                          name="default_team_member_models"
+                        <FormField
+                          control={form.control}
+                          name="models"
+                          label="Models"
+                          description="Leave empty to grant no models directly. The team keeps any models granted through its access groups"
                         >
-                          <Form.Item noStyle shouldUpdate={(prev, cur) => prev.models !== cur.models}>
-                            {({ getFieldValue }) => {
-                              const teamModels = getFieldValue("models") || info.models || [];
-                              return (
-                                <Select
-                                  mode="multiple"
-                                  placeholder="Leave empty — all team models accessible to every member"
-                                  value={form.getFieldValue("default_team_member_models") || []}
-                                  onChange={(values) => form.setFieldValue("default_team_member_models", values)}
-                                  options={teamModels.map((m: string) => ({ label: m, value: m }))}
-                                />
-                              );
-                            }}
-                          </Form.Item>
-                        </Form.Item>
-                        <Form.Item
-                          label="Default Budget (USD)"
-                          name="team_member_budget"
-                          tooltip="Default spend budget for each member in this team."
-                        >
-                          <NumericalInput step={0.01} precision={2} style={{ width: "100%" }} />
-                        </Form.Item>
-                        <Form.Item label="Default Budget Duration" name="team_member_budget_duration">
-                          <DurationSelect
-                            onChange={(value) => form.setFieldValue("team_member_budget_duration", value)}
-                            value={form.getFieldValue("team_member_budget_duration")}
+                          {({ id, value, onChange }) => (
+                            <ModelSelect
+                              id={id}
+                              value={value ?? []}
+                              onChange={onChange}
+                              teamID={teamId}
+                              organizationID={teamData?.team_info?.organization_id || undefined}
+                              options={{
+                                includeSpecialOptions: true,
+                                includeUserModels: !teamData?.team_info?.organization_id,
+                                showAllProxyModelsOverride:
+                                  isProxyAdminRole(userRole) && !teamData?.team_info?.organization_id,
+                              }}
+                              context="team"
+                              dataTestId="models-select"
+                            />
+                          )}
+                        </FormField>
+
+                        <Field>
+                          <FieldLabel>
+                            {labelWithHint(
+                              "Model Aliases",
+                              "Map a custom alias to an underlying model. Team members can call the alias in API requests instead of the real model name.",
+                            )}
+                          </FieldLabel>
+                          <ModelAliasManager
+                            accessToken={accessToken || ""}
+                            initialModelAliases={teamModelAliases}
+                            onAliasUpdate={setTeamModelAliases}
+                            showExampleConfig={false}
                           />
-                        </Form.Item>
-                        <Form.Item
-                          label="Default Key Duration (eg: 1d, 1mo)"
-                          name="team_member_key_duration"
-                          tooltip="Set a limit to the duration of a team member's key. Format: 30s (seconds), 30m (minutes), 30h (hours), 30d (days), 1mo (month)"
+                        </Field>
+
+                        <FormField control={form.control} name="max_budget" label="Max Budget (USD)">
+                          {({ ref, value, ...field }) => (
+                            <NumericalInput {...field} ref={ref} value={value ?? ""} step={0.01} precision={2} />
+                          )}
+                        </FormField>
+
+                        <FormField control={form.control} name="soft_budget" label="Soft Budget (USD)">
+                          {({ ref, value, ...field }) => (
+                            <NumericalInput {...field} ref={ref} value={value ?? ""} step={0.01} precision={2} />
+                          )}
+                        </FormField>
+
+                        <FormField
+                          control={form.control}
+                          name="soft_budget_alerting_emails"
+                          label={labelWithHint(
+                            "Soft Budget Alerting Emails",
+                            "Comma-separated email addresses to receive alerts when the soft budget is reached",
+                          )}
                         >
-                          <UIInput placeholder="e.g., 30d" />
-                        </Form.Item>
-                        <Form.Item
-                          label="Default TPM Limit"
-                          name="team_member_tpm_limit"
-                          tooltip="Default tokens per minute limit for each member. Can be overridden per member."
+                          {({ ref, value, ...field }) => (
+                            <UIInput
+                              {...field}
+                              ref={ref}
+                              value={typeof value === "string" ? value : ""}
+                              placeholder="example1@test.com, example2@test.com"
+                            />
+                          )}
+                        </FormField>
+
+                        <Collapsible
+                          open={teamMemberSettingsOpen}
+                          onOpenChange={setTeamMemberSettingsOpen}
+                          className="mt-4 mb-4 overflow-hidden rounded-lg border"
                         >
-                          <NumericalInput step={1} style={{ width: "100%" }} placeholder="e.g., 1000" />
-                        </Form.Item>
-                        <Form.Item
-                          label="Default RPM Limit"
-                          name="team_member_rpm_limit"
-                          tooltip="Default requests per minute limit for each member. Can be overridden per member."
-                        >
-                          <NumericalInput step={1} style={{ width: "100%" }} placeholder="e.g., 100" />
-                        </Form.Item>
-                      </CollapsibleContent>
-                    </Collapsible>
-
-                    <Form.Item label="Reset Budget" name="budget_duration">
-                      <BudgetDurationDropdown placeholder="Never resets" />
-                    </Form.Item>
-
-                    <Form.Item label="Tokens per minute Limit (TPM)" name="tpm_limit">
-                      <NumericalInput step={1} style={{ width: "100%" }} />
-                    </Form.Item>
-
-                    <Form.Item label="Requests per minute Limit (RPM)" name="rpm_limit">
-                      <NumericalInput step={1} style={{ width: "100%" }} />
-                    </Form.Item>
-
-                    <Form.Item
-                      label="Metadata"
-                      help='Values are saved as text. Enter JSON for typed values, e.g. 3, true, or {"region": "us"}.'
-                    >
-                      <MetadataKeyValueFields
-                        form={form}
-                        schemaFields={teamMetadataSchemaFields}
-                        schemaLoading={isTeamMetadataSchemaLoading}
-                      />
-                    </Form.Item>
-
-                    <Form.Item
-                      label="Model-Specific Rate Limits"
-                      tooltip="Set per-model TPM/RPM limits that apply across the whole team."
-                    >
-                      <Form.List name="modelLimits">
-                        {(fields, { add, remove }) => (
-                          <>
-                            {fields.map(({ key, name, ...restField }) => (
-                              <Space key={key} style={{ display: "flex", marginBottom: 8 }} align="baseline">
-                                <Form.Item
-                                  {...restField}
-                                  name={[name, "model"]}
-                                  rules={[
-                                    { required: true, message: "Missing model" },
-                                    {
-                                      validator: (_, value) => {
-                                        if (!value) return Promise.resolve();
-                                        const all = form.getFieldValue("modelLimits") ?? [];
-                                        const dupes = all.filter((entry: { model?: string }) => entry?.model === value);
-                                        if (dupes.length > 1) {
-                                          return Promise.reject(new Error("Duplicate model"));
-                                        }
-                                        return Promise.resolve();
-                                      },
-                                    },
-                                  ]}
-                                  style={{ minWidth: 240 }}
-                                >
-                                  <Select
-                                    showSearch
-                                    placeholder="Select model"
-                                    allowClear
-                                    options={availableRateLimitModels.map((m) => ({
-                                      value: m,
-                                      label: m,
-                                    }))}
-                                  />
-                                </Form.Item>
-                                <Form.Item
-                                  {...restField}
-                                  name={[name, "tpm"]}
-                                  rules={[
-                                    {
-                                      validator: async (_, value) => {
-                                        const row = (form.getFieldValue("modelLimits") ?? [])[name] ?? {};
-                                        if (row.model && value == null && row.rpm == null) {
-                                          return Promise.reject(new Error("Set at least one of TPM or RPM"));
-                                        }
-                                        return Promise.resolve();
-                                      },
-                                    },
-                                  ]}
-                                >
-                                  <InputNumber placeholder="TPM Limit" min={0} />
-                                </Form.Item>
-                                <Form.Item {...restField} name={[name, "rpm"]}>
-                                  <InputNumber placeholder="RPM Limit" min={0} />
-                                </Form.Item>
-                                <MinusCircleOutlined onClick={() => remove(name)} style={{ color: "#ef4444" }} />
-                              </Space>
-                            ))}
-                            <Form.Item>
-                              <Button type="dashed" onClick={() => add()} block icon={<PlusOutlined />}>
-                                Add Model Limit
-                              </Button>
-                            </Form.Item>
-                          </>
-                        )}
-                      </Form.List>
-                    </Form.Item>
-
-                    <Form.Item
-                      label="Estimated Output Tokens"
-                      name="default_estimated_output_tokens"
-                      tooltip={teamEstimateTooltip.estimate}
-                      rules={[estimateRules.positive]}
-                    >
-                      <NumericalInput min={1} step={1} style={{ width: "100%" }} disabled={!canEditTeamEstimates} />
-                    </Form.Item>
-
-                    <Form.Item
-                      label="Estimated Output Tokens Per Model"
-                      name="default_estimated_output_tokens_per_model"
-                      tooltip={teamEstimateTooltip.perModel}
-                      rules={[estimateRules.perModel]}
-                    >
-                      <Input.TextArea rows={4} placeholder='{"gpt-4": 4096}' disabled={!canEditTeamEstimates} />
-                    </Form.Item>
-
-                    <Form.Item label="Router Settings">
-                      <RouterSettingsAccordion
-                        ref={routerSettingsRef}
-                        accessToken={accessToken || ""}
-                        teamId={teamId}
-                        value={info.router_settings ? { router_settings: info.router_settings } : undefined}
-                      />
-                    </Form.Item>
-
-                    <Form.Item
-                      label={
-                        <span>
-                          Guardrails{" "}
-                          <Tooltip title="Select which guardrails apply to this team. Global guardrails are enabled by default — uncheck to opt out. Other guardrails are opt-in.">
-                            <a
-                              href="https://docs.litellm.ai/docs/proxy/guardrails/quick_start"
-                              target="_blank"
-                              rel="noopener noreferrer"
-                              onClick={(e) => e.stopPropagation()}
-                            >
-                              <InfoCircleOutlined style={{ marginLeft: "4px" }} />
-                            </a>
-                          </Tooltip>
-                        </span>
-                      }
-                      name="guardrails"
-                    >
-                      <Select
-                        mode="multiple"
-                        placeholder="Select guardrails"
-                        optionLabelProp="label"
-                        tagRender={renderGuardrailTag}
-                      >
-                        {globalGuardrails.length > 0 && otherGuardrails.length > 0 ? (
-                          <>
-                            <Select.OptGroup
-                              label={
-                                <>
-                                  <GlobalOutlined style={{ marginInlineEnd: 4 }} />
-                                  Global
-                                </>
-                              }
-                            >
-                              {globalGuardrails.map((g) => renderGuardrailOption(g, Boolean(killSwitchOn)))}
-                            </Select.OptGroup>
-                            <Select.OptGroup label="Other">
-                              {otherGuardrails.map((g) => renderGuardrailOption(g, false))}
-                            </Select.OptGroup>
-                          </>
-                        ) : (
-                          [
-                            ...globalGuardrails.map((g) => renderGuardrailOption(g, Boolean(killSwitchOn))),
-                            ...otherGuardrails.map((g) => renderGuardrailOption(g, false)),
-                          ]
-                        )}
-                      </Select>
-                    </Form.Item>
-
-                    <Form.Item
-                      label={
-                        <span>
-                          Disable all global guardrails{" "}
-                          <Tooltip title="Kill switch: bypass every global guardrail for this team, including any added in the future. For per-guardrail opt-out instead, use the Guardrails dropdown above.">
-                            <InfoCircleOutlined style={{ marginLeft: "4px" }} />
-                          </Tooltip>
-                        </span>
-                      }
-                      name="disable_global_guardrails"
-                      valuePropName="checked"
-                    >
-                      <Switch checkedChildren="Yes" unCheckedChildren="No" />
-                    </Form.Item>
-
-                    {canViewPolicies && (
-                      <Form.Item
-                        label={
-                          <span>
-                            Policies{" "}
-                            <Tooltip title="Apply policies to this team to control guardrails and other settings">
-                              <a
-                                href="https://docs.litellm.ai/docs/proxy/guardrails/guardrail_policies"
-                                target="_blank"
-                                rel="noopener noreferrer"
-                                onClick={(e) => e.stopPropagation()}
+                          <CollapsibleTrigger className="group/section flex w-full items-center justify-between px-4 py-3 text-left">
+                            <b>Team Member Settings</b>
+                            <ChevronDown className="size-5 shrink-0 text-gray-500 transition-transform group-data-[panel-open]/section:rotate-180" />
+                          </CollapsibleTrigger>
+                          <CollapsibleContent className="px-4 pb-3">
+                            <p className="mb-4 text-xs text-gray-500">
+                              Optional defaults applied when members join this team. All fields can be overridden per
+                              member.
+                            </p>
+                            <FieldGroup>
+                              <FormField
+                                control={form.control}
+                                name="default_team_member_models"
+                                label={labelWithHint(
+                                  "Default Model Access",
+                                  "Optional. If set, new members can only access these models by default. Must be a subset of the team's models above. Leave empty to give all members access to all team models.",
+                                )}
                               >
-                                <InfoCircleOutlined style={{ marginLeft: "4px" }} />
-                              </a>
-                            </Tooltip>
-                          </span>
-                        }
-                        name="policies"
-                      >
-                        <Select
-                          mode="tags"
-                          placeholder="Select or enter policies"
-                          options={policiesList.map((name) => ({ value: name, label: name }))}
-                        />
-                      </Form.Item>
-                    )}
+                                {({ id, value, onChange }) => (
+                                  <MultiSelect
+                                    id={id}
+                                    value={value ?? []}
+                                    onValueChange={onChange}
+                                    options={(watchedModels ?? info.models ?? []).map((model) => ({
+                                      label: model,
+                                      value: model,
+                                    }))}
+                                    placeholder="Leave empty — all team models accessible to every member"
+                                  />
+                                )}
+                              </FormField>
+                              <FormField
+                                control={form.control}
+                                name="team_member_budget"
+                                label={labelWithHint(
+                                  "Default Budget (USD)",
+                                  "Default spend budget for each member in this team.",
+                                )}
+                              >
+                                {({ ref, value, ...field }) => (
+                                  <NumericalInput {...field} ref={ref} value={value ?? ""} step={0.01} precision={2} />
+                                )}
+                              </FormField>
+                              <FormField
+                                control={form.control}
+                                name="team_member_budget_duration"
+                                label="Default Budget Duration"
+                              >
+                                {({ value, onChange }) => (
+                                  <DurationSelect value={value ?? undefined} onChange={onChange} />
+                                )}
+                              </FormField>
+                              <FormField
+                                control={form.control}
+                                name="team_member_key_duration"
+                                label={labelWithHint(
+                                  "Default Key Duration (eg: 1d, 1mo)",
+                                  "Set a limit to the duration of a team member's key. Format: 30s (seconds), 30m (minutes), 30h (hours), 30d (days), 1mo (month)",
+                                )}
+                              >
+                                {({ ref, value, ...field }) => (
+                                  <UIInput {...field} ref={ref} value={value ?? ""} placeholder="e.g., 30d" />
+                                )}
+                              </FormField>
+                              <FormField
+                                control={form.control}
+                                name="team_member_tpm_limit"
+                                label={labelWithHint(
+                                  "Default TPM Limit",
+                                  "Default tokens per minute limit for each member. Can be overridden per member.",
+                                )}
+                              >
+                                {({ ref, value, ...field }) => (
+                                  <NumericalInput
+                                    {...field}
+                                    ref={ref}
+                                    value={value ?? ""}
+                                    step={1}
+                                    placeholder="e.g., 1000"
+                                  />
+                                )}
+                              </FormField>
+                              <FormField
+                                control={form.control}
+                                name="team_member_rpm_limit"
+                                label={labelWithHint(
+                                  "Default RPM Limit",
+                                  "Default requests per minute limit for each member. Can be overridden per member.",
+                                )}
+                              >
+                                {({ ref, value, ...field }) => (
+                                  <NumericalInput
+                                    {...field}
+                                    ref={ref}
+                                    value={value ?? ""}
+                                    step={1}
+                                    placeholder="e.g., 100"
+                                  />
+                                )}
+                              </FormField>
+                            </FieldGroup>
+                          </CollapsibleContent>
+                        </Collapsible>
 
-                    <Form.Item
-                      label={
-                        <span>
-                          Access Groups{" "}
-                          <Tooltip title="Assign access groups to this team. Access groups control which models, MCP servers, and agents this team can use">
-                            <InfoCircleOutlined style={{ marginLeft: "4px" }} />
-                          </Tooltip>
-                        </span>
-                      }
-                      name="access_group_ids"
-                    >
-                      <AccessGroupSelector placeholder="Select access groups (optional)" />
-                    </Form.Item>
+                        <FormField control={form.control} name="budget_duration" label="Reset Budget">
+                          {({ id, value, onChange }) => (
+                            <BudgetDurationDropdown
+                              id={id}
+                              placeholder="Never resets"
+                              value={value}
+                              onChange={(next) => onChange(next ?? null)}
+                            />
+                          )}
+                        </FormField>
 
-                    <Form.Item label="Vector Stores" name="vector_stores" aria-label="Vector Stores">
-                      <VectorStoreSelector
-                        onChange={(values: string[]) => form.setFieldValue("vector_stores", values)}
-                        value={form.getFieldValue("vector_stores")}
-                        accessToken={accessToken || ""}
-                        placeholder="Select vector stores"
-                      />
-                    </Form.Item>
+                        <FormField control={form.control} name="tpm_limit" label="Tokens per minute Limit (TPM)">
+                          {({ ref, value, ...field }) => (
+                            <NumericalInput {...field} ref={ref} value={value ?? ""} step={1} />
+                          )}
+                        </FormField>
 
-                    <Form.Item
-                      label="Allowed Pass Through Routes"
-                      name="allowed_passthrough_routes"
-                      tooltip={
-                        !premiumUser
-                          ? "Premium feature - Upgrade to set allowed pass through routes"
-                          : !is_proxy_admin
-                            ? "Only proxy admins can set allowed pass through routes"
-                            : undefined
-                      }
-                    >
-                      <PassThroughRoutesSelector
-                        accessToken={accessToken || ""}
-                        placeholder="Select pass through routes"
-                        disabled={!premiumUser || !is_proxy_admin}
-                      />
-                    </Form.Item>
+                        <FormField control={form.control} name="rpm_limit" label="Requests per minute Limit (RPM)">
+                          {({ ref, value, ...field }) => (
+                            <NumericalInput {...field} ref={ref} value={value ?? ""} step={1} />
+                          )}
+                        </FormField>
 
-                    <Form.Item label="MCP Servers / Access Groups" name="mcp_servers_and_groups">
-                      <MCPServerSelector
-                        onChange={(val) => form.setFieldValue("mcp_servers_and_groups", val)}
-                        value={form.getFieldValue("mcp_servers_and_groups")}
-                        accessToken={accessToken || ""}
-                        placeholder="Select MCP servers or access groups (optional)"
-                        allowAllProxyMcpServers={is_proxy_admin}
-                      />
-                    </Form.Item>
+                        <Field>
+                          <FieldLabel>Metadata</FieldLabel>
+                          <MetadataKeyValueFields
+                            control={form.control}
+                            getValues={form.getValues}
+                            name="metadata"
+                            schemaFields={teamMetadataSchemaFields}
+                            schemaLoading={isTeamMetadataSchemaLoading}
+                          />
+                          <FieldDescription>
+                            Values are saved as text. Enter JSON for typed values, e.g. 3, true, or {'{"region": "us"}'}
+                            .
+                          </FieldDescription>
+                        </Field>
 
-                    {/* Hidden field to register mcp_tool_permissions with the form */}
-                    <Form.Item name="mcp_tool_permissions" initialValue={{}} hidden>
-                      <Input type="hidden" />
-                    </Form.Item>
+                        <Field>
+                          <FieldLabel>
+                            {labelWithHint(
+                              "Model-Specific Rate Limits",
+                              "Set per-model TPM/RPM limits that apply across the whole team.",
+                            )}
+                          </FieldLabel>
+                          {modelLimitRows.map((row, index) => (
+                            <div key={row.id} className="mb-2 flex items-start gap-2">
+                              <FormField
+                                control={form.control}
+                                name={`modelLimits.${index}.model`}
+                                className="min-w-60"
+                              >
+                                {({ id, value, onChange }) => (
+                                  <SearchSelect
+                                    inputId={id}
+                                    value={value ?? ""}
+                                    onValueChange={onChange}
+                                    options={availableRateLimitModels.map((model) => ({
+                                      label: model,
+                                      value: model,
+                                    }))}
+                                    placeholder="Select model"
+                                  />
+                                )}
+                              </FormField>
+                              <FormField control={form.control} name={`modelLimits.${index}.tpm`}>
+                                {({ ref, value, onChange, ...field }) => (
+                                  <NumericalInput
+                                    {...field}
+                                    ref={ref}
+                                    value={value ?? ""}
+                                    onChange={(event: React.ChangeEvent<HTMLInputElement>) =>
+                                      onChange(event.target.value === "" ? null : Number(event.target.value))
+                                    }
+                                    placeholder="TPM Limit"
+                                    min={0}
+                                    step={1}
+                                  />
+                                )}
+                              </FormField>
+                              <FormField control={form.control} name={`modelLimits.${index}.rpm`}>
+                                {({ ref, value, onChange, ...field }) => (
+                                  <NumericalInput
+                                    {...field}
+                                    ref={ref}
+                                    value={value ?? ""}
+                                    onChange={(event: React.ChangeEvent<HTMLInputElement>) =>
+                                      onChange(event.target.value === "" ? null : Number(event.target.value))
+                                    }
+                                    placeholder="RPM Limit"
+                                    min={0}
+                                    step={1}
+                                  />
+                                )}
+                              </FormField>
+                              <UIButton
+                                type="button"
+                                variant="ghost"
+                                size="icon"
+                                aria-label="Remove model limit"
+                                className="mt-1 text-destructive"
+                                onClick={() => removeModelLimit(index)}
+                              >
+                                <CircleMinus className="size-4" />
+                              </UIButton>
+                            </div>
+                          ))}
+                          <UIButton
+                            type="button"
+                            variant="outline"
+                            className="w-full border-dashed"
+                            onClick={() => appendModelLimit({ model: "", tpm: null, rpm: null })}
+                          >
+                            <Plus className="size-4" />
+                            Add Model Limit
+                          </UIButton>
+                        </Field>
+
+                        <FormField
+                          control={form.control}
+                          name="default_estimated_output_tokens"
+                          label={labelWithHint("Estimated Output Tokens", teamEstimateTooltip.estimate)}
+                        >
+                          {({ ref, value, ...field }) => (
+                            <NumericalInput
+                              {...field}
+                              ref={ref}
+                              value={value ?? ""}
+                              min={1}
+                              step={1}
+                              disabled={!canEditTeamEstimates}
+                            />
+                          )}
+                        </FormField>
+
+                        <FormField
+                          control={form.control}
+                          name="default_estimated_output_tokens_per_model"
+                          label={labelWithHint("Estimated Output Tokens Per Model", teamEstimateTooltip.perModel)}
+                        >
+                          {({ ref, value, ...field }) => (
+                            <Textarea
+                              {...field}
+                              ref={ref}
+                              value={value ?? ""}
+                              rows={4}
+                              placeholder='{"gpt-4": 4096}'
+                              disabled={!canEditTeamEstimates}
+                            />
+                          )}
+                        </FormField>
+
+                        <Field>
+                          <FieldLabel>Router Settings</FieldLabel>
+                          <RouterSettingsAccordion
+                            ref={routerSettingsRef}
+                            accessToken={accessToken || ""}
+                            teamId={teamId}
+                            value={info.router_settings ? { router_settings: info.router_settings } : undefined}
+                          />
+                        </Field>
+
+                        <FormField
+                          control={form.control}
+                          name="guardrails"
+                          label={labelWithDocsHint(
+                            "Guardrails",
+                            "Select which guardrails apply to this team. Global guardrails are enabled by default, uncheck to opt out. Other guardrails are opt-in.",
+                            "https://docs.litellm.ai/docs/proxy/guardrails/quick_start",
+                          )}
+                        >
+                          {({ id, value, onChange }) => (
+                            <GuardrailsSelect
+                              id={id}
+                              value={value ?? []}
+                              onValueChange={onChange}
+                              globalGuardrails={globalGuardrails.map((g) => ({
+                                name: g.guardrail_name,
+                                disabled: Boolean(killSwitchOn),
+                              }))}
+                              otherGuardrails={otherGuardrails.map((g) => ({
+                                name: g.guardrail_name,
+                                disabled: false,
+                              }))}
+                              globalGuardrailNames={globalGuardrailNames}
+                            />
+                          )}
+                        </FormField>
+
+                        <FormField
+                          control={form.control}
+                          name="disable_global_guardrails"
+                          label={labelWithHint(
+                            "Disable all global guardrails",
+                            "Kill switch: bypass every global guardrail for this team, including any added in the future. For per-guardrail opt-out instead, use the Guardrails dropdown above.",
+                          )}
+                        >
+                          {({ id, value, onChange }) => (
+                            <Switch
+                              id={id}
+                              checked={value === true}
+                              onCheckedChange={(checked) => {
+                                onChange(checked);
+                                applyKillSwitchToGuardrails(checked);
+                              }}
+                            />
+                          )}
+                        </FormField>
+
+                        {canViewPolicies && (
+                          <FormField
+                            control={form.control}
+                            name="policies"
+                            label={labelWithDocsHint(
+                              "Policies",
+                              "Apply policies to this team to control guardrails and other settings",
+                              "https://docs.litellm.ai/docs/proxy/guardrails/guardrail_policies",
+                            )}
+                          >
+                            {({ id, value, onChange }) => (
+                              <TagsInput
+                                id={id}
+                                value={value ?? []}
+                                onValueChange={onChange}
+                                options={policiesList.map((name) => ({ value: name, label: name }))}
+                                placeholder="Select or enter policies"
+                              />
+                            )}
+                          </FormField>
+                        )}
+
+                        <FormField
+                          control={form.control}
+                          name="access_group_ids"
+                          label={labelWithHint(
+                            "Access Groups",
+                            "Assign access groups to this team. Access groups control which models, MCP servers, and agents this team can use",
+                          )}
+                        >
+                          {({ value, onChange }) => (
+                            <AccessGroupSelector
+                              value={value}
+                              onChange={onChange}
+                              placeholder="Select access groups (optional)"
+                            />
+                          )}
+                        </FormField>
+
+                        <FormField control={form.control} name="vector_stores" label="Vector Stores">
+                          {({ value, onChange }) => (
+                            <VectorStoreSelector
+                              onChange={onChange}
+                              value={value}
+                              accessToken={accessToken || ""}
+                              placeholder="Select vector stores"
+                            />
+                          )}
+                        </FormField>
+
+                        <FormField
+                          control={form.control}
+                          name="allowed_passthrough_routes"
+                          label={
+                            !premiumUser
+                              ? labelWithHint(
+                                  "Allowed Pass Through Routes",
+                                  "Premium feature - Upgrade to set allowed pass through routes",
+                                )
+                              : !is_proxy_admin
+                                ? labelWithHint(
+                                    "Allowed Pass Through Routes",
+                                    "Only proxy admins can set allowed pass through routes",
+                                  )
+                                : "Allowed Pass Through Routes"
+                          }
+                        >
+                          {({ value, onChange }) => (
+                            <PassThroughRoutesSelector
+                              value={value}
+                              onChange={onChange}
+                              accessToken={accessToken || ""}
+                              placeholder="Select pass through routes"
+                              disabled={!premiumUser || !is_proxy_admin}
+                            />
+                          )}
+                        </FormField>
+
+                        <FormField
+                          control={form.control}
+                          name="mcp_servers_and_groups"
+                          label="MCP Servers / Access Groups"
+                        >
+                          {({ value, onChange }) => (
+                            <MCPServerSelector
+                              onChange={onChange}
+                              value={value}
+                              accessToken={accessToken || ""}
+                              placeholder="Select MCP servers or access groups (optional)"
+                              allowAllProxyMcpServers={is_proxy_admin}
+                            />
+                          )}
+                        </FormField>
 
-                    <Form.Item
-                      noStyle
-                      shouldUpdate={(prevValues, currentValues) =>
-                        prevValues.mcp_servers_and_groups !== currentValues.mcp_servers_and_groups ||
-                        prevValues.mcp_tool_permissions !== currentValues.mcp_tool_permissions
-                      }
-                    >
-                      {() => (
                         <div className="mb-6">
                           <MCPToolPermissions
                             accessToken={accessToken || ""}
-                            selectedServers={form.getFieldValue("mcp_servers_and_groups")?.servers || []}
-                            toolPermissions={form.getFieldValue("mcp_tool_permissions") || {}}
-                            onChange={(toolPerms) => form.setFieldsValue({ mcp_tool_permissions: toolPerms })}
+                            selectedServers={watchedMcpSelection?.servers || []}
+                            toolPermissions={watchedToolPermissions || {}}
+                            onChange={(toolPerms) => form.setValue("mcp_tool_permissions", toolPerms)}
                           />
                         </div>
-                      )}
-                    </Form.Item>
 
-                    <Form.Item label="Agents / Access Groups" name="agents_and_groups">
-                      <AgentSelector
-                        onChange={(val) => form.setFieldValue("agents_and_groups", val)}
-                        value={form.getFieldValue("agents_and_groups")}
-                        accessToken={accessToken || ""}
-                        placeholder="Select agents or access groups (optional)"
-                      />
-                    </Form.Item>
+                        <FormField control={form.control} name="agents_and_groups" label="Agents / Access Groups">
+                          {({ value, onChange }) => (
+                            <AgentSelector
+                              onChange={onChange}
+                              value={value}
+                              accessToken={accessToken || ""}
+                              placeholder="Select agents or access groups (optional)"
+                            />
+                          )}
+                        </FormField>
 
-                    <Collapsible className="mt-4 mb-4 overflow-hidden rounded-lg border">
-                      <CollapsibleTrigger className="group/section flex w-full items-center justify-between px-4 py-3 text-left">
-                        <b>Search Tool Settings</b>
-                        <ChevronDown className="size-5 shrink-0 text-gray-500 transition-transform group-data-[panel-open]/section:rotate-180" />
-                      </CollapsibleTrigger>
-                      <CollapsibleContent className="px-4 pb-3">
-                        <Form.Item
-                          label="Allowed Search Tools"
-                          name="object_permission_search_tools"
-                          tooltip="Select which search tools this team can access. Leave empty to allow all search tools."
+                        <Collapsible
+                          open={searchToolSettingsOpen}
+                          onOpenChange={setSearchToolSettingsOpen}
+                          className="mt-4 mb-4 overflow-hidden rounded-lg border"
                         >
-                          <SearchToolSelector
-                            onChange={(vals: string[]) => form.setFieldValue("object_permission_search_tools", vals)}
-                            value={form.getFieldValue("object_permission_search_tools")}
-                            accessToken={accessToken || ""}
-                            placeholder="Select search tools (optional, empty = all allowed)"
-                          />
-                        </Form.Item>
-                      </CollapsibleContent>
-                    </Collapsible>
+                          <CollapsibleTrigger className="group/section flex w-full items-center justify-between px-4 py-3 text-left">
+                            <b>Search Tool Settings</b>
+                            <ChevronDown className="size-5 shrink-0 text-gray-500 transition-transform group-data-[panel-open]/section:rotate-180" />
+                          </CollapsibleTrigger>
+                          <CollapsibleContent className="px-4 pb-3">
+                            <FormField
+                              control={form.control}
+                              name="object_permission_search_tools"
+                              label={labelWithHint(
+                                "Allowed Search Tools",
+                                "Select which search tools this team can access. Leave empty to allow all search tools.",
+                              )}
+                            >
+                              {({ value, onChange }) => (
+                                <SearchToolSelector
+                                  onChange={onChange}
+                                  value={value}
+                                  accessToken={accessToken || ""}
+                                  placeholder="Select search tools (optional, empty = all allowed)"
+                                />
+                              )}
+                            </FormField>
+                          </CollapsibleContent>
+                        </Collapsible>
 
-                    <Form.Item label="Organization" name="organization_id">
-                      <Select
-                        allowClear
-                        placeholder="Select an organization"
-                        showSearch
-                        optionFilterProp="label"
-                        options={userOrganizations.map((org) => ({
-                          value: org.organization_id,
-                          label: org.organization_alias || org.organization_id,
-                        }))}
-                      />
-                    </Form.Item>
+                        <FormField control={form.control} name="organization_id" label="Organization">
+                          {({ id, value, onChange }) => (
+                            <SearchSelect
+                              inputId={id}
+                              value={value ?? ""}
+                              onValueChange={(next) => onChange(next === "" ? null : next)}
+                              options={userOrganizations.map((org) => ({
+                                value: org.organization_id ?? "",
+                                label: org.organization_alias || org.organization_id || "",
+                              }))}
+                              placeholder="Select an organization"
+                              emptyText="No matching organizations"
+                            />
+                          )}
+                        </FormField>
 
-                    <Form.Item label="Logging Settings" name="logging_settings">
-                      <EditLoggingSettings
-                        value={form.getFieldValue("logging_settings")}
-                        onChange={(values) => form.setFieldValue("logging_settings", values)}
-                      />
-                    </Form.Item>
+                        <FormField control={form.control} name="logging_settings" label="Logging Settings">
+                          {({ value, onChange }) => (
+                            <EditLoggingSettings value={(value as unknown[]) ?? []} onChange={onChange} />
+                          )}
+                        </FormField>
 
-                    <Form.Item
-                      label="Secret Manager Settings"
-                      name="secret_manager_settings"
-                      help={
-                        premiumUser
-                          ? "Enter secret manager configuration as a JSON object."
-                          : "Premium feature - Upgrade to manage secret manager settings."
-                      }
-                      rules={[
-                        {
-                          validator: async (_, value) => {
-                            if (!value) {
-                              return Promise.resolve();
-                            }
-                            try {
-                              JSON.parse(value);
-                              return Promise.resolve();
-                            } catch (error) {
-                              return Promise.reject(new Error("Please enter valid JSON"));
-                            }
-                          },
-                        },
-                      ]}
-                    >
-                      <Input.TextArea
-                        rows={6}
-                        placeholder='{"namespace": "admin", "mount": "secret", "path_prefix": "litellm"}'
-                        disabled={!premiumUser}
-                      />
-                    </Form.Item>
-
-                    <div className="sticky z-10 bg-white p-4 pr-0 border-t border-gray-200 -bottom-6 -inset-x-6">
-                      <div className="flex justify-end items-center gap-2">
-                        <Button onClick={() => setIsEditing(false)} disabled={isTeamSaving}>
-                          Cancel
-                        </Button>
-                        <Button
-                          icon={<SaveOutlined className="h-4 w-4" />}
-                          type="primary"
-                          htmlType="submit"
-                          loading={isTeamSaving}
+                        <FormField
+                          control={form.control}
+                          name="secret_manager_settings"
+                          label="Secret Manager Settings"
+                          description={
+                            premiumUser
+                              ? "Enter secret manager configuration as a JSON object."
+                              : "Premium feature - Upgrade to manage secret manager settings."
+                          }
                         >
-                          Save Changes
-                        </Button>
+                          {({ ref, value, ...field }) => (
+                            <Textarea
+                              {...field}
+                              ref={ref}
+                              value={value ?? ""}
+                              rows={6}
+                              placeholder='{"namespace": "admin", "mount": "secret", "path_prefix": "litellm"}'
+                              disabled={!premiumUser}
+                            />
+                          )}
+                        </FormField>
+                      </FieldGroup>
+
+                      <div className="sticky z-10 -inset-x-6 -bottom-6 border-t border-gray-200 bg-white p-4 pr-0">
+                        <div className="flex items-center justify-end gap-2">
+                          <UIButton
+                            type="button"
+                            variant="outline"
+                            onClick={() => setIsEditing(false)}
+                            disabled={isTeamSaving}
+                          >
+                            Cancel
+                          </UIButton>
+                          <UIButton type="submit" disabled={isTeamSaving}>
+                            {isTeamSaving ? <UiLoadingSpinner className="size-4" /> : <Save className="size-4" />}
+                            Save Changes
+                          </UIButton>
+                        </div>
                       </div>
-                    </div>
-                  </Form>
+                    </form>
+                  </TooltipProvider>
                 ) : (
                   <div className="space-y-4">
                     <div>
diff --git a/ui/litellm-dashboard/src/components/team/TeamMemberTab.tsx b/ui/litellm-dashboard/src/components/team/TeamMemberTab.tsx
index ddc43ac50f1..a662a02f91e 100644
--- a/ui/litellm-dashboard/src/components/team/TeamMemberTab.tsx
+++ b/ui/litellm-dashboard/src/components/team/TeamMemberTab.tsx
@@ -1,6 +1,6 @@
 import { useUISettings } from "@/app/(dashboard)/hooks/uiSettings/useUISettings";
 import useAuthorized from "@/app/(dashboard)/hooks/useAuthorized";
-import { Tooltip } from "@/components/atoms/Tooltip";
+import { SimpleTooltip } from "@/components/ui/tooltip";
 import MemberTable from "@/components/common_components/MemberTable";
 import { Member } from "@/components/networking";
 import { DateCell, MoneyCell } from "@/components/shared/table_cells";
@@ -102,9 +102,9 @@ export default function TeamMemberTab({
       title: (
         <span className="flex items-center gap-1">
           Model Scope
-          <Tooltip content="Models this member can access. Empty means they inherit all team models.">
+          <SimpleTooltip content="Models this member can access. Empty means they inherit all team models.">
             <CircleHelp className="size-4" aria-label="Model scope information" />
-          </Tooltip>
+          </SimpleTooltip>
         </span>
       ),
       key: "model_scope",
@@ -123,9 +123,9 @@ export default function TeamMemberTab({
               </code>
             ))}
             {remaining > 0 && (
-              <Tooltip content={models.slice(2).join(", ")}>
+              <SimpleTooltip content={models.slice(2).join(", ")}>
                 <span className="text-muted-foreground">+{remaining} more</span>
-              </Tooltip>
+              </SimpleTooltip>
             )}
           </div>
         );
@@ -135,9 +135,9 @@ export default function TeamMemberTab({
       title: (
         <span className="flex items-center gap-1">
           Current Cycle Spend (USD)
-          <Tooltip content="Spend for the current budget cycle. Resets to $0 when the member's budget window rolls over. This is the value checked against the member's budget.">
+          <SimpleTooltip content="Spend for the current budget cycle. Resets to $0 when the member's budget window rolls over. This is the value checked against the member's budget.">
             <CircleHelp className="size-4" aria-label="Current cycle spend information" />
-          </Tooltip>
+          </SimpleTooltip>
         </span>
       ),
       key: "spend",
@@ -149,9 +149,9 @@ export default function TeamMemberTab({
       title: (
         <span className="flex items-center gap-1">
           Total Spend (USD)
-          <Tooltip content="Cumulative spend by this member within this team, across all budget cycles. Tracking began 2026-04-21; spend from before that date is not included.">
+          <SimpleTooltip content="Cumulative spend by this member within this team, across all budget cycles. Tracking began 2026-04-21; spend from before that date is not included.">
             <CircleHelp className="size-4" aria-label="Total spend information" />
-          </Tooltip>
+          </SimpleTooltip>
         </span>
       ),
       key: "total_spend",
@@ -173,9 +173,9 @@ export default function TeamMemberTab({
       title: (
         <span className="flex items-center gap-1">
           Team Member Rate Limits
-          <Tooltip content="Rate limits for this member's usage within this team.">
+          <SimpleTooltip content="Rate limits for this member's usage within this team.">
             <CircleHelp className="size-4" aria-label="Team member rate limits information" />
-          </Tooltip>
+          </SimpleTooltip>
         </span>
       ),
       key: "rate_limits",
diff --git a/ui/litellm-dashboard/src/components/team/TeamVirtualKeysTable.tsx b/ui/litellm-dashboard/src/components/team/TeamVirtualKeysTable.tsx
index f4097b082f8..bd7faa41ee9 100644
--- a/ui/litellm-dashboard/src/components/team/TeamVirtualKeysTable.tsx
+++ b/ui/litellm-dashboard/src/components/team/TeamVirtualKeysTable.tsx
@@ -1,6 +1,6 @@
 "use client";
 import { useKeys } from "@/app/(dashboard)/hooks/keys/useKeys";
-import { Tooltip } from "@/components/atoms/Tooltip";
+import { SimpleTooltip } from "@/components/ui/tooltip";
 import CopyButton from "@/components/shared/CopyButton";
 import { DateCell, IdCell, MoneyCell } from "@/components/shared/table_cells";
 import {
@@ -150,9 +150,9 @@ export function TeamVirtualKeysTable({ teamId, teamAlias, organization }: TeamVi
         cell: (info) => {
           const value = info.getValue() as string;
           return (
-            <Tooltip content={value}>
+            <SimpleTooltip content={value}>
               <span className="block max-w-full truncate font-mono text-xs">{value ?? "-"}</span>
-            </Tooltip>
+            </SimpleTooltip>
           );
         },
       },
@@ -182,9 +182,9 @@ export function TeamVirtualKeysTable({ teamId, teamAlias, organization }: TeamVi
           const user = info.getValue() as { user_email?: string } | undefined;
           const value = user?.user_email;
           return (
-            <Tooltip content={value}>
+            <SimpleTooltip content={value}>
               <span className="block max-w-full truncate font-mono text-xs">{value ?? "-"}</span>
-            </Tooltip>
+            </SimpleTooltip>
           );
         },
       },
@@ -198,9 +198,9 @@ export function TeamVirtualKeysTable({ teamId, teamAlias, organization }: TeamVi
           const userId = info.getValue() as string | null;
           const displayValue = userId === "default_user_id" ? "Default Proxy Admin" : userId;
           return (
-            <Tooltip content={displayValue}>
+            <SimpleTooltip content={displayValue}>
               <span className="block max-w-full truncate font-mono text-xs">{displayValue ?? "-"}</span>
-            </Tooltip>
+            </SimpleTooltip>
           );
         },
       },
@@ -336,11 +336,11 @@ export function TeamVirtualKeysTable({ teamId, teamAlias, organization }: TeamVi
           const models = info.getValue() as string[];
           const scope = deriveKeyModelScope(info.row.original.allowed_routes, info.row.original.key_type);
           const emptyModelsBadge = !scope.hasModelAccess ? (
-            <Tooltip content={`Scoped to ${scope.label} routes; this key cannot call any models`}>
+            <SimpleTooltip content={`Scoped to ${scope.label} routes; this key cannot call any models`}>
               <Badge variant="secondary" className="mb-1">
                 No model access
               </Badge>
-            </Tooltip>
+            </SimpleTooltip>
           ) : (
             <Badge variant="destructive" className="mb-1">
               All Proxy Models
diff --git a/ui/litellm-dashboard/src/components/templates/KeyEditViewControls.tsx b/ui/litellm-dashboard/src/components/templates/KeyEditViewControls.tsx
new file mode 100644
index 00000000000..1ab7b9be52c
--- /dev/null
+++ b/ui/litellm-dashboard/src/components/templates/KeyEditViewControls.tsx
@@ -0,0 +1,50 @@
+import React from "react";
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from "@/components/ui/select";
+import { Tooltip, TooltipContent, TooltipTrigger } from "@/components/ui/tooltip";
+import { CircleHelp } from "lucide-react";
+
+export const labelWithHint = (label: React.ReactNode, hint: string): React.ReactNode => (
+  <>
+    {label}
+    <Tooltip>
+      <TooltipTrigger render={<CircleHelp className="size-3.5 shrink-0 cursor-help text-muted-foreground" />} />
+      <TooltipContent className="max-w-xs">{hint}</TooltipContent>
+    </Tooltip>
+  </>
+);
+
+const KEY_TYPE_OPTIONS = [
+  { value: "default", label: "Full Access", hint: "Can call all routes (AI APIs, Management, and read-only)" },
+  { value: "llm_api", label: "AI APIs", hint: "Can call only AI API routes (chat/completions, embeddings, etc.)" },
+  { value: "management", label: "Management", hint: "Can call only management routes (user/team/key management)" },
+];
+
+export const KeyTypeSelect = ({
+  id,
+  value,
+  onChange,
+}: {
+  id: string;
+  value: string;
+  onChange: (value: string) => void;
+}) => (
+  <Select
+    items={Object.fromEntries(KEY_TYPE_OPTIONS.map((option) => [option.value, option.label]))}
+    value={value}
+    onValueChange={(next: string | null) => next != null && onChange(next)}
+  >
+    <SelectTrigger id={id} className="w-full">
+      <SelectValue placeholder="Select key type" />
+    </SelectTrigger>
+    <SelectContent>
+      {KEY_TYPE_OPTIONS.map((option) => (
+        <SelectItem key={option.value} value={option.value}>
+          <div className="py-1">
+            <div className="font-medium">{option.label}</div>
+            <div className="mt-0.5 text-[11px] text-muted-foreground">{option.hint}</div>
+          </div>
+        </SelectItem>
+      ))}
+    </SelectContent>
+  </Select>
+);
diff --git a/ui/litellm-dashboard/src/components/templates/KeyInfoView.handleKeyUpdate.test.tsx b/ui/litellm-dashboard/src/components/templates/KeyInfoView.handleKeyUpdate.test.tsx
index 46747d2a0dc..efb895a920e 100644
--- a/ui/litellm-dashboard/src/components/templates/KeyInfoView.handleKeyUpdate.test.tsx
+++ b/ui/litellm-dashboard/src/components/templates/KeyInfoView.handleKeyUpdate.test.tsx
@@ -58,70 +58,6 @@ vi.mock("../shared/errorUtils", () => ({
   parseErrorMessage: (e: any) => String(e),
 }));
 
-// Tremor components -> async factory, local React import, and named passthroughs
-vi.mock("@tremor/react", async () => {
-  const React = await import("react");
-
-  const makeNamedPassthrough = (tag: any, name: string) => {
-    function Named(props: any) {
-      const { children, ...rest } = props;
-      return React.createElement(tag, rest, children);
-    }
-    (Named as any).displayName = name;
-    return Named;
-  };
-
-  const Card = makeNamedPassthrough("div", "Card");
-  const Text = makeNamedPassthrough("span", "Text");
-  const Grid = makeNamedPassthrough("div", "Grid");
-  const Col = makeNamedPassthrough("div", "Col");
-  const TabGroup = makeNamedPassthrough("div", "TabGroup");
-  const TabList = makeNamedPassthrough("div", "TabList");
-  const TabPanels = makeNamedPassthrough("div", "TabPanels");
-  const TabPanel = makeNamedPassthrough("div", "TabPanel");
-  const Title = makeNamedPassthrough("h1", "Title");
-  const Badge = makeNamedPassthrough("span", "Badge");
-
-  function Button(props: any) {
-    const { children, onClick, ...rest } = props;
-    return React.createElement("button", { onClick, ...rest }, children);
-  }
-  (Button as any).displayName = "Button";
-
-  function Tab(props: any) {
-    const { children, ...rest } = props;
-    return React.createElement("button", { ...rest }, children);
-  }
-  (Tab as any).displayName = "Tab";
-
-  function TextInput(props: any) {
-    return React.createElement("input", { ...props });
-  }
-  (TextInput as any).displayName = "TextInput";
-
-  function TremorSelect(props: any) {
-    return React.createElement("select", { ...props });
-  }
-  (TremorSelect as any).displayName = "TremorSelect";
-
-  return {
-    Card,
-    Text,
-    Button,
-    Grid,
-    Col,
-    Tab,
-    TabList,
-    TabGroup,
-    TabPanel,
-    TabPanels,
-    Title,
-    Badge,
-    TextInput,
-    Select: TremorSelect,
-  };
-});
-
 // antd bits -> async factory & local React
 vi.mock("antd", async (importOriginal) => {
   const actual = await importOriginal<typeof import("antd")>();
diff --git a/ui/litellm-dashboard/src/components/templates/estimatedOutputTokens.ts b/ui/litellm-dashboard/src/components/templates/estimatedOutputTokens.ts
index 842d7d2bb68..0982bbcc750 100644
--- a/ui/litellm-dashboard/src/components/templates/estimatedOutputTokens.ts
+++ b/ui/litellm-dashboard/src/components/templates/estimatedOutputTokens.ts
@@ -44,25 +44,28 @@ export const estimateTooltips = (canEdit: boolean, entity: "key" | "team" = "key
     : ADMIN_ONLY_TOOLTIP,
 });
 
-export const estimateRules = {
+export const estimateChecks = {
   perModel: {
-    validator: (_: unknown, value: unknown) => {
-      if (typeof value !== "string" || value.trim() === "") return Promise.resolve();
-      return parsePerModelEstimates(value) === null
-        ? Promise.reject(new Error(INVALID_PER_MODEL_MESSAGE))
-        : Promise.resolve();
-    },
+    isValid: (value: unknown): boolean =>
+      typeof value !== "string" || value.trim() === "" ? true : parsePerModelEstimates(value) !== null,
+    message: INVALID_PER_MODEL_MESSAGE,
   },
   positive: {
-    validator: (_: unknown, value: unknown) => {
-      if (value === "" || value === null || value === undefined) return Promise.resolve();
-      return isPositiveInteger(Number(value))
-        ? Promise.resolve()
-        : Promise.reject(new Error("Enter a positive integer"));
-    },
+    isValid: (value: unknown): boolean =>
+      value === "" || value === null || value === undefined ? true : isPositiveInteger(Number(value)),
+    message: "Enter a positive integer",
   },
 };
 
+const asAntdRule = ({ isValid, message }: { isValid: (value: unknown) => boolean; message: string }) => ({
+  validator: (_: unknown, value: unknown) => (isValid(value) ? Promise.resolve() : Promise.reject(new Error(message))),
+});
+
+export const estimateRules = {
+  perModel: asAntdRule(estimateChecks.perModel),
+  positive: asAntdRule(estimateChecks.positive),
+};
+
 export const withNormalizedEstimates = <T extends FormValues>(values: T): FormValues => {
   const { [ESTIMATE_FIELD]: estimate, [PER_MODEL_FIELD]: perModel, ...rest } = values;
 
diff --git a/ui/litellm-dashboard/src/components/templates/keyEditFieldNormalizers.ts b/ui/litellm-dashboard/src/components/templates/keyEditFieldNormalizers.ts
index ee8d9ebf685..c8b8a689dae 100644
--- a/ui/litellm-dashboard/src/components/templates/keyEditFieldNormalizers.ts
+++ b/ui/litellm-dashboard/src/components/templates/keyEditFieldNormalizers.ts
@@ -17,3 +17,29 @@ export const keyTypeFromRoutes = (allowedRoutes: string[] | null | undefined): s
   if (allowedRoutes.includes("info_routes")) return "read_only";
   return "default";
 };
+
+export const parseAllowedRoutes = (value: unknown): string[] =>
+  typeof value === "string" && value.trim() !== ""
+    ? value
+        .split(",")
+        .map((route) => route.trim())
+        .filter((route) => route.length > 0)
+    : [];
+
+export const modelSentinelOptions = (
+  keyTeamId: string | null | undefined,
+  teamLoaded: boolean,
+): { value: string; label: string }[] => {
+  if (keyTeamId == null) return [{ value: "all-proxy-models", label: "All Proxy Models" }];
+  return teamLoaded ? [{ value: "all-team-models", label: "All Team Models" }] : [];
+};
+
+export const currentValuePlaceholder = (
+  premiumUser: boolean,
+  current: unknown,
+  premiumHint: string,
+  emptyHint: string,
+): string => {
+  if (!premiumUser) return premiumHint;
+  return Array.isArray(current) && current.length > 0 ? `Current: ${current.join(", ")}` : emptyHint;
+};
diff --git a/ui/litellm-dashboard/src/components/templates/keyEditFormValues.test.ts b/ui/litellm-dashboard/src/components/templates/keyEditFormValues.test.ts
new file mode 100644
index 00000000000..948ed659cd5
--- /dev/null
+++ b/ui/litellm-dashboard/src/components/templates/keyEditFormValues.test.ts
@@ -0,0 +1,33 @@
+import { describe, expect, it } from "vitest";
+import { keyEditFormSchema } from "./keyEditFormValues";
+
+const parse = (values: Record<string, unknown>) => keyEditFormSchema.safeParse(values);
+
+describe("keyEditFormSchema", () => {
+  it("accepts an empty form", () => {
+    expect(parse({}).success).toBe(true);
+  });
+
+  it("rejects a fractional estimated output tokens value", () => {
+    expect(parse({ default_estimated_output_tokens: "12.5" }).success).toBe(false);
+  });
+
+  it("rejects a zero or negative estimated output tokens value", () => {
+    expect(parse({ default_estimated_output_tokens: "-5" }).success).toBe(false);
+    expect(parse({ default_estimated_output_tokens: 0 }).success).toBe(false);
+  });
+
+  it("accepts a blank or absent estimated output tokens value", () => {
+    expect(parse({ default_estimated_output_tokens: "" }).success).toBe(true);
+    expect(parse({ default_estimated_output_tokens: null }).success).toBe(true);
+  });
+
+  it("rejects a per-model estimate that is not a JSON object of positive integers", () => {
+    expect(parse({ default_estimated_output_tokens_per_model: "not json" }).success).toBe(false);
+    expect(parse({ default_estimated_output_tokens_per_model: '{"gpt-4": 0}' }).success).toBe(false);
+  });
+
+  it("accepts a per-model estimate that is a JSON object of positive integers", () => {
+    expect(parse({ default_estimated_output_tokens_per_model: '{"gpt-4": 4096}' }).success).toBe(true);
+  });
+});
diff --git a/ui/litellm-dashboard/src/components/templates/keyEditFormValues.ts b/ui/litellm-dashboard/src/components/templates/keyEditFormValues.ts
new file mode 100644
index 00000000000..ad90610b732
--- /dev/null
+++ b/ui/litellm-dashboard/src/components/templates/keyEditFormValues.ts
@@ -0,0 +1,203 @@
+import { z } from "zod/v4";
+
+import { KeyResponse } from "../key_team_helpers/key_list";
+import { extractLoggingSettings, formatMetadataForDisplay, stripTagsFromMetadata } from "../key_info_utils";
+import { mapInternalToDisplayNames } from "../callback_info_helpers";
+import { estimateChecks, estimateFields } from "./estimatedOutputTokens";
+import { canonicalBudgetDuration } from "./keyEditFieldNormalizers";
+
+export interface McpServersAndGroups {
+  servers: string[];
+  accessGroups: string[];
+  toolsets: string[];
+}
+
+export interface AgentsAndGroups {
+  agents: string[];
+  accessGroups: string[];
+}
+
+export interface KeyEditFormValues {
+  key_alias?: string;
+  models?: string[];
+  allowed_routes?: string;
+  max_budget?: number | string | null;
+  budget_duration?: string | null;
+  tpm_limit?: number | string | null;
+  tpm_limit_type?: string | null;
+  rpm_limit?: number | string | null;
+  rpm_limit_type?: string | null;
+  throttle_on_budget_exceeded?: boolean;
+  enable_prompt_caching?: boolean;
+  max_parallel_requests?: number | string | null;
+  model_tpm_limit?: string;
+  model_rpm_limit?: string;
+  default_estimated_output_tokens?: number | string | null;
+  default_estimated_output_tokens_per_model?: string;
+  guardrails?: string[];
+  disable_global_guardrails?: boolean;
+  policies?: string[];
+  tags?: string[];
+  prompts?: string[];
+  access_group_ids?: string[];
+  allowed_passthrough_routes?: string[];
+  vector_stores?: string[];
+  mcp_servers_and_groups?: McpServersAndGroups;
+  mcp_tool_permissions?: Record<string, string[]>;
+  agents_and_groups?: AgentsAndGroups;
+  organization_id?: string | null;
+  team_id?: string | null;
+  logging_settings?: unknown[];
+  metadata?: string;
+  duration?: string | null;
+  token?: string;
+  disabled_callbacks?: string[];
+  auto_rotate?: boolean;
+  rotation_interval?: string;
+}
+
+const readMetadata = (keyData: KeyResponse, key: string): unknown =>
+  keyData.metadata != null && typeof keyData.metadata === "object"
+    ? (keyData.metadata as Record<string, unknown>)[key]
+    : undefined;
+
+export const toKeyEditFormValues = (keyData: KeyResponse): KeyEditFormValues => ({
+  key_alias: keyData.key_alias,
+  models: keyData.models,
+  allowed_routes:
+    Array.isArray(keyData.allowed_routes) && keyData.allowed_routes.length > 0 ? keyData.allowed_routes.join(", ") : "",
+  max_budget: keyData.max_budget,
+  budget_duration: canonicalBudgetDuration(keyData.budget_duration),
+  tpm_limit: keyData.tpm_limit,
+  tpm_limit_type: (keyData as { tpm_limit_type?: string | null }).tpm_limit_type ?? null,
+  rpm_limit: keyData.rpm_limit,
+  rpm_limit_type: (keyData as { rpm_limit_type?: string | null }).rpm_limit_type ?? null,
+  throttle_on_budget_exceeded: Boolean(readMetadata(keyData, "throttle_on_budget_exceeded")),
+  enable_prompt_caching: Boolean(readMetadata(keyData, "enable_prompt_caching")),
+  max_parallel_requests: keyData.max_parallel_requests,
+  model_tpm_limit: (keyData as { model_tpm_limit?: string }).model_tpm_limit,
+  model_rpm_limit: (keyData as { model_rpm_limit?: string }).model_rpm_limit,
+  ...(estimateFields(keyData.metadata as Record<string, unknown> | null | undefined) as {
+    default_estimated_output_tokens?: number | string | null;
+    default_estimated_output_tokens_per_model?: string;
+  }),
+  guardrails: readMetadata(keyData, "guardrails") as string[] | undefined,
+  disable_global_guardrails: Boolean(readMetadata(keyData, "disable_global_guardrails")),
+  policies: (keyData as { policies?: string[] }).policies,
+  tags: readMetadata(keyData, "tags") as string[] | undefined,
+  prompts: readMetadata(keyData, "prompts") as string[] | undefined,
+  access_group_ids: keyData.access_group_ids || [],
+  allowed_passthrough_routes: (keyData as { allowed_passthrough_routes?: string[] }).allowed_passthrough_routes,
+  vector_stores: keyData.object_permission?.vector_stores || [],
+  mcp_servers_and_groups: {
+    servers: keyData.object_permission?.mcp_servers || [],
+    accessGroups: keyData.object_permission?.mcp_access_groups || [],
+    toolsets: keyData.object_permission?.mcp_toolsets || [],
+  },
+  mcp_tool_permissions: keyData.object_permission?.mcp_tool_permissions || {},
+  agents_and_groups: {
+    agents: keyData.object_permission?.agents || [],
+    accessGroups: keyData.object_permission?.agent_access_groups || [],
+  },
+  organization_id: keyData.organization_id,
+  team_id: keyData.team_id,
+  logging_settings: extractLoggingSettings(keyData.metadata),
+  metadata: formatMetadataForDisplay(stripTagsFromMetadata(keyData.metadata)),
+  duration: (keyData as { duration?: string }).duration ?? "",
+  token: keyData.token || keyData.token_id,
+  disabled_callbacks: Array.isArray(readMetadata(keyData, "litellm_disabled_callbacks"))
+    ? mapInternalToDisplayNames(readMetadata(keyData, "litellm_disabled_callbacks") as string[])
+    : [],
+  auto_rotate: keyData.auto_rotate || false,
+  rotation_interval: keyData.rotation_interval,
+});
+
+export const keyEditFormSchema = z.object({
+  key_alias: z.custom<string | undefined>(),
+  models: z.custom<string[] | undefined>(),
+  allowed_routes: z.custom<string | undefined>(),
+  max_budget: z.custom<number | string | null | undefined>(),
+  budget_duration: z.custom<string | null | undefined>(),
+  tpm_limit: z.custom<number | string | null | undefined>(),
+  tpm_limit_type: z.custom<string | null | undefined>(),
+  rpm_limit: z.custom<number | string | null | undefined>(),
+  rpm_limit_type: z.custom<string | null | undefined>(),
+  throttle_on_budget_exceeded: z.custom<boolean | undefined>(),
+  enable_prompt_caching: z.custom<boolean | undefined>(),
+  max_parallel_requests: z.custom<number | string | null | undefined>(),
+  model_tpm_limit: z.custom<string | undefined>(),
+  model_rpm_limit: z.custom<string | undefined>(),
+  default_estimated_output_tokens: z
+    .custom<number | string | null | undefined>()
+    .refine(estimateChecks.positive.isValid, estimateChecks.positive.message),
+  default_estimated_output_tokens_per_model: z
+    .custom<string | undefined>()
+    .refine(estimateChecks.perModel.isValid, estimateChecks.perModel.message),
+  guardrails: z.custom<string[] | undefined>(),
+  disable_global_guardrails: z.custom<boolean | undefined>(),
+  policies: z.custom<string[] | undefined>(),
+  tags: z.custom<string[] | undefined>(),
+  prompts: z.custom<string[] | undefined>(),
+  access_group_ids: z.custom<string[] | undefined>(),
+  allowed_passthrough_routes: z.custom<string[] | undefined>(),
+  vector_stores: z.custom<string[] | undefined>(),
+  mcp_servers_and_groups: z.custom<McpServersAndGroups | undefined>(),
+  mcp_tool_permissions: z.custom<Record<string, string[]> | undefined>(),
+  agents_and_groups: z.custom<AgentsAndGroups | undefined>(),
+  organization_id: z.custom<string | null | undefined>(),
+  team_id: z.custom<string | null | undefined>(),
+  logging_settings: z.custom<unknown[] | undefined>(),
+  metadata: z.custom<string | undefined>(),
+  duration: z.custom<string | null | undefined>(),
+  token: z.custom<string | undefined>(),
+  disabled_callbacks: z.custom<string[] | undefined>(),
+  auto_rotate: z.custom<boolean | undefined>(),
+  rotation_interval: z.custom<string | undefined>(),
+});
+
+export interface MountedFieldGates {
+  canViewPolicies: boolean;
+  canViewPrompts: boolean;
+}
+
+export const toSubmittedValues = (
+  values: KeyEditFormValues,
+  { canViewPolicies, canViewPrompts }: MountedFieldGates,
+): Record<string, unknown> => ({
+  key_alias: values.key_alias,
+  models: values.models,
+  allowed_routes: values.allowed_routes,
+  max_budget: values.max_budget,
+  budget_duration: values.budget_duration,
+  tpm_limit: values.tpm_limit,
+  tpm_limit_type: values.tpm_limit_type,
+  rpm_limit: values.rpm_limit,
+  rpm_limit_type: values.rpm_limit_type,
+  throttle_on_budget_exceeded: values.throttle_on_budget_exceeded,
+  enable_prompt_caching: values.enable_prompt_caching,
+  max_parallel_requests: values.max_parallel_requests,
+  model_tpm_limit: values.model_tpm_limit,
+  model_rpm_limit: values.model_rpm_limit,
+  default_estimated_output_tokens: values.default_estimated_output_tokens,
+  default_estimated_output_tokens_per_model: values.default_estimated_output_tokens_per_model,
+  guardrails: values.guardrails,
+  disable_global_guardrails: values.disable_global_guardrails,
+  ...(canViewPolicies ? { policies: values.policies } : {}),
+  tags: values.tags,
+  ...(canViewPrompts ? { prompts: values.prompts } : {}),
+  access_group_ids: values.access_group_ids,
+  allowed_passthrough_routes: values.allowed_passthrough_routes,
+  vector_stores: values.vector_stores,
+  mcp_servers_and_groups: values.mcp_servers_and_groups,
+  mcp_tool_permissions: values.mcp_tool_permissions,
+  agents_and_groups: values.agents_and_groups,
+  organization_id: values.organization_id,
+  team_id: values.team_id,
+  logging_settings: values.logging_settings,
+  metadata: values.metadata,
+  duration: values.duration,
+  token: values.token,
+  disabled_callbacks: values.disabled_callbacks,
+  auto_rotate: values.auto_rotate,
+  rotation_interval: values.rotation_interval,
+});
diff --git a/ui/litellm-dashboard/src/components/templates/key_edit_view.test.tsx b/ui/litellm-dashboard/src/components/templates/key_edit_view.test.tsx
index 4a3fd50b379..1f4d3cf9128 100644
--- a/ui/litellm-dashboard/src/components/templates/key_edit_view.test.tsx
+++ b/ui/litellm-dashboard/src/components/templates/key_edit_view.test.tsx
@@ -3,7 +3,13 @@ import userEvent from "@testing-library/user-event";
 import { beforeEach, describe, expect, it, vi } from "vitest";
 import { renderWithProviders } from "../../../tests/test-utils";
 import { KeyResponse } from "../key_team_helpers/key_list";
-import { getPoliciesList, getPromptsList, modelAvailableCall } from "../networking";
+import {
+  getPassThroughEndpointsCall,
+  getPoliciesList,
+  getPromptsList,
+  modelAvailableCall,
+  vectorStoreListCall,
+} from "../networking";
 import { KeyEditView } from "./key_edit_view";
 
 const can = vi.fn();
@@ -98,6 +104,36 @@ vi.mock("@/app/(dashboard)/hooks/accessGroups/useAccessGroups", () => ({
   }),
 }));
 
+vi.mock("../mcp_server_management/MCPServerSelector", () => ({
+  default: ({
+    value,
+    onChange,
+  }: {
+    value?: { servers?: string[]; accessGroups?: string[]; toolsets?: string[] };
+    onChange?: (v: { servers: string[]; accessGroups: string[]; toolsets: string[] }) => void;
+  }) => (
+    <button
+      type="button"
+      data-testid="mcp-server-selector"
+      onClick={() => onChange?.({ servers: ["mcp-1"], accessGroups: [], toolsets: value?.toolsets ?? [] })}
+    >
+      pick mcp server
+    </button>
+  ),
+}));
+
+vi.mock("../agent_management/AgentSelector", () => ({
+  default: ({ onChange }: { onChange?: (v: { agents: string[]; accessGroups: string[] }) => void }) => (
+    <button
+      type="button"
+      data-testid="agent-selector"
+      onClick={() => onChange?.({ agents: ["agent-1"], accessGroups: [] })}
+    >
+      pick agent
+    </button>
+  ),
+}));
+
 vi.mock("../common_components/AccessGroupSelector", () => ({
   default: ({ value = [], onChange }: { value?: string[]; onChange?: (v: string[]) => void }) => (
     <input
@@ -108,24 +144,12 @@ vi.mock("../common_components/AccessGroupSelector", () => ({
   ),
 }));
 
-/* eslint-disable local/no-antd-class-selectors -- the "Key Type" and "Models" Form.Items wrap a noStyle nested item, so antd renders a label with no associated control and there is no accessible query for these selects */
-const antdSelectorFor = (label: HTMLElement): Element =>
-  label.closest(".ant-form-item")!.querySelector(".ant-select-selector")!;
-/* eslint-enable local/no-antd-class-selectors */
+const visibleOptions = (): HTMLElement[] => screen.queryAllByRole("option");
 
-const visibleOptions = (): HTMLElement[] =>
-  // eslint-disable-next-line local/no-antd-class-selectors -- antd puts role="option" only on a hidden mirror list; the visible, clickable options carry no role or accessible name
-  Array.from(document.querySelectorAll<HTMLElement>(".ant-select-item-option"));
-
-const isOptionDisabled = (option: HTMLElement): boolean =>
-  // eslint-disable-next-line local/no-antd-class-selectors -- antd signals option disabled state only through this class; the rendered options carry no aria-disabled
-  option.classList.contains("ant-select-item-option-disabled");
+const isOptionDisabled = (option: HTMLElement): boolean => option.getAttribute("aria-disabled") === "true";
 
 const optionByContent = (label: string): HTMLElement | undefined =>
-  visibleOptions().find(
-    // eslint-disable-next-line local/no-antd-class-selectors -- the option's own label text lives in this child node, with no accessible equivalent
-    (el) => el.querySelector(".ant-select-item-option-content")?.textContent === label,
-  );
+  visibleOptions().find((el) => el.textContent === label);
 
 describe("KeyEditView", () => {
   const MOCK_KEY_DATA: KeyResponse = {
@@ -348,6 +372,48 @@ describe("KeyEditView", () => {
         />,
       );
 
+    it("locks the prompts control for a non-premium admin so an unsavable value cannot be entered", async () => {
+      renderWithProviders(
+        <KeyEditView
+          keyData={MOCK_KEY_DATA}
+          onCancel={() => {}}
+          onSubmit={async () => {}}
+          accessToken={"test-token"}
+          userID={"test-user"}
+          userRole={"Admin"}
+          premiumUser={false}
+        />,
+      );
+
+      const prompts = await screen.findByLabelText(/Prompts/);
+      expect(prompts).toBeDisabled();
+
+      await userEvent.type(prompts, "sneaky-prompt{Enter}");
+
+      expect(screen.queryByLabelText("sneaky-prompt")).not.toBeInTheDocument();
+    });
+
+    it("leaves the prompts control usable for a premium admin", async () => {
+      renderWithProviders(
+        <KeyEditView
+          keyData={MOCK_KEY_DATA}
+          onCancel={() => {}}
+          onSubmit={async () => {}}
+          accessToken={"test-token"}
+          userID={"test-user"}
+          userRole={"Admin"}
+          premiumUser={true}
+        />,
+      );
+
+      const prompts = await screen.findByLabelText(/Prompts/);
+      expect(prompts).toBeEnabled();
+
+      await userEvent.type(prompts, "allowed-prompt{Enter}");
+
+      expect(await screen.findByLabelText("allowed-prompt")).toBeInTheDocument();
+    });
+
     it("should render both fields and load prompts for an admin", async () => {
       renderAs("Admin");
 
@@ -1162,7 +1228,7 @@ describe("KeyEditView", () => {
     });
 
     // The selected key type label should show "AI APIs" (not "LLM API")
-    await userEvent.click(antdSelectorFor(screen.getByText("Key Type")));
+    await userEvent.click(screen.getByLabelText("Key Type"));
 
     await waitFor(() => {
       // Verify "AI APIs" appears as an option label
@@ -1310,8 +1376,8 @@ describe("KeyEditView", () => {
   });
 
   describe("models dropdown team gating", () => {
-    const openModelsDropdown = () => {
-      fireEvent.mouseDown(antdSelectorFor(screen.getByText("Models", { selector: "label" })));
+    const openModelsDropdown = async () => {
+      await userEvent.click(screen.getByLabelText("Models"));
     };
 
     it("should offer all-proxy-models but not all-team-models for a teamless key", async () => {
@@ -1331,7 +1397,7 @@ describe("KeyEditView", () => {
         expect(screen.getByText("Models", { selector: "label" })).toBeInTheDocument();
       });
 
-      openModelsDropdown();
+      await openModelsDropdown();
 
       await waitFor(() => {
         expect(screen.getAllByText("gpt-4").length).toBeGreaterThan(0);
@@ -1362,7 +1428,7 @@ describe("KeyEditView", () => {
         expect(screen.getByText("Models", { selector: "label" })).toBeInTheDocument();
       });
 
-      openModelsDropdown();
+      await openModelsDropdown();
 
       await waitFor(() => {
         expect(screen.getAllByText("team-model-1").length).toBeGreaterThan(0);
@@ -1393,7 +1459,7 @@ describe("KeyEditView", () => {
         expect(screen.getByText("Models", { selector: "label" })).toBeInTheDocument();
       });
 
-      openModelsDropdown();
+      await openModelsDropdown();
 
       expect(screen.queryAllByText("All Team Models")).toHaveLength(0);
       expect(screen.queryAllByText("All Proxy Models")).toHaveLength(0);
@@ -1420,10 +1486,9 @@ describe("KeyEditView", () => {
         expect(screen.getByText("Models", { selector: "label" })).toBeInTheDocument();
       });
 
-      openModelsDropdown();
+      await openModelsDropdown();
 
-      const proxyOptionLabels = () =>
-        Array.from(document.querySelectorAll('[role="option"]')).map((option) => option.getAttribute("aria-label"));
+      const proxyOptionLabels = () => visibleOptions().map((option) => option.textContent);
 
       await waitFor(() => {
         expect(proxyOptionLabels()).toContain("gpt-4");
@@ -1453,7 +1518,7 @@ describe("KeyEditView", () => {
         expect(screen.getByText("Models", { selector: "label" })).toBeInTheDocument();
       });
 
-      openModelsDropdown();
+      await openModelsDropdown();
 
       const clickOption = async (label: string) => {
         const option = await waitFor(() => {
@@ -1466,6 +1531,7 @@ describe("KeyEditView", () => {
 
       await clickOption("gpt-4");
       await clickOption("All Proxy Models");
+      await userEvent.keyboard("{Escape}");
 
       await userEvent.click(screen.getByRole("button", { name: /save changes/i }));
 
@@ -1492,7 +1558,7 @@ describe("KeyEditView", () => {
         expect(screen.getByText("Models", { selector: "label" })).toBeInTheDocument();
       });
 
-      openModelsDropdown();
+      await openModelsDropdown();
 
       const findOption = (label: string) => optionByContent(label);
 
@@ -1535,6 +1601,47 @@ describe("KeyEditView", () => {
         />,
       );
 
+    it("refuses to save an invalid per-model estimate, and saves once it is corrected", async () => {
+      const onSubmitMock = vi.fn().mockResolvedValue(undefined);
+      renderEditView(MOCK_KEY_DATA, onSubmitMock);
+      await screen.findByRole("button", { name: /save changes/i });
+      const perModel = screen.getByLabelText("Estimated Output Tokens Per Model");
+
+      fireEvent.change(perModel, { target: { value: "not json" } });
+      await userEvent.click(screen.getByRole("button", { name: /save changes/i }));
+
+      expect(await screen.findByText(/JSON object of positive integers/)).toBeInTheDocument();
+      expect(onSubmitMock).not.toHaveBeenCalled();
+
+      fireEvent.change(perModel, { target: { value: '{"gpt-4": 4096}' } });
+      await userEvent.click(screen.getByRole("button", { name: /save changes/i }));
+
+      await waitFor(() => {
+        expect(onSubmitMock).toHaveBeenCalled();
+      });
+    });
+
+    it("refuses to save a fractional estimate, and saves once it is corrected", async () => {
+      const onSubmitMock = vi.fn().mockResolvedValue(undefined);
+      renderEditView(MOCK_KEY_DATA, onSubmitMock);
+      await screen.findByRole("button", { name: /save changes/i });
+      const estimate = screen.getByLabelText("Estimated Output Tokens");
+
+      fireEvent.change(estimate, { target: { value: "12.5" } });
+      await userEvent.click(screen.getByRole("button", { name: /save changes/i }));
+
+      await waitFor(() => {
+        expect(onSubmitMock).not.toHaveBeenCalled();
+      });
+
+      fireEvent.change(estimate, { target: { value: "2048" } });
+      await userEvent.click(screen.getByRole("button", { name: /save changes/i }));
+
+      await waitFor(() => {
+        expect(onSubmitMock).toHaveBeenCalled();
+      });
+    });
+
     it("loads the estimates from key metadata and resubmits them unchanged", async () => {
       const onSubmitMock = vi.fn().mockResolvedValue(undefined);
       renderEditView(
@@ -1777,5 +1884,297 @@ describe("KeyEditView", () => {
       });
       expect(onSubmitMock.mock.calls[0][0]).toHaveProperty("duration", null);
     });
+
+    it("carries a typed value from every free-text and numeric control into the payload", async () => {
+      const onSubmitMock = vi.fn().mockResolvedValue(undefined);
+      renderForPayload(onSubmitMock);
+      await screen.findByRole("button", { name: /save changes/i });
+
+      const retype = async (label: RegExp | string, text: string) => {
+        const control = screen.getByLabelText(label);
+        await userEvent.clear(control);
+        await userEvent.type(control, text);
+      };
+
+      await retype("Key Alias", "typed-alias");
+      await retype("Max Budget (USD)", "12.5");
+      await retype("TPM Limit", "111");
+      await retype("RPM Limit", "222");
+      await retype("Max Parallel Requests", "3");
+      await retype("Model TPM Limit", '{{"gpt-4": 7}');
+      await retype("Model RPM Limit", '{{"gpt-4": 8}');
+      await retype("Metadata", '{{"typed": true}');
+
+      await userEvent.click(screen.getByRole("button", { name: /save changes/i }));
+
+      await waitFor(() => {
+        expect(onSubmitMock).toHaveBeenCalled();
+      });
+      expect(onSubmitMock.mock.calls[0][0]).toMatchObject({
+        key_alias: "typed-alias",
+        max_budget: "12.5",
+        tpm_limit: "111",
+        rpm_limit: "222",
+        max_parallel_requests: "3",
+        model_tpm_limit: '{"gpt-4": 7}',
+        model_rpm_limit: '{"gpt-4": 8}',
+        metadata: '{"typed": true}',
+      });
+    });
+
+    it("carries every toggle driven off its default into the payload", async () => {
+      const onSubmitMock = vi.fn().mockResolvedValue(undefined);
+      renderForPayload(onSubmitMock);
+      await screen.findByRole("button", { name: /save changes/i });
+
+      await userEvent.click(screen.getByRole("switch", { name: /throttle on budget exceeded/i }));
+      await userEvent.click(screen.getByRole("switch", { name: /enable prompt caching/i }));
+      await userEvent.click(screen.getByRole("switch", { name: /disable global guardrails/i }));
+
+      await userEvent.click(screen.getByRole("button", { name: /save changes/i }));
+
+      await waitFor(() => {
+        expect(onSubmitMock).toHaveBeenCalled();
+      });
+      expect(onSubmitMock.mock.calls[0][0]).toMatchObject({
+        throttle_on_budget_exceeded: true,
+        enable_prompt_caching: true,
+        disable_global_guardrails: true,
+      });
+    });
+
+    it("carries a tag typed into the tags control into the payload", async () => {
+      const onSubmitMock = vi.fn().mockResolvedValue(undefined);
+      renderForPayload(onSubmitMock);
+      await screen.findByRole("button", { name: /save changes/i });
+
+      await userEvent.type(screen.getByLabelText("Tags"), "typed-tag{Enter}");
+
+      await userEvent.click(screen.getByRole("button", { name: /save changes/i }));
+
+      await waitFor(() => {
+        expect(onSubmitMock).toHaveBeenCalled();
+      });
+      expect(onSubmitMock.mock.calls[0][0].tags).toEqual(["test-tag", "typed-tag"]);
+    });
+
+    const pickFromCombobox = async (inputLabel: RegExp | string, optionName: RegExp | string) => {
+      await userEvent.click(screen.getByLabelText(inputLabel));
+      await userEvent.click(await screen.findByRole("option", { name: optionName }));
+      await userEvent.keyboard("{Escape}");
+    };
+
+    it("carries a picked guardrail into the payload", async () => {
+      const onSubmitMock = vi.fn().mockResolvedValue(undefined);
+      renderForPayload(onSubmitMock);
+      await screen.findByRole("button", { name: /save changes/i });
+
+      await pickFromCombobox("Select guardrails", "guardrail-1");
+      await userEvent.click(screen.getByRole("button", { name: /save changes/i }));
+
+      await waitFor(() => {
+        expect(onSubmitMock).toHaveBeenCalled();
+      });
+      expect(onSubmitMock.mock.calls[0][0].guardrails).toEqual(["guardrail-1"]);
+    });
+
+    it("carries a picked policy into the payload", async () => {
+      vi.mocked(getPoliciesList).mockResolvedValueOnce({
+        policies: [{ policy_name: "policy-1", version_number: 1, version_status: "production" }],
+      });
+      const onSubmitMock = vi.fn().mockResolvedValue(undefined);
+      renderForPayload(onSubmitMock);
+      await screen.findByRole("button", { name: /save changes/i });
+
+      await pickFromCombobox(/Select policies/, /policy-1/);
+      await userEvent.click(screen.getByRole("button", { name: /save changes/i }));
+
+      await waitFor(() => {
+        expect(onSubmitMock).toHaveBeenCalled();
+      });
+      expect(onSubmitMock.mock.calls[0][0].policies).toEqual(["policy-1"]);
+    });
+
+    it("carries a typed prompt into the payload", async () => {
+      const onSubmitMock = vi.fn().mockResolvedValue(undefined);
+      renderForPayload(onSubmitMock);
+      await screen.findByRole("button", { name: /save changes/i });
+
+      await userEvent.type(screen.getByLabelText("Prompts"), "prompt-1{Enter}");
+      await userEvent.click(screen.getByRole("button", { name: /save changes/i }));
+
+      await waitFor(() => {
+        expect(onSubmitMock).toHaveBeenCalled();
+      });
+      expect(onSubmitMock.mock.calls[0][0].prompts).toEqual(["prompt-1"]);
+    });
+
+    it("carries the RPM rate limit type into its own payload key", async () => {
+      const onSubmitMock = vi.fn().mockResolvedValue(undefined);
+      renderForPayload(onSubmitMock);
+      await screen.findByRole("button", { name: /save changes/i });
+
+      await userEvent.click(screen.getByLabelText(/RPM Rate Limit Type/));
+      await userEvent.click(await screen.findByTitle("Guaranteed throughput"));
+
+      await userEvent.click(screen.getByRole("button", { name: /save changes/i }));
+
+      await waitFor(() => {
+        expect(onSubmitMock).toHaveBeenCalled();
+      });
+      const payload = onSubmitMock.mock.calls[0][0];
+      expect(payload.rpm_limit_type).toBe("guaranteed_throughput");
+      expect(payload.tpm_limit_type).toBeNull();
+    });
+
+    it("carries a picked vector store into the payload", async () => {
+      vi.mocked(vectorStoreListCall).mockResolvedValueOnce({
+        data: [{ vector_store_id: "vs-1", vector_store_name: "VS One" }],
+      });
+      const onSubmitMock = vi.fn().mockResolvedValue(undefined);
+      renderForPayload(onSubmitMock);
+      await screen.findByRole("button", { name: /save changes/i });
+
+      await pickFromCombobox("Select vector stores", /VS One/);
+      await userEvent.click(screen.getByRole("button", { name: /save changes/i }));
+
+      await waitFor(() => {
+        expect(onSubmitMock).toHaveBeenCalled();
+      });
+      expect(onSubmitMock.mock.calls[0][0].vector_stores).toEqual(["vs-1"]);
+    });
+
+    it("carries a picked pass through route into the payload", async () => {
+      vi.mocked(getPassThroughEndpointsCall).mockResolvedValueOnce({
+        endpoints: [{ path: "/bria", methods: ["POST"] }],
+      });
+      const onSubmitMock = vi.fn().mockResolvedValue(undefined);
+      renderForPayload(onSubmitMock);
+      await screen.findByRole("button", { name: /save changes/i });
+
+      await pickFromCombobox(/allowed pass through routes/, /\/bria/);
+      await userEvent.click(screen.getByRole("button", { name: /save changes/i }));
+
+      await waitFor(() => {
+        expect(onSubmitMock).toHaveBeenCalled();
+      });
+      expect(onSubmitMock.mock.calls[0][0].allowed_passthrough_routes).toEqual(["/bria"]);
+    });
+
+    it("carries a picked team into the payload", async () => {
+      const onSubmitMock = vi.fn().mockResolvedValue(undefined);
+      renderWithProviders(
+        <KeyEditView
+          keyData={MOCK_KEY_DATA}
+          teams={[{ team_id: "team-9", team_alias: "Team Nine" }]}
+          onCancel={() => {}}
+          onSubmit={onSubmitMock}
+          accessToken={"test-token"}
+          userID={"test-user"}
+          userRole={"Admin"}
+          premiumUser={true}
+        />,
+      );
+      await screen.findByRole("button", { name: /save changes/i });
+
+      await userEvent.click(screen.getByLabelText("Team ID"));
+      await userEvent.click(await screen.findByRole("option", { name: /Team Nine/ }));
+
+      await userEvent.click(screen.getByRole("button", { name: /save changes/i }));
+
+      await waitFor(() => {
+        expect(onSubmitMock).toHaveBeenCalled();
+      });
+      expect(onSubmitMock.mock.calls[0][0].team_id).toBe("team-9");
+    });
+
+    it("carries a picked MCP server into the payload", async () => {
+      const onSubmitMock = vi.fn().mockResolvedValue(undefined);
+      renderForPayload(onSubmitMock);
+      await screen.findByRole("button", { name: /save changes/i });
+
+      await userEvent.click(screen.getByRole("button", { name: "pick mcp server" }));
+      await userEvent.click(screen.getByRole("button", { name: /save changes/i }));
+
+      await waitFor(() => {
+        expect(onSubmitMock).toHaveBeenCalled();
+      });
+      expect(onSubmitMock.mock.calls[0][0].mcp_servers_and_groups.servers).toEqual(["mcp-1"]);
+    });
+
+    it("carries a picked agent into the payload", async () => {
+      const onSubmitMock = vi.fn().mockResolvedValue(undefined);
+      renderForPayload(onSubmitMock);
+      await screen.findByRole("button", { name: /save changes/i });
+
+      await userEvent.click(screen.getByRole("button", { name: "pick agent" }));
+      await userEvent.click(screen.getByRole("button", { name: /save changes/i }));
+
+      await waitFor(() => {
+        expect(onSubmitMock).toHaveBeenCalled();
+      });
+      expect(onSubmitMock.mock.calls[0][0].agents_and_groups.agents).toEqual(["agent-1"]);
+    });
+
+    it("carries an added logging integration into the payload", async () => {
+      const onSubmitMock = vi.fn().mockResolvedValue(undefined);
+      renderForPayload(onSubmitMock);
+      await screen.findByRole("button", { name: /save changes/i });
+
+      await userEvent.click(screen.getByRole("button", { name: /add integration/i }));
+      await userEvent.click(screen.getByRole("button", { name: /save changes/i }));
+
+      await waitFor(() => {
+        expect(onSubmitMock).toHaveBeenCalled();
+      });
+      expect(onSubmitMock.mock.calls[0][0].logging_settings).toEqual([
+        { callback_name: "", callback_type: "success", callback_vars: {} },
+      ]);
+    });
+
+    it("resends stored budget fallbacks on an untouched save", async () => {
+      const onSubmitMock = vi.fn().mockResolvedValue(undefined);
+      renderForPayload(onSubmitMock, {
+        ...MOCK_KEY_DATA,
+        budget_fallbacks: { "gpt-4": ["gpt-4o-mini"] },
+      } as KeyResponse);
+      await screen.findByRole("button", { name: /save changes/i });
+
+      await userEvent.click(screen.getByRole("button", { name: /save changes/i }));
+
+      await waitFor(() => {
+        expect(onSubmitMock).toHaveBeenCalled();
+      });
+      expect(onSubmitMock.mock.calls[0][0]).toHaveProperty("budget_fallbacks", { "gpt-4": ["gpt-4o-mini"] });
+    });
+
+    it("omits budget fallbacks entirely for a key that has none", async () => {
+      const onSubmitMock = vi.fn().mockResolvedValue(undefined);
+      renderForPayload(onSubmitMock);
+      await screen.findByRole("button", { name: /save changes/i });
+
+      await userEvent.click(screen.getByRole("button", { name: /save changes/i }));
+
+      await waitFor(() => {
+        expect(onSubmitMock).toHaveBeenCalled();
+      });
+      expect(onSubmitMock.mock.calls[0][0]).not.toHaveProperty("budget_fallbacks");
+    });
+
+    it("resends the stored per-tag rpm limits on an untouched save", async () => {
+      const onSubmitMock = vi.fn().mockResolvedValue(undefined);
+      renderForPayload(onSubmitMock, {
+        ...MOCK_KEY_DATA,
+        metadata: { ...MOCK_KEY_DATA.metadata, tag_rpm_limit: { "test-tag": 7 } },
+      } as KeyResponse);
+      await screen.findByRole("button", { name: /save changes/i });
+
+      await userEvent.click(screen.getByRole("button", { name: /save changes/i }));
+
+      await waitFor(() => {
+        expect(onSubmitMock).toHaveBeenCalled();
+      });
+      expect(onSubmitMock.mock.calls[0][0]).toHaveProperty("tag_rpm_limit", { "test-tag": 7 });
+    });
   });
 });
diff --git a/ui/litellm-dashboard/src/components/templates/key_edit_view.tsx b/ui/litellm-dashboard/src/components/templates/key_edit_view.tsx
index 25e0992e5b6..de8689b46f6 100644
--- a/ui/litellm-dashboard/src/components/templates/key_edit_view.tsx
+++ b/ui/litellm-dashboard/src/components/templates/key_edit_view.tsx
@@ -3,12 +3,16 @@ import { useOrganizations } from "@/app/(dashboard)/hooks/organizations/useOrgan
 import { useProjects } from "@/app/(dashboard)/hooks/projects/useProjects";
 import { useUISettings } from "@/app/(dashboard)/hooks/uiSettings/useUISettings";
 import PolicySelector from "@/components/policies/PolicySelector";
-import { InfoCircleOutlined } from "@ant-design/icons";
 import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from "@/components/ui/select";
+import { Switch } from "@/components/ui/switch";
+import { Textarea } from "@/components/ui/textarea";
+import { TooltipProvider } from "@/components/ui/tooltip";
 import { UiLoadingSpinner } from "@/components/ui/ui-loading-spinner";
-import { Form, Input as AntdInput, Select, Switch, Tooltip } from "antd";
-import { useEffect, useRef, useState } from "react";
+import { Field, FieldGroup, FieldLabel } from "@/components/shared/form/field";
+import { FormField } from "@/components/shared/form/FormField";
+import React, { useEffect, useRef, useState } from "react";
 import { hasCapability } from "../../utils/capabilities";
 import { isProxyAdminRole, rolesWithWriteAccess } from "../../utils/roles";
 import AgentSelector from "../agent_management/AgentSelector";
@@ -21,9 +25,22 @@ import RateLimitTypeFormItem from "../common_components/RateLimitTypeFormItem";
 import OrganizationDropdown from "../common_components/OrganizationDropdown";
 import RouterSettingsAccordion, { RouterSettingsAccordionRef } from "../common_components/RouterSettingsAccordion";
 import { routerSettingsEditorValue, routerSettingsUpdate } from "../common_components/routerSettingsPayload";
-import { extractLoggingSettings, formatMetadataForDisplay, stripTagsFromMetadata } from "../key_info_utils";
-import { estimateFields, estimateRules, estimateTooltips, withNormalizedEstimates } from "./estimatedOutputTokens";
-import { canonicalBudgetDuration, keyTypeFromRoutes } from "./keyEditFieldNormalizers";
+import { estimateTooltips, withNormalizedEstimates } from "./estimatedOutputTokens";
+import {
+  currentValuePlaceholder,
+  keyTypeFromRoutes,
+  modelSentinelOptions,
+  parseAllowedRoutes,
+} from "./keyEditFieldNormalizers";
+import { KeyTypeSelect, labelWithHint } from "./KeyEditViewControls";
+import {
+  AgentsAndGroups,
+  KeyEditFormValues,
+  keyEditFormSchema,
+  McpServersAndGroups,
+  toKeyEditFormValues,
+  toSubmittedValues,
+} from "./keyEditFormValues";
 import { BudgetFallbacksEditor } from "../key_team_helpers/BudgetFallbacksEditor";
 import { BudgetWindowEntry, BudgetWindowsEditor } from "../key_team_helpers/BudgetWindowsEditor";
 import {
@@ -41,8 +58,11 @@ import { toast } from "@/lib/toast";
 import { getPromptsList, modelAvailableCall, tagListCall } from "../networking";
 import { fetchTeamModels } from "../organisms/create_key_button";
 import NumericalInput from "../shared/numerical_input";
+import { MultiSelect } from "../shared/MultiSelect";
+import { TagsInput } from "@/app/(dashboard)/guardrails/_components/content_filter/TagsInput";
 import { Tag } from "../tag_management/types";
 import EditLoggingSettings from "../team/EditLoggingSettings";
+import { useZodForm } from "@/lib/forms/useZodForm";
 import VectorStoreSelector from "../vector_store_management/VectorStoreSelector";
 
 interface KeyEditViewProps {
@@ -71,7 +91,9 @@ export function KeyEditView({
   const canViewPrompts = hasCapability(userRole, "viewPrompts");
   const canEditEstimates = userRole != null && isProxyAdminRole(userRole);
   const estimateTooltip = estimateTooltips(canEditEstimates);
-  const [form] = Form.useForm();
+  const form = useZodForm<KeyEditFormValues, KeyEditFormValues>(keyEditFormSchema, {
+    defaultValues: toKeyEditFormValues(keyData),
+  });
   const [promptsList, setPromptsList] = useState<string[]>([]);
   const [tagsList, setTagsList] = useState<Record<string, Tag>>({});
   const team = teams?.find((team) => team.team_id === keyData.team_id);
@@ -96,6 +118,8 @@ export function KeyEditView({
     keyData.budget_fallbacks && typeof keyData.budget_fallbacks === "object" ? keyData.budget_fallbacks : {},
   );
   const routerSettingsRef = useRef<RouterSettingsAccordionRef>(null);
+  const keyTypeFieldId = React.useId();
+  const projectFieldId = React.useId();
   const { data: organizations, isLoading: isOrganizationsLoading } = useOrganizations();
   const { data: projects } = useProjects();
   const { data: uiSettingsData } = useUISettings();
@@ -107,6 +131,13 @@ export function KeyEditView({
     return project?.project_alias ? `${project.project_alias} (${keyData.project_id})` : keyData.project_id;
   })();
 
+  const allowedRoutesValue = form.watch("allowed_routes");
+  const selectedModels = (form.watch("models") as string[] | undefined) ?? [];
+  const allowedRoutes = parseAllowedRoutes(allowedRoutesValue);
+  const isModelsDisabled = allowedRoutes.includes("management_routes") || allowedRoutes.includes("info_routes");
+  const mcpServersAndGroups = form.watch("mcp_servers_and_groups");
+  const mcpToolPermissions = form.watch("mcp_tool_permissions");
+
   useEffect(() => {
     const fetchModels = async () => {
       if (!userID || !userRole || !accessToken) return;
@@ -143,59 +174,21 @@ export function KeyEditView({
 
   // Sync disabled callbacks with form when component mounts
   useEffect(() => {
-    form.setFieldValue("disabled_callbacks", disabledCallbacks);
+    form.setValue("disabled_callbacks", disabledCallbacks);
   }, [form, disabledCallbacks]);
 
-  // Set initial form values
-  const initialValues = {
-    ...keyData,
-    token: keyData.token || keyData.token_id,
-    budget_duration: canonicalBudgetDuration(keyData.budget_duration),
-    metadata: formatMetadataForDisplay(stripTagsFromMetadata(keyData.metadata)),
-    guardrails: keyData.metadata?.guardrails,
-    disable_global_guardrails: keyData.metadata?.disable_global_guardrails || false,
-    throttle_on_budget_exceeded: keyData.metadata?.throttle_on_budget_exceeded || false,
-    enable_prompt_caching: keyData.metadata?.enable_prompt_caching || false,
-    ...estimateFields(keyData.metadata),
-    prompts: keyData.metadata?.prompts,
-    tags: keyData.metadata?.tags,
-    vector_stores: keyData.object_permission?.vector_stores || [],
-    mcp_servers_and_groups: {
-      servers: keyData.object_permission?.mcp_servers || [],
-      accessGroups: keyData.object_permission?.mcp_access_groups || [],
-      toolsets: keyData.object_permission?.mcp_toolsets || [],
-    },
-    mcp_tool_permissions: keyData.object_permission?.mcp_tool_permissions || {},
-    agents_and_groups: {
-      agents: keyData.object_permission?.agents || [],
-      accessGroups: keyData.object_permission?.agent_access_groups || [],
-    },
-    logging_settings: extractLoggingSettings(keyData.metadata),
-    disabled_callbacks: Array.isArray(keyData.metadata?.litellm_disabled_callbacks)
-      ? mapInternalToDisplayNames(keyData.metadata.litellm_disabled_callbacks)
-      : [],
-    access_group_ids: keyData.access_group_ids || [],
-    auto_rotate: keyData.auto_rotate || false,
-    ...(keyData.rotation_interval && { rotation_interval: keyData.rotation_interval }),
-    allowed_routes:
-      Array.isArray(keyData.allowed_routes) && keyData.allowed_routes.length > 0
-        ? keyData.allowed_routes.join(", ")
-        : "",
-  };
-
   useEffect(() => {
-    form.setFieldsValue(initialValues);
-    // eslint-disable-next-line react-hooks/exhaustive-deps -- initialValues is rebuilt from keyData every render; depending on it would re-run each render
+    form.reset(toKeyEditFormValues(keyData));
   }, [keyData, form]);
 
   // Sync auto-rotation state with form values
   useEffect(() => {
-    form.setFieldValue("auto_rotate", autoRotationEnabled);
+    form.setValue("auto_rotate", autoRotationEnabled);
   }, [autoRotationEnabled, form]);
 
   useEffect(() => {
     if (rotationInterval) {
-      form.setFieldValue("rotation_interval", rotationInterval);
+      form.setValue("rotation_interval", rotationInterval);
     }
   }, [rotationInterval, form]);
 
@@ -305,588 +298,577 @@ export function KeyEditView({
     }
   };
 
+  const handleOrganizationChange = (setField: (value: string | undefined) => void, orgId: string | undefined) => {
+    setField(orgId);
+    setSelectedOrganizationId(orgId || null);
+    form.setValue("team_id", undefined);
+  };
+
+  const handleTeamChange = (setField: (value: string | null) => void, teamId: string | null) => {
+    setField(teamId);
+    const selectedTeam = teams?.find((t) => t.team_id === teamId) || null;
+    if (selectedTeam?.organization_id) {
+      setSelectedOrganizationId(selectedTeam.organization_id);
+      form.setValue("organization_id", selectedTeam.organization_id);
+    } else if (!teamId) {
+      setSelectedOrganizationId(null);
+      form.setValue("organization_id", undefined);
+    }
+  };
+
+  const handleDisabledCallbacksChange = (internalValues: string[]) => {
+    setDisabledCallbacks(mapInternalToDisplayNames(internalValues));
+    form.setValue("disabled_callbacks", internalValues);
+  };
+
+  const modelOptions = [
+    ...modelSentinelOptions(keyData.team_id, team != null),
+    ...availableModels.map((model) => ({
+      value: model,
+      label: model,
+      disabled: hasAllModelsSentinel(selectedModels),
+    })),
+  ];
+
+  const visibleTeams = selectedOrganizationId
+    ? teams?.filter((t) => t.organization_id === selectedOrganizationId)
+    : teams;
+
   return (
-    <Form form={form} onFinish={handleSubmit} initialValues={initialValues} layout="vertical">
-      <Form.Item label="Key Alias" name="key_alias">
-        <Input />
-      </Form.Item>
+    <TooltipProvider>
+      <form
+        onSubmit={form.handleSubmit((values) =>
+          handleSubmit(toSubmittedValues(values, { canViewPolicies, canViewPrompts })),
+        )}
+      >
+        <FieldGroup>
+          <FormField control={form.control} name="key_alias" label="Key Alias">
+            {(field) => <Input {...field} value={(field.value as string | undefined) ?? ""} />}
+          </FormField>
 
-      <Form.Item label="Models" name="models">
-        <Form.Item
-          noStyle
-          shouldUpdate={(prevValues, currentValues) =>
-            prevValues.allowed_routes !== currentValues.allowed_routes || prevValues.models !== currentValues.models
-          }
-        >
-          {({ getFieldValue, setFieldValue }) => {
-            const allowedRoutesValue = getFieldValue("allowed_routes") || "";
-            // Convert string to array for checking
-            const allowedRoutes =
-              typeof allowedRoutesValue === "string" && allowedRoutesValue.trim() !== ""
-                ? allowedRoutesValue
-                    .split(",")
-                    .map((r: string) => r.trim())
-                    .filter((r: string) => r.length > 0)
-                : [];
-            const isDisabled = allowedRoutes.includes("management_routes") || allowedRoutes.includes("info_routes");
-            const models = getFieldValue("models") || [];
-
-            return (
-              <>
-                <Select
-                  mode="multiple"
-                  placeholder="Select models"
-                  style={{ width: "100%" }}
-                  disabled={isDisabled}
-                  value={isDisabled ? [] : models}
-                  onChange={(value) => {
-                    if (value.includes("all-team-models")) {
-                      setFieldValue("models", ["all-team-models"]);
-                    } else if (value.includes("all-proxy-models")) {
-                      setFieldValue("models", ["all-proxy-models"]);
-                    } else {
-                      setFieldValue("models", value);
-                    }
-                  }}
-                >
-                  {keyData.team_id != null ? (
-                    team != null && <Select.Option value="all-team-models">All Team Models</Select.Option>
-                  ) : (
-                    <Select.Option value="all-proxy-models">All Proxy Models</Select.Option>
-                  )}
-                  {availableModels.map((model) => (
-                    <Select.Option key={model} value={model} disabled={hasAllModelsSentinel(models)}>
-                      {model}
-                    </Select.Option>
-                  ))}
-                </Select>
-                {isDisabled && (
-                  <div style={{ fontSize: "11px", color: "#6b7280", marginTop: "2px" }}>
-                    Models field is disabled for this key type
-                  </div>
-                )}
-              </>
-            );
-          }}
-        </Form.Item>
-      </Form.Item>
-
-      <Form.Item label="Key Type">
-        <Form.Item
-          noStyle
-          shouldUpdate={(prevValues, currentValues) => prevValues.allowed_routes !== currentValues.allowed_routes}
-        >
-          {({ getFieldValue, setFieldValue }) => {
-            const allowedRoutesValue = getFieldValue("allowed_routes") || "";
-            // Convert string to array for keyTypeFromRoutes
-            const allowedRoutes =
-              typeof allowedRoutesValue === "string" && allowedRoutesValue.trim() !== ""
-                ? allowedRoutesValue
-                    .split(",")
-                    .map((r: string) => r.trim())
-                    .filter((r: string) => r.length > 0)
-                : [];
-            const keyTypeValue = keyTypeFromRoutes(allowedRoutes);
-
-            return (
-              <Select
-                placeholder="Select key type"
-                style={{ width: "100%" }}
-                optionLabelProp="label"
-                value={keyTypeValue}
-                onChange={(value) => {
-                  switch (value) {
-                    case "default":
-                      setFieldValue("allowed_routes", "");
-                      break;
-                    case "llm_api":
-                      setFieldValue("allowed_routes", "llm_api_routes");
-                      break;
-                    case "management":
-                      setFieldValue("allowed_routes", "management_routes");
-                      setFieldValue("models", []);
-                      break;
+          <FormField
+            control={form.control}
+            name="models"
+            label="Models"
+            description={isModelsDisabled ? "Models field is disabled for this key type" : undefined}
+          >
+            {({ value, onChange, id }) => (
+              <MultiSelect
+                id={id}
+                options={modelOptions}
+                value={isModelsDisabled ? [] : (value as string[] | undefined) ?? []}
+                onValueChange={(next) => {
+                  if (next.includes("all-team-models")) {
+                    onChange(["all-team-models"]);
+                  } else if (next.includes("all-proxy-models")) {
+                    onChange(["all-proxy-models"]);
+                  } else {
+                    onChange(next);
                   }
                 }}
-              >
-                <Select.Option value="default" label="Full Access">
-                  <div style={{ padding: "4px 0" }}>
-                    <div style={{ fontWeight: 500 }}>Full Access</div>
-                    <div style={{ fontSize: "11px", color: "#6b7280", marginTop: "2px" }}>
-                      Can call all routes (AI APIs, Management, and read-only)
-                    </div>
-                  </div>
-                </Select.Option>
-                <Select.Option value="llm_api" label="AI APIs">
-                  <div style={{ padding: "4px 0" }}>
-                    <div style={{ fontWeight: 500 }}>AI APIs</div>
-                    <div style={{ fontSize: "11px", color: "#6b7280", marginTop: "2px" }}>
-                      Can call only AI API routes (chat/completions, embeddings, etc.)
-                    </div>
-                  </div>
-                </Select.Option>
-                <Select.Option value="management" label="Management">
-                  <div style={{ padding: "4px 0" }}>
-                    <div style={{ fontWeight: 500 }}>Management</div>
-                    <div style={{ fontSize: "11px", color: "#6b7280", marginTop: "2px" }}>
-                      Can call only management routes (user/team/key management)
-                    </div>
-                  </div>
-                </Select.Option>
-              </Select>
-            );
-          }}
-        </Form.Item>
-      </Form.Item>
+                disabled={isModelsDisabled}
+                placeholder="Select models"
+              />
+            )}
+          </FormField>
 
-      <Form.Item
-        label={
-          <span>
-            Allowed Routes{" "}
-            <Tooltip title="List of allowed routes for the key (comma-separated). Can be specific routes (e.g., '/chat/completions') or route patterns (e.g., 'llm_api_routes', 'management_routes', '/keys/*'). Leave empty to allow all routes.">
-              <InfoCircleOutlined style={{ marginLeft: "4px" }} />
-            </Tooltip>
-          </span>
-        }
-        name="allowed_routes"
-      >
-        <AntdInput placeholder="Enter allowed routes (comma-separated). Special values: llm_api_routes, management_routes. Examples: llm_api_routes, /chat/completions, /keys/*. Leave empty to allow all routes" />
-      </Form.Item>
-
-      <Form.Item label="Max Budget (USD)" name="max_budget">
-        <NumericalInput step={0.01} style={{ width: "100%" }} placeholder="Enter a numerical value" />
-      </Form.Item>
-
-      <Form.Item label="Reset Budget" name="budget_duration">
-        <BudgetDurationDropdown placeholder="Never resets" />
-      </Form.Item>
-
-      <Form.Item
-        label={
-          <span>
-            Budget Windows{" "}
-            <Tooltip title="Set multiple independent budget windows (e.g., hourly $10 AND monthly $200). Each window tracks spend separately and resets on its own schedule.">
-              <InfoCircleOutlined style={{ marginLeft: "4px" }} />
-            </Tooltip>
-          </span>
-        }
-      >
-        <BudgetWindowsEditor value={budgetLimits} onChange={setBudgetLimits} />
-      </Form.Item>
-
-      <Form.Item
-        label={
-          <span>
-            Budget Fallbacks{" "}
-            <Tooltip title="When a model exceeds its per-model budget, requests automatically reroute to fallback models instead of failing">
-              <InfoCircleOutlined style={{ marginLeft: "4px" }} />
-            </Tooltip>
-          </span>
-        }
-      >
-        <BudgetFallbacksEditor
-          value={budgetFallbacks}
-          onChange={setBudgetFallbacks}
-          availableModels={availableModels}
-        />
-      </Form.Item>
-
-      <Form.Item label="TPM Limit" name="tpm_limit">
-        <NumericalInput min={0} />
-      </Form.Item>
-
-      <Form.Item name="tpm_limit_type" initialValue={null} noStyle>
-        <RateLimitTypeFormItem type="tpm" name="tpm_limit_type" showDetailedDescriptions={false} />
-      </Form.Item>
-
-      <Form.Item label="RPM Limit" name="rpm_limit">
-        <NumericalInput min={0} />
-      </Form.Item>
-
-      <Form.Item name="rpm_limit_type" initialValue={null} noStyle>
-        <RateLimitTypeFormItem type="rpm" name="rpm_limit_type" showDetailedDescriptions={false} />
-      </Form.Item>
-
-      <Form.Item
-        label={
-          <span>
-            Throttle on budget exceeded{" "}
-            <Tooltip title="When this key exceeds its max budget, throttle its TPM/RPM to the globally configured percentage instead of blocking access entirely. Requires budget_exceeded_throttle_percentage in litellm_settings and a TPM/RPM limit on the key.">
-              <InfoCircleOutlined style={{ marginLeft: "4px" }} />
-            </Tooltip>
-          </span>
-        }
-        name="throttle_on_budget_exceeded"
-        valuePropName="checked"
-      >
-        <Switch checkedChildren="Yes" unCheckedChildren="No" />
-      </Form.Item>
-
-      <Form.Item
-        label={
-          <span>
-            Enable Prompt Caching{" "}
-            <Tooltip title="Automatically add prompt caching breakpoints (cache_control markers) to requests made with this key, cutting input cost on repeated prompts. Applies to Anthropic and Bedrock Claude models; requests that already set their own cache_control markers are left untouched.">
-              <InfoCircleOutlined style={{ marginLeft: "4px" }} />
-            </Tooltip>
-          </span>
-        }
-        name="enable_prompt_caching"
-        valuePropName="checked"
-      >
-        <Switch checkedChildren="Yes" unCheckedChildren="No" />
-      </Form.Item>
-
-      <Form.Item label="Max Parallel Requests" name="max_parallel_requests">
-        <NumericalInput min={0} />
-      </Form.Item>
-
-      <Form.Item label="Model TPM Limit" name="model_tpm_limit">
-        <AntdInput.TextArea rows={4} placeholder='{"gpt-4": 100, "claude-v1": 200}' />
-      </Form.Item>
-
-      <Form.Item label="Model RPM Limit" name="model_rpm_limit">
-        <AntdInput.TextArea rows={4} placeholder='{"gpt-4": 100, "claude-v1": 200}' />
-      </Form.Item>
-
-      <Form.Item
-        label="Estimated Output Tokens"
-        name="default_estimated_output_tokens"
-        tooltip={estimateTooltip.estimate}
-        rules={[estimateRules.positive]}
-      >
-        <NumericalInput min={1} step={1} disabled={!canEditEstimates} />
-      </Form.Item>
-
-      <Form.Item
-        label="Estimated Output Tokens Per Model"
-        name="default_estimated_output_tokens_per_model"
-        tooltip={estimateTooltip.perModel}
-        rules={[estimateRules.perModel]}
-      >
-        <AntdInput.TextArea rows={4} placeholder='{"gpt-4": 4096}' disabled={!canEditEstimates} />
-      </Form.Item>
-
-      <Form.Item
-        label={
-          <span>
-            Per-Tag Rate Limits{" "}
-            <Tooltip title="Scope rate limits to a request tag so each tag (e.g. a cell or group) gets its own RPM counter. Requests without a matching tag fall back to the key-level limit.">
-              <InfoCircleOutlined style={{ marginLeft: "4px" }} />
-            </Tooltip>
-          </span>
-        }
-      >
-        <TagRateLimitEditor value={tagRateLimits} onChange={setTagRateLimits} />
-      </Form.Item>
-
-      <Form.Item label="Guardrails" name="guardrails">
-        {accessToken && (
-          <GuardrailSelector
-            onChange={(v) => {
-              form.setFieldValue("guardrails", v);
-            }}
-            accessToken={accessToken}
-            disabled={!canEditGuardrails}
-          />
-        )}
-      </Form.Item>
-
-      <Form.Item
-        label={
-          <span>
-            Disable Global Guardrails{" "}
-            <Tooltip title="When enabled, this key will bypass any guardrails configured to run on every request (global guardrails)">
-              <InfoCircleOutlined style={{ marginLeft: "4px" }} />
-            </Tooltip>
-          </span>
-        }
-        name="disable_global_guardrails"
-        valuePropName="checked"
-      >
-        <Switch disabled={!canEditGuardrails} checkedChildren="Yes" unCheckedChildren="No" />
-      </Form.Item>
-
-      {canViewPolicies && (
-        <Form.Item
-          label={
-            <span>
-              Policies{" "}
-              <Tooltip title="Apply policies to this key to control guardrails and other settings">
-                <InfoCircleOutlined style={{ marginLeft: "4px" }} />
-              </Tooltip>
-            </span>
-          }
-          name="policies"
-        >
-          {accessToken && (
-            <PolicySelector
-              onChange={(v) => {
-                form.setFieldValue("policies", v);
+          <Field>
+            <FieldLabel htmlFor={keyTypeFieldId}>Key Type</FieldLabel>
+            <KeyTypeSelect
+              id={keyTypeFieldId}
+              value={keyTypeFromRoutes(allowedRoutes)}
+              onChange={(value) => {
+                switch (value) {
+                  case "default":
+                    form.setValue("allowed_routes", "");
+                    break;
+                  case "llm_api":
+                    form.setValue("allowed_routes", "llm_api_routes");
+                    break;
+                  case "management":
+                    form.setValue("allowed_routes", "management_routes");
+                    form.setValue("models", []);
+                    break;
+                }
               }}
-              accessToken={accessToken}
-              disabled={!premiumUser}
             />
-          )}
-        </Form.Item>
-      )}
+          </Field>
 
-      <Form.Item label="Tags" name="tags">
-        <Select
-          mode="tags"
-          style={{ width: "100%" }}
-          placeholder="Select or enter tags"
-          options={Object.values(tagsList).map((tag) => ({
-            value: tag.name,
-            label: tag.name,
-            title: tag.description || tag.name,
-          }))}
-        />
-      </Form.Item>
+          <FormField
+            control={form.control}
+            name="allowed_routes"
+            label={labelWithHint(
+              "Allowed Routes",
+              "List of allowed routes for the key (comma-separated). Can be specific routes (e.g., '/chat/completions') or route patterns (e.g., 'llm_api_routes', 'management_routes', '/keys/*'). Leave empty to allow all routes.",
+            )}
+          >
+            {(field) => (
+              <Input
+                {...field}
+                value={(field.value as string | undefined) ?? ""}
+                placeholder="Enter allowed routes (comma-separated). Special values: llm_api_routes, management_routes. Examples: llm_api_routes, /chat/completions, /keys/*. Leave empty to allow all routes"
+              />
+            )}
+          </FormField>
 
-      {canViewPrompts && (
-        <Form.Item label="Prompts" name="prompts">
-          <Tooltip title={!premiumUser ? "Setting prompts by key is a premium feature" : ""} placement="top">
-            <Select
-              mode="tags"
-              style={{ width: "100%" }}
-              disabled={!premiumUser}
-              placeholder={
-                !premiumUser
-                  ? "Premium feature - Upgrade to set prompts by key"
-                  : Array.isArray(keyData.metadata?.prompts) && keyData.metadata.prompts.length > 0
-                    ? `Current: ${keyData.metadata.prompts.join(", ")}`
-                    : "Select or enter prompts"
+          <FormField control={form.control} name="max_budget" label="Max Budget (USD)">
+            {({ ref: _ref, ...field }) => (
+              <NumericalInput
+                {...field}
+                value={field.value ?? ""}
+                step={0.01}
+                style={{ width: "100%" }}
+                placeholder="Enter a numerical value"
+              />
+            )}
+          </FormField>
+
+          <FormField control={form.control} name="budget_duration" label="Reset Budget">
+            {({ value, onChange, id }) => (
+              <BudgetDurationDropdown
+                id={id}
+                value={value as string | null}
+                onChange={(next) => onChange(next ?? null)}
+                placeholder="Never resets"
+              />
+            )}
+          </FormField>
+
+          <Field>
+            <FieldLabel>
+              {labelWithHint(
+                "Budget Windows",
+                "Set multiple independent budget windows (e.g., hourly $10 AND monthly $200). Each window tracks spend separately and resets on its own schedule.",
+              )}
+            </FieldLabel>
+            <BudgetWindowsEditor value={budgetLimits} onChange={setBudgetLimits} />
+          </Field>
+
+          <Field>
+            <FieldLabel>
+              {labelWithHint(
+                "Budget Fallbacks",
+                "When a model exceeds its per-model budget, requests automatically reroute to fallback models instead of failing",
+              )}
+            </FieldLabel>
+            <BudgetFallbacksEditor
+              value={budgetFallbacks}
+              onChange={setBudgetFallbacks}
+              availableModels={availableModels}
+            />
+          </Field>
+
+          <FormField control={form.control} name="tpm_limit" label="TPM Limit">
+            {({ ref: _ref, ...field }) => <NumericalInput {...field} value={field.value ?? ""} min={0} />}
+          </FormField>
+
+          <FormField control={form.control} name="tpm_limit_type">
+            {({ value, onChange, id }) => (
+              <RateLimitTypeFormItem
+                id={id}
+                type="tpm"
+                name="tpm_limit_type"
+                showDetailedDescriptions={false}
+                value={value as string | null}
+                onChange={onChange}
+              />
+            )}
+          </FormField>
+
+          <FormField control={form.control} name="rpm_limit" label="RPM Limit">
+            {({ ref: _ref, ...field }) => <NumericalInput {...field} value={field.value ?? ""} min={0} />}
+          </FormField>
+
+          <FormField control={form.control} name="rpm_limit_type">
+            {({ value, onChange, id }) => (
+              <RateLimitTypeFormItem
+                id={id}
+                type="rpm"
+                name="rpm_limit_type"
+                showDetailedDescriptions={false}
+                value={value as string | null}
+                onChange={onChange}
+              />
+            )}
+          </FormField>
+
+          <FormField
+            control={form.control}
+            name="throttle_on_budget_exceeded"
+            label={labelWithHint(
+              "Throttle on budget exceeded",
+              "When this key exceeds its max budget, throttle its TPM/RPM to the globally configured percentage instead of blocking access entirely. Requires budget_exceeded_throttle_percentage in litellm_settings and a TPM/RPM limit on the key.",
+            )}
+          >
+            {({ value, onChange, ref: _ref, ...field }) => (
+              <Switch {...field} checked={Boolean(value)} onCheckedChange={onChange} />
+            )}
+          </FormField>
+
+          <FormField
+            control={form.control}
+            name="enable_prompt_caching"
+            label={labelWithHint(
+              "Enable Prompt Caching",
+              "Automatically add prompt caching breakpoints (cache_control markers) to requests made with this key, cutting input cost on repeated prompts. Applies to Anthropic and Bedrock Claude models; requests that already set their own cache_control markers are left untouched.",
+            )}
+          >
+            {({ value, onChange, ref: _ref, ...field }) => (
+              <Switch {...field} checked={Boolean(value)} onCheckedChange={onChange} />
+            )}
+          </FormField>
+
+          <FormField control={form.control} name="max_parallel_requests" label="Max Parallel Requests">
+            {({ ref: _ref, ...field }) => <NumericalInput {...field} value={field.value ?? ""} min={0} />}
+          </FormField>
+
+          <FormField control={form.control} name="model_tpm_limit" label="Model TPM Limit">
+            {(field) => (
+              <Textarea
+                {...field}
+                value={(field.value as string | undefined) ?? ""}
+                rows={4}
+                placeholder='{"gpt-4": 100, "claude-v1": 200}'
+              />
+            )}
+          </FormField>
+
+          <FormField control={form.control} name="model_rpm_limit" label="Model RPM Limit">
+            {(field) => (
+              <Textarea
+                {...field}
+                value={(field.value as string | undefined) ?? ""}
+                rows={4}
+                placeholder='{"gpt-4": 100, "claude-v1": 200}'
+              />
+            )}
+          </FormField>
+
+          <FormField
+            control={form.control}
+            name="default_estimated_output_tokens"
+            label={labelWithHint("Estimated Output Tokens", estimateTooltip.estimate)}
+          >
+            {({ ref: _ref, ...field }) => (
+              <NumericalInput {...field} value={field.value ?? ""} min={1} step={1} disabled={!canEditEstimates} />
+            )}
+          </FormField>
+
+          <FormField
+            control={form.control}
+            name="default_estimated_output_tokens_per_model"
+            label={labelWithHint("Estimated Output Tokens Per Model", estimateTooltip.perModel)}
+          >
+            {(field) => (
+              <Textarea
+                {...field}
+                value={(field.value as string | undefined) ?? ""}
+                rows={4}
+                placeholder='{"gpt-4": 4096}'
+                disabled={!canEditEstimates}
+              />
+            )}
+          </FormField>
+
+          <Field>
+            <FieldLabel>
+              {labelWithHint(
+                "Per-Tag Rate Limits",
+                "Scope rate limits to a request tag so each tag (e.g. a cell or group) gets its own RPM counter. Requests without a matching tag fall back to the key-level limit.",
+              )}
+            </FieldLabel>
+            <TagRateLimitEditor value={tagRateLimits} onChange={setTagRateLimits} />
+          </Field>
+
+          <FormField control={form.control} name="guardrails" label="Guardrails">
+            {({ value, onChange }) =>
+              accessToken ? (
+                <GuardrailSelector
+                  onChange={onChange}
+                  value={value as string[] | undefined}
+                  accessToken={accessToken}
+                  disabled={!canEditGuardrails}
+                />
+              ) : (
+                <div />
+              )
+            }
+          </FormField>
+
+          <FormField
+            control={form.control}
+            name="disable_global_guardrails"
+            label={labelWithHint(
+              "Disable Global Guardrails",
+              "When enabled, this key will bypass any guardrails configured to run on every request (global guardrails)",
+            )}
+          >
+            {({ value, onChange, ref: _ref, ...field }) => (
+              <Switch {...field} checked={Boolean(value)} onCheckedChange={onChange} disabled={!canEditGuardrails} />
+            )}
+          </FormField>
+
+          {canViewPolicies && (
+            <FormField
+              control={form.control}
+              name="policies"
+              label={labelWithHint("Policies", "Apply policies to this key to control guardrails and other settings")}
+            >
+              {({ value, onChange }) =>
+                accessToken ? (
+                  <PolicySelector
+                    onChange={onChange}
+                    value={value as string[] | undefined}
+                    accessToken={accessToken}
+                    disabled={!premiumUser}
+                  />
+                ) : (
+                  <div />
+                )
               }
-              options={promptsList.map((name) => ({ value: name, label: name }))}
-            />
-          </Tooltip>
-        </Form.Item>
-      )}
+            </FormField>
+          )}
 
-      <Form.Item
-        label={
-          <span>
-            Access Groups{" "}
-            <Tooltip title="Assign access groups to this key. Access groups control which models, MCP servers, and agents this key can use">
-              <InfoCircleOutlined style={{ marginLeft: "4px" }} />
-            </Tooltip>
-          </span>
-        }
-        name="access_group_ids"
-      >
-        <AccessGroupSelector placeholder="Select access groups (optional)" />
-      </Form.Item>
+          <FormField control={form.control} name="tags" label="Tags">
+            {({ value, onChange, id }) => (
+              <TagsInput
+                id={id}
+                value={(value as string[] | undefined) ?? []}
+                onValueChange={onChange}
+                options={Object.values(tagsList).map((tag) => ({ value: tag.name, label: tag.name }))}
+                placeholder="Select or enter tags"
+              />
+            )}
+          </FormField>
 
-      <Form.Item
-        label="Allowed Pass Through Routes"
-        name="allowed_passthrough_routes"
-        tooltip={!premiumUser ? "Setting allowed pass through routes by key is a premium feature" : undefined}
-      >
-        <PassThroughRoutesSelector
-          accessToken={accessToken || ""}
-          placeholder={
-            !premiumUser
-              ? "Premium feature - Upgrade to set allowed pass through routes by key"
-              : Array.isArray(keyData.metadata?.allowed_passthrough_routes) &&
-                  keyData.metadata.allowed_passthrough_routes.length > 0
-                ? `Current: ${keyData.metadata.allowed_passthrough_routes.join(", ")}`
-                : "Select or enter allowed pass through routes"
-          }
-          disabled={!premiumUser}
-        />
-      </Form.Item>
+          {canViewPrompts && (
+            <FormField
+              control={form.control}
+              name="prompts"
+              label={premiumUser ? "Prompts" : labelWithHint("Prompts", "Setting prompts by key is a premium feature")}
+            >
+              {({ value, onChange, id }) => (
+                <TagsInput
+                  id={id}
+                  value={(value as string[] | undefined) ?? []}
+                  onValueChange={onChange}
+                  options={promptsList.map((name) => ({ value: name, label: name }))}
+                  disabled={!premiumUser}
+                  placeholder={currentValuePlaceholder(
+                    premiumUser,
+                    keyData.metadata?.prompts,
+                    "Premium feature - Upgrade to set prompts by key",
+                    "Select or enter prompts",
+                  )}
+                />
+              )}
+            </FormField>
+          )}
 
-      <Form.Item label="Vector Stores" name="vector_stores">
-        <VectorStoreSelector
-          onChange={(values: string[]) => form.setFieldValue("vector_stores", values)}
-          value={form.getFieldValue("vector_stores")}
-          accessToken={accessToken || ""}
-          placeholder="Select vector stores"
-        />
-      </Form.Item>
+          <FormField
+            control={form.control}
+            name="access_group_ids"
+            label={labelWithHint(
+              "Access Groups",
+              "Assign access groups to this key. Access groups control which models, MCP servers, and agents this key can use",
+            )}
+          >
+            {({ value, onChange }) => (
+              <AccessGroupSelector
+                value={value as string[] | undefined}
+                onChange={onChange}
+                placeholder="Select access groups (optional)"
+              />
+            )}
+          </FormField>
 
-      <Form.Item label="MCP Servers / Access Groups" name="mcp_servers_and_groups">
-        <MCPServerSelector
-          onChange={(val) => form.setFieldValue("mcp_servers_and_groups", val)}
-          value={form.getFieldValue("mcp_servers_and_groups")}
-          accessToken={accessToken || ""}
-          placeholder="Select MCP servers or access groups (optional)"
-          allowNoMcpServers
-        />
-      </Form.Item>
+          <FormField
+            control={form.control}
+            name="allowed_passthrough_routes"
+            label={
+              premiumUser
+                ? "Allowed Pass Through Routes"
+                : labelWithHint(
+                    "Allowed Pass Through Routes",
+                    "Setting allowed pass through routes by key is a premium feature",
+                  )
+            }
+          >
+            {({ value, onChange }) => (
+              <PassThroughRoutesSelector
+                value={value as string[] | undefined}
+                onChange={onChange}
+                accessToken={accessToken || ""}
+                placeholder={currentValuePlaceholder(
+                  premiumUser,
+                  keyData.metadata?.allowed_passthrough_routes,
+                  "Premium feature - Upgrade to set allowed pass through routes by key",
+                  "Select or enter allowed pass through routes",
+                )}
+                disabled={!premiumUser}
+              />
+            )}
+          </FormField>
 
-      {/* Hidden field to register mcp_tool_permissions with the form */}
-      <Form.Item name="mcp_tool_permissions" initialValue={{}} hidden>
-        <AntdInput type="hidden" />
-      </Form.Item>
+          <FormField control={form.control} name="vector_stores" label="Vector Stores">
+            {({ value, onChange }) => (
+              <VectorStoreSelector
+                onChange={onChange}
+                value={value as string[] | undefined}
+                accessToken={accessToken || ""}
+                placeholder="Select vector stores"
+              />
+            )}
+          </FormField>
+
+          <FormField control={form.control} name="mcp_servers_and_groups" label="MCP Servers / Access Groups">
+            {({ value, onChange }) => (
+              <MCPServerSelector
+                onChange={onChange}
+                value={value as McpServersAndGroups | undefined}
+                accessToken={accessToken || ""}
+                placeholder="Select MCP servers or access groups (optional)"
+                allowNoMcpServers
+              />
+            )}
+          </FormField>
 
-      <Form.Item
-        noStyle
-        shouldUpdate={(prevValues, currentValues) =>
-          prevValues.mcp_servers_and_groups !== currentValues.mcp_servers_and_groups ||
-          prevValues.mcp_tool_permissions !== currentValues.mcp_tool_permissions
-        }
-      >
-        {() => (
           <div className="mb-6">
             <MCPToolPermissions
               accessToken={accessToken || ""}
-              selectedServers={(form.getFieldValue("mcp_servers_and_groups")?.servers || []).filter(
+              selectedServers={((mcpServersAndGroups as { servers?: string[] } | undefined)?.servers || []).filter(
                 (s: string) => s !== NO_MCP_SERVERS_SENTINEL,
               )}
-              toolPermissions={form.getFieldValue("mcp_tool_permissions") || {}}
-              onChange={(toolPerms) => form.setFieldsValue({ mcp_tool_permissions: toolPerms })}
+              toolPermissions={(mcpToolPermissions as Record<string, string[]> | undefined) || {}}
+              onChange={(toolPerms) => form.setValue("mcp_tool_permissions", toolPerms)}
             />
           </div>
-        )}
-      </Form.Item>
 
-      <Form.Item label="Agents / Access Groups" name="agents_and_groups">
-        <AgentSelector
-          onChange={(val) => form.setFieldValue("agents_and_groups", val)}
-          value={form.getFieldValue("agents_and_groups")}
-          accessToken={accessToken || ""}
-          placeholder="Select agents or access groups (optional)"
-        />
-      </Form.Item>
+          <FormField control={form.control} name="agents_and_groups" label="Agents / Access Groups">
+            {({ value, onChange }) => (
+              <AgentSelector
+                onChange={onChange}
+                value={value as AgentsAndGroups | undefined}
+                accessToken={accessToken || ""}
+                placeholder="Select agents or access groups (optional)"
+              />
+            )}
+          </FormField>
 
-      <Form.Item
-        label={
-          <span>
-            Organization{" "}
-            <Tooltip title="The organization this key belongs to. Selecting an organization filters the available teams.">
-              <InfoCircleOutlined style={{ marginLeft: "4px" }} />
-            </Tooltip>
-          </span>
-        }
-        name="organization_id"
-      >
-        <OrganizationDropdown
-          organizations={organizations}
-          loading={isOrganizationsLoading}
-          disabled={userRole !== "Admin"}
-          onChange={(orgId) => {
-            setSelectedOrganizationId(orgId || null);
-            form.setFieldValue("team_id", undefined);
-          }}
-        />
-      </Form.Item>
+          <FormField
+            control={form.control}
+            name="organization_id"
+            label={labelWithHint(
+              "Organization",
+              "The organization this key belongs to. Selecting an organization filters the available teams.",
+            )}
+          >
+            {({ value, onChange, id }) => (
+              <OrganizationDropdown
+                id={id}
+                value={(value as string | undefined) ?? undefined}
+                organizations={organizations}
+                loading={isOrganizationsLoading}
+                disabled={userRole !== "Admin"}
+                onChange={(orgId) => handleOrganizationChange(onChange, orgId)}
+              />
+            )}
+          </FormField>
 
-      <Form.Item
-        label="Team ID"
-        name="team_id"
-        help={enableProjectsUI && hasProject ? "Team is locked because this key belongs to a project" : undefined}
-      >
-        <Select
-          placeholder="Select team"
-          showSearch
-          disabled={enableProjectsUI && hasProject}
-          style={{ width: "100%" }}
-          onChange={(teamId) => {
-            const selectedTeam = teams?.find((t) => t.team_id === teamId) || null;
-            if (selectedTeam?.organization_id) {
-              setSelectedOrganizationId(selectedTeam.organization_id);
-              form.setFieldValue("organization_id", selectedTeam.organization_id);
-            } else if (!teamId) {
-              setSelectedOrganizationId(null);
-              form.setFieldValue("organization_id", undefined);
+          <FormField
+            control={form.control}
+            name="team_id"
+            label="Team ID"
+            description={
+              enableProjectsUI && hasProject ? "Team is locked because this key belongs to a project" : undefined
             }
-          }}
-          filterOption={(input, option) => {
-            const filteredTeams = selectedOrganizationId
-              ? teams?.filter((t) => t.organization_id === selectedOrganizationId)
-              : teams;
-            const team = filteredTeams?.find((t) => t.team_id === option?.value);
-            if (!team) return false;
-            return team.team_alias?.toLowerCase().includes(input.toLowerCase()) ?? false;
-          }}
-        >
-          {(selectedOrganizationId ? teams?.filter((t) => t.organization_id === selectedOrganizationId) : teams)?.map(
-            (team) => (
-              <Select.Option key={team.team_id} value={team.team_id}>
-                {`${team.team_alias} (${team.team_id})`}
-              </Select.Option>
-            ),
+          >
+            {({ value, onChange, id }) => (
+              <Select
+                value={(value as string | null) ?? null}
+                onValueChange={(teamId: string | null) => handleTeamChange(onChange, teamId)}
+                disabled={enableProjectsUI && hasProject}
+                items={Object.fromEntries(
+                  (visibleTeams ?? []).map((t) => [t.team_id, `${t.team_alias} (${t.team_id})`]),
+                )}
+              >
+                <SelectTrigger id={id} className="w-full">
+                  <SelectValue placeholder="Select team" />
+                </SelectTrigger>
+                <SelectContent>
+                  {visibleTeams?.map((t) => (
+                    <SelectItem key={t.team_id} value={t.team_id}>
+                      {`${t.team_alias} (${t.team_id})`}
+                    </SelectItem>
+                  ))}
+                </SelectContent>
+              </Select>
+            )}
+          </FormField>
+
+          {enableProjectsUI && hasProject && (
+            <Field>
+              <FieldLabel htmlFor={projectFieldId}>Project</FieldLabel>
+              <Input id={projectFieldId} value={projectDisplay ?? ""} disabled readOnly />
+            </Field>
           )}
-        </Select>
-      </Form.Item>
-      {enableProjectsUI && hasProject && (
-        <Form.Item label="Project">
-          <AntdInput value={projectDisplay ?? ""} disabled />
-        </Form.Item>
-      )}
-      <Form.Item label="Router Settings">
-        <RouterSettingsAccordion
-          ref={routerSettingsRef}
-          accessToken={accessToken || ""}
-          teamId={keyData.team_id}
-          value={routerSettingsEditorValue(keyData.router_settings)}
-        />
-      </Form.Item>
 
-      <Form.Item label="Logging Settings" name="logging_settings">
-        <EditLoggingSettings
-          value={form.getFieldValue("logging_settings")}
-          onChange={(values) => form.setFieldValue("logging_settings", values)}
-          disabledCallbacks={disabledCallbacks}
-          onDisabledCallbacksChange={(internalValues) => {
-            // Convert internal values back to display names for UI state
-            const displayNames = mapInternalToDisplayNames(internalValues);
-            setDisabledCallbacks(displayNames);
-            // Store internal values in form for submission
-            form.setFieldValue("disabled_callbacks", internalValues);
-          }}
-        />
-      </Form.Item>
+          <Field>
+            <FieldLabel>Router Settings</FieldLabel>
+            <RouterSettingsAccordion
+              ref={routerSettingsRef}
+              accessToken={accessToken || ""}
+              teamId={keyData.team_id}
+              value={routerSettingsEditorValue(keyData.router_settings)}
+            />
+          </Field>
 
-      <Form.Item label="Metadata" name="metadata">
-        <AntdInput.TextArea rows={10} />
-      </Form.Item>
+          <FormField control={form.control} name="logging_settings" label="Logging Settings">
+            {({ value, onChange }) => (
+              <EditLoggingSettings
+                value={(value as unknown[] | undefined) ?? []}
+                onChange={onChange}
+                disabledCallbacks={disabledCallbacks}
+                onDisabledCallbacksChange={handleDisabledCallbacksChange}
+              />
+            )}
+          </FormField>
 
-      {/* Auto-Rotation Settings */}
-      <div className="mb-4">
-        <Form.Item name="duration" initialValue="" noStyle>
-          <KeyLifecycleSettings
-            autoRotationEnabled={autoRotationEnabled}
-            onAutoRotationChange={setAutoRotationEnabled}
-            rotationInterval={rotationInterval}
-            onRotationIntervalChange={setRotationInterval}
-            neverExpire={neverExpire}
-            onNeverExpireChange={setNeverExpire}
-          />
-        </Form.Item>
-      </div>
+          <FormField control={form.control} name="metadata" label="Metadata">
+            {(field) => <Textarea {...field} value={(field.value as string | undefined) ?? ""} rows={10} />}
+          </FormField>
 
-      {/* Hidden form field for token */}
-      <Form.Item name="token" hidden>
-        <AntdInput />
-      </Form.Item>
+          <div className="mb-4">
+            <FormField control={form.control} name="duration">
+              {({ value, onChange, id }) => (
+                <KeyLifecycleSettings
+                  id={id}
+                  value={(value as string | null) ?? ""}
+                  onChange={onChange}
+                  autoRotationEnabled={autoRotationEnabled}
+                  onAutoRotationChange={setAutoRotationEnabled}
+                  rotationInterval={rotationInterval}
+                  onRotationIntervalChange={setRotationInterval}
+                  neverExpire={neverExpire}
+                  onNeverExpireChange={setNeverExpire}
+                />
+              )}
+            </FormField>
+          </div>
+        </FieldGroup>
 
-      {/* Hidden form field for disabled callbacks */}
-      <Form.Item name="disabled_callbacks" hidden>
-        <AntdInput />
-      </Form.Item>
-
-      {/* Hidden form fields for auto-rotation */}
-      <Form.Item name="auto_rotate" hidden>
-        <AntdInput />
-      </Form.Item>
-      <Form.Item name="rotation_interval" hidden>
-        <AntdInput />
-      </Form.Item>
-
-      <div className="sticky z-10 bg-white p-4 border-t border-gray-200 -bottom-6 -inset-x-6">
-        <div className="flex justify-end items-center gap-2">
-          <Button variant="secondary" onClick={onCancel} disabled={isKeySaving}>
-            Cancel
-          </Button>
-          <Button type="submit" disabled={isKeySaving} aria-busy={isKeySaving}>
-            {isKeySaving && <UiLoadingSpinner className="size-4" />}
-            Save Changes
-          </Button>
+        <div className="sticky z-10 bg-background p-4 border-t border-border -bottom-6 -inset-x-6">
+          <div className="flex justify-end items-center gap-2">
+            <Button type="button" variant="secondary" onClick={onCancel} disabled={isKeySaving}>
+              Cancel
+            </Button>
+            <Button type="submit" disabled={isKeySaving} aria-busy={isKeySaving}>
+              {isKeySaving && <UiLoadingSpinner className="size-4" />}
+              Save Changes
+            </Button>
+          </div>
         </div>
-      </div>
-    </Form>
+      </form>
+    </TooltipProvider>
   );
 }
diff --git a/ui/litellm-dashboard/src/components/atoms/Tooltip.test.tsx b/ui/litellm-dashboard/src/components/ui/tooltip.test.tsx
similarity index 53%
rename from ui/litellm-dashboard/src/components/atoms/Tooltip.test.tsx
rename to ui/litellm-dashboard/src/components/ui/tooltip.test.tsx
index 4e0b64ea6de..788849047c6 100644
--- a/ui/litellm-dashboard/src/components/atoms/Tooltip.test.tsx
+++ b/ui/litellm-dashboard/src/components/ui/tooltip.test.tsx
@@ -1,19 +1,19 @@
 import { describe, it, expect } from "vitest";
 import { render, screen } from "@testing-library/react";
 import userEvent from "@testing-library/user-event";
-import { Tooltip } from "./Tooltip";
+import { SimpleTooltip } from "./tooltip";
 
-describe("Tooltip", () => {
+describe("SimpleTooltip", () => {
   it("should render", () => {
-    render(<Tooltip content="Help text" />);
+    render(<SimpleTooltip content="Help text" />);
     expect(screen.getByLabelText("question-circle")).toBeInTheDocument();
   });
 
   it("should render children instead of the default icon when provided", () => {
     render(
-      <Tooltip content="Help text">
+      <SimpleTooltip content="Help text">
         <button>Info</button>
-      </Tooltip>,
+      </SimpleTooltip>,
     );
     expect(screen.getByRole("button", { name: /info/i })).toBeInTheDocument();
     expect(screen.queryByLabelText("question-circle")).not.toBeInTheDocument();
@@ -21,7 +21,7 @@ describe("Tooltip", () => {
 
   it("should show tooltip content on mouse enter", async () => {
     const user = userEvent.setup();
-    render(<Tooltip content="Help text" />);
+    render(<SimpleTooltip content="Help text" />);
 
     await user.hover(screen.getByLabelText("question-circle"));
 
@@ -30,7 +30,7 @@ describe("Tooltip", () => {
 
   it("should hide tooltip content on mouse leave", async () => {
     const user = userEvent.setup();
-    render(<Tooltip content="Help text" />);
+    render(<SimpleTooltip content="Help text" />);
 
     await user.hover(screen.getByLabelText("question-circle"));
     expect(screen.getByText("Help text")).toBeInTheDocument();
@@ -40,7 +40,31 @@ describe("Tooltip", () => {
   });
 
   it("should not show tooltip content before hovering", () => {
-    render(<Tooltip content="Help text" />);
+    render(<SimpleTooltip content="Help text" />);
     expect(screen.queryByText("Help text")).not.toBeInTheDocument();
   });
+
+  it("should keep rendering children when there is no content to show", async () => {
+    const user = userEvent.setup();
+    render(
+      <SimpleTooltip content={undefined}>
+        <button>Pick a rubric</button>
+      </SimpleTooltip>,
+    );
+
+    const trigger = screen.getByRole("button", { name: /pick a rubric/i });
+    await user.hover(trigger);
+
+    expect(trigger).toBeInTheDocument();
+    expect(document.querySelector('[data-slot="tooltip-content"]')).toBeNull();
+  });
+
+  it("should place the tooltip on the requested side", async () => {
+    const user = userEvent.setup();
+    render(<SimpleTooltip content="Help text" side="right" />);
+
+    await user.hover(screen.getByLabelText("question-circle"));
+
+    expect(await screen.findByText("Help text")).toHaveAttribute("data-side", "right");
+  });
 });
diff --git a/ui/litellm-dashboard/src/components/ui/tooltip.tsx b/ui/litellm-dashboard/src/components/ui/tooltip.tsx
index 5e21eab67f5..e3b2f9d864d 100644
--- a/ui/litellm-dashboard/src/components/ui/tooltip.tsx
+++ b/ui/litellm-dashboard/src/components/ui/tooltip.tsx
@@ -1,6 +1,8 @@
 "use client";
 
+import React from "react";
 import { Tooltip as TooltipPrimitive } from "@base-ui/react/tooltip";
+import { CircleHelp } from "lucide-react";
 
 import { cn } from "@/lib/cva.config";
 
@@ -51,4 +53,42 @@ function TooltipContent({
   );
 }
 
-export { Tooltip, TooltipTrigger, TooltipContent, TooltipProvider };
+interface SimpleTooltipProps {
+  content: React.ReactNode;
+  children?: React.ReactNode;
+  width?: string;
+  className?: string;
+  side?: React.ComponentProps<typeof TooltipContent>["side"];
+}
+
+const widthClassNames: Record<string, string> = {
+  "360px": "max-w-[360px]",
+  "500px": "max-w-[500px]",
+  auto: "max-w-xs",
+};
+
+const triggerClassName = (className?: string): string =>
+  cn(
+    "inline-flex cursor-help items-center rounded-sm focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring",
+    className,
+  );
+
+const defaultTrigger = <CircleHelp aria-label="question-circle" className="ml-1 size-4 text-muted-foreground" />;
+
+const SimpleTooltip: React.FC<SimpleTooltipProps> = ({ content, children, width = "auto", className, side }) =>
+  content === undefined || content === null || content === "" ? (
+    <span className={triggerClassName(className)}>{children ?? defaultTrigger}</span>
+  ) : (
+    <TooltipProvider>
+      <Tooltip>
+        <TooltipTrigger render={<span className={triggerClassName(className)} />}>
+          {children ?? defaultTrigger}
+        </TooltipTrigger>
+        <TooltipContent side={side} className={cn("whitespace-normal", widthClassNames[width] ?? "max-w-xs")}>
+          {content}
+        </TooltipContent>
+      </Tooltip>
+    </TooltipProvider>
+  );
+
+export { Tooltip, TooltipTrigger, TooltipContent, TooltipProvider, SimpleTooltip };
diff --git a/ui/litellm-dashboard/src/components/view_user_spend.tsx b/ui/litellm-dashboard/src/components/view_user_spend.tsx
index b5d54ae3bcb..c7a2bb70eef 100644
--- a/ui/litellm-dashboard/src/components/view_user_spend.tsx
+++ b/ui/litellm-dashboard/src/components/view_user_spend.tsx
@@ -115,16 +115,12 @@ const ViewUserSpend: React.FC<ViewUserSpendProps> = ({ userSpend, userMaxBudget,
     <div className="flex items-center">
       <div className="flex justify-between gap-x-6">
         <div>
-          <p className="text-tremor-default text-tremor-content dark:text-dark-tremor-content">Total Spend</p>
-          <p className="text-2xl text-tremor-content-strong dark:text-dark-tremor-content-strong font-semibold">
-            ${roundedSpend}
-          </p>
+          <p className="text-sm text-muted-foreground">Total Spend</p>
+          <p className="text-2xl font-semibold text-foreground">${roundedSpend}</p>
         </div>
         <div>
-          <p className="text-tremor-default text-tremor-content dark:text-dark-tremor-content">Max Budget</p>
-          <p className="text-2xl text-tremor-content-strong dark:text-dark-tremor-content-strong font-semibold">
-            {displayMaxBudget}
-          </p>
+          <p className="text-sm text-muted-foreground">Max Budget</p>
+          <p className="text-2xl font-semibold text-foreground">{displayMaxBudget}</p>
         </div>
       </div>
       {/* <div className="ml-auto">
diff --git a/ui/litellm-dashboard/src/lib/http/schema.d.ts b/ui/litellm-dashboard/src/lib/http/schema.d.ts
index 3a0ed88ce17..7ec6c98a82c 100644
--- a/ui/litellm-dashboard/src/lib/http/schema.d.ts
+++ b/ui/litellm-dashboard/src/lib/http/schema.d.ts
@@ -29812,10 +29812,18 @@ export interface components {
             metadata?: {
                 [key: string]: unknown;
             } | null;
+            /** Model Itpm Limit */
+            model_itpm_limit?: {
+                [key: string]: number;
+            } | null;
             /** Model Max Budget */
             model_max_budget?: {
                 [key: string]: unknown;
             } | null;
+            /** Model Otpm Limit */
+            model_otpm_limit?: {
+                [key: string]: number;
+            } | null;
             /** Model Rpm Limit */
             model_rpm_limit?: {
                 [key: string]: unknown;
@@ -35024,10 +35032,18 @@ export interface components {
             metadata?: {
                 [key: string]: unknown;
             } | null;
+            /** Model Itpm Limit */
+            model_itpm_limit?: {
+                [key: string]: number;
+            } | null;
             /** Model Max Budget */
             model_max_budget?: {
                 [key: string]: unknown;
             } | null;
+            /** Model Otpm Limit */
+            model_otpm_limit?: {
+                [key: string]: number;
+            } | null;
             /** Model Rpm Limit */
             model_rpm_limit?: {
                 [key: string]: unknown;
diff --git a/ui/litellm-dashboard/src/utils/ptuValidation.ts b/ui/litellm-dashboard/src/utils/ptuValidation.ts
index da367f233b6..e54912dea26 100644
--- a/ui/litellm-dashboard/src/utils/ptuValidation.ts
+++ b/ui/litellm-dashboard/src/utils/ptuValidation.ts
@@ -18,10 +18,10 @@ export const PTU_END_FIELD = "ptu_effective_to";
 export const MAX_PTU_COUNT = 1_000_000;
 export const MAX_COST_PER_PTU_PER_HOUR = 1_000_000;
 
-const isFilled = (value: unknown): boolean => value !== undefined && value !== null && value !== "";
+export const isFilledPtuValue = (value: unknown): boolean => value !== undefined && value !== null && value !== "";
 
-const isPositiveWholeNumber = (value: unknown): boolean => {
-  if (!isFilled(value)) {
+export const isPositiveWholePtuCount = (value: unknown): boolean => {
+  if (!isFilledPtuValue(value)) {
     return true;
   }
   const parsed = Number(value);
@@ -32,14 +32,14 @@ const isPositiveWholeNumber = (value: unknown): boolean => {
 export const ptuCountRules: ValidatorRule[] = [
   {
     validator: (_, value) =>
-      isPositiveWholeNumber(value)
+      isPositiveWholePtuCount(value)
         ? Promise.resolve()
         : Promise.reject(new Error(`PTU Count must be a whole number between 1 and ${MAX_PTU_COUNT.toLocaleString()}`)),
   },
 ];
 
-const isNonNegativeNumber = (value: unknown): boolean => {
-  if (!isFilled(value)) {
+export const isNonNegativePtuRate = (value: unknown): boolean => {
+  if (!isFilledPtuValue(value)) {
     return true;
   }
   const parsed = Number(value);
@@ -50,7 +50,7 @@ const isNonNegativeNumber = (value: unknown): boolean => {
 export const ptuRateRules: ValidatorRule[] = [
   {
     validator: (_, value) =>
-      isNonNegativeNumber(value)
+      isNonNegativePtuRate(value)
         ? Promise.resolve()
         : Promise.reject(
             new Error(`Cost per PTU / Hour must be between 0 and ${MAX_COST_PER_PTU_PER_HOUR.toLocaleString()}`),
@@ -67,7 +67,7 @@ export const ptuPairRule =
   (siblingField: string) =>
   ({ getFieldValue }: FormInstance): ValidatorRule => ({
     validator: (_, value) =>
-      isFilled(value) === isFilled(getFieldValue(siblingField))
+      isFilledPtuValue(value) === isFilledPtuValue(getFieldValue(siblingField))
         ? Promise.resolve()
         : Promise.reject(new Error("PTU Count and Cost per PTU / Hour must be set together")),
   });
@@ -85,7 +85,7 @@ export const ptuNoUsageCostRule =
       // for an unpriced deployment is the public cost map. Refusing it would block every
       // attempt to put an existing deployment on PTU, and the save omits it anyway.
       const echoed = thisField !== undefined && isFieldTouched !== undefined && !isFieldTouched(thisField);
-      return echoed || !isFilled(getFieldValue(countField)) || !isFilled(value) || Number(value) === 0
+      return echoed || !isFilledPtuValue(getFieldValue(countField)) || !isFilledPtuValue(value) || Number(value) === 0
         ? Promise.resolve()
         : Promise.reject(new Error("A PTU deployment bills by reserved capacity, so this cost must be 0 or blank"));
     },
@@ -100,7 +100,7 @@ export const ptuStartRequiredRule =
   (countField: string) =>
   ({ getFieldValue }: FormInstance): ValidatorRule => ({
     validator: (_, value) =>
-      isFilled(value) || !isFilled(getFieldValue(countField))
+      isFilledPtuValue(value) || !isFilledPtuValue(getFieldValue(countField))
         ? Promise.resolve()
         : Promise.reject(new Error("PTU Effective From is required when PTU Count is set")),
   });
@@ -118,19 +118,24 @@ const toEpochMs = (value: unknown): number => {
  * cannot anticipate. Pair this with `dependencies` on the sibling bound so the error clears
  * once the pair is ordered.
  */
+export const ptuWindowIsOrdered = (start: unknown, end: unknown): boolean => {
+  if (!isFilledPtuValue(start) || !isFilledPtuValue(end)) {
+    return true;
+  }
+  const startMs = toEpochMs(start);
+  const endMs = toEpochMs(end);
+  return Number.isNaN(startMs) || Number.isNaN(endMs) || endMs > startMs;
+};
+
 export const ptuWindowOrderRule =
   (siblingField: string, thisBound: "start" | "end") =>
   ({ getFieldValue }: FormInstance): ValidatorRule => ({
     validator: (_, value) => {
       const sibling = getFieldValue(siblingField);
-      if (!isFilled(value) || !isFilled(sibling)) {
-        return Promise.resolve();
-      }
-      const startMs = toEpochMs(thisBound === "start" ? value : sibling);
-      const endMs = toEpochMs(thisBound === "start" ? sibling : value);
-      if (Number.isNaN(startMs) || Number.isNaN(endMs) || endMs > startMs) {
-        return Promise.resolve();
-      }
-      return Promise.reject(new Error("PTU Effective To must be after PTU Effective From"));
+      const start = thisBound === "start" ? value : sibling;
+      const end = thisBound === "start" ? sibling : value;
+      return ptuWindowIsOrdered(start, end)
+        ? Promise.resolve()
+        : Promise.reject(new Error("PTU Effective To must be after PTU Effective From"));
     },
   });
diff --git a/ui/litellm-dashboard/tests/mounted-form-host.tsx b/ui/litellm-dashboard/tests/mounted-form-host.tsx
new file mode 100644
index 00000000000..62622d1854c
--- /dev/null
+++ b/ui/litellm-dashboard/tests/mounted-form-host.tsx
@@ -0,0 +1,24 @@
+import React from "react";
+import { FormProvider, useForm } from "react-hook-form";
+
+import {
+  MountedFormProvider,
+  useMountRegistry,
+  type MountedFormValues,
+} from "@/components/common_components/MountedFormField";
+
+interface MountedFormHostProps {
+  defaultValues?: MountedFormValues;
+  children: React.ReactNode;
+}
+
+export const MountedFormHost: React.FC<MountedFormHostProps> = ({ defaultValues, children }) => {
+  const form = useForm<MountedFormValues>({ mode: "onChange", defaultValues });
+  const registry = useMountRegistry();
+
+  return (
+    <FormProvider {...form}>
+      <MountedFormProvider value={{ control: form.control, registry }}>{children}</MountedFormProvider>
+    </FormProvider>
+  );
+};
diff --git a/ui/litellm-dashboard/tests/setupTests.ts b/ui/litellm-dashboard/tests/setupTests.ts
index b14d422bce8..3eceef211a5 100644
--- a/ui/litellm-dashboard/tests/setupTests.ts
+++ b/ui/litellm-dashboard/tests/setupTests.ts
@@ -1,6 +1,5 @@
 import "@testing-library/jest-dom";
 import { cleanup } from "@testing-library/react";
-import React from "react";
 import { afterEach, vi } from "vitest";
 
 const ensureTestLocalStorage = () => {
@@ -100,39 +99,6 @@ vi.mock("@/lib/toast", () => ({
   },
 }));
 
-vi.mock("@tremor/react", async (importOriginal) => {
-  const actual = await importOriginal<typeof import("@tremor/react")>();
-  return {
-    ...actual,
-    Button: React.forwardRef<HTMLButtonElement, any>(({ children, ...props }, ref) =>
-      // Render as a native button to avoid Tremor-specific behaviors in tests
-      React.createElement("button", { ...props, ref }, children),
-    ),
-    Tooltip: ({ children, ..._props }: { children?: React.ReactNode; [key: string]: unknown }) => {
-      // Return children directly without tooltip functionality to prevent flaky tests
-      // This avoids issues with hover states, positioning, and DOM queries in tests
-      return React.createElement(React.Fragment, null, children);
-    },
-    // Render as a plain checkbox so toggle interactions are testable without Tremor internals
-    Switch: ({
-      checked,
-      onChange,
-      className,
-    }: {
-      checked?: boolean;
-      onChange?: (v: boolean) => void;
-      className?: string;
-    }) =>
-      React.createElement("input", {
-        type: "checkbox",
-        role: "switch",
-        checked,
-        onChange: (e: React.ChangeEvent<HTMLInputElement>) => onChange?.(e.target.checked),
-        className,
-      }),
-  };
-});
-
 // Global mock for useAuthorized hook to avoid repeating the same mock in every test file
 vi.mock("@/app/(dashboard)/hooks/useAuthorized", () => ({
   default: () => ({
@@ -232,9 +198,8 @@ if (typeof window !== "undefined") {
   // JSDOM has no layout, so for observers inside a shadcn ChartContainer ([data-slot="chart"])
   // the mock immediately reports a fixed 800x400 box; recharts renders nothing until it
   // observes a size. Scoped to chart subtrees only: firing for every observer re-enters
-  // React mid-effect for tremor/headlessui consumers whose tests assume the old no-op
-  // (chart text would duplicate getByText targets, popover clicks go stale). Widen or
-  // drop the scoping once tremor is gone.
+  // React mid-effect for headlessui consumers whose tests assume the old no-op
+  // (chart text would duplicate getByText targets, popover clicks go stale).
   const MOCK_RESIZE_BOX = { inlineSize: 800, blockSize: 400 };
   const MOCK_RESIZE_RECT: DOMRectReadOnly = {
     width: 800,
diff --git a/uv.lock b/uv.lock
index 63e8e31223c..d9e2fb94667 100644
--- a/uv.lock
+++ b/uv.lock
@@ -10,7 +10,7 @@ resolution-markers = [
 ]
 
 [options]
-exclude-newer = "2026-08-14T18:59:56.524034Z"
+exclude-newer = "2026-08-16T00:41:08.185444Z"
 exclude-newer-span = "P3D"
 
 [manifest]
@@ -4194,7 +4194,7 @@ wheels = [
 
 [[package]]
 name = "litellm"
-version = "1.98.0"
+version = "1.99.0"
 source = { editable = "." }
 dependencies = [
     { name = "aiohttp" },
@@ -4585,12 +4585,12 @@ proxy-dev = [
 
 [[package]]
 name = "litellm-enterprise"
-version = "0.1.56"
+version = "0.1.57"
 source = { editable = "enterprise" }
 
 [[package]]
 name = "litellm-proxy-extras"
-version = "0.4.86"
+version = "0.4.87"
 source = { editable = "litellm-proxy-extras" }
 
 [[package]]