From 881619aa423bea5994d684cb55fdbd50b35cc2c0 Mon Sep 17 00:00:00 2001
From: Vasilisa Parshikova <vasilisa.parshikova@sap.com>
Date: Thu, 18 Dec 2025 17:40:30 +0400
Subject: [PATCH] fix(sap): change creds priority

---
 litellm/llms/sap/credentials.py | 41 ++++++++++++++++-----------------
 1 file changed, 20 insertions(+), 21 deletions(-)

diff --git a/litellm/llms/sap/credentials.py b/litellm/llms/sap/credentials.py
index 44dd7436b20..ca925bc6a9a 100644
--- a/litellm/llms/sap/credentials.py
+++ b/litellm/llms/sap/credentials.py
@@ -159,24 +159,26 @@ def _resolve_value(
     if cred.name in kwargs and kwargs[cred.name] is not None:
         return kwargs[cred.name]
 
-    # 2) environment variables (primary name)
-    env_key = _env_name(cred.name)
-    if env_key in env and env[env_key] is not None:
-        return env[env_key]
-
-    # 3) config file (accept both prefixed and plain keys)
-    for key in (env_key, cred.name):
-        if key in config and config[key] is not None:
-            return config[key]
-
-    # 4) service-like source (AICORE_SERVICE_KEY first, else VCAP)
+    # 2) service-like source (AICORE_SERVICE_KEY first, else VCAP)
     if service_like and cred.vcap_key:
         try:
             val = _get_nested(service_like, cred.vcap_key)
             if val is not None:
                 return val
-        except KeyError:
-            pass
+        except KeyError as e:
+            raise KeyError(f"Unable to find {cred.name} in service key") from e
+        except json.JSONDecodeError:
+            raise KeyError(f"{service_like} is not valid JSON. Please fix or remove it!")
+
+    # 3) environment variables (primary name)
+    env_key = _env_name(cred.name)
+    if env_key in env and env[env_key] is not None:
+        return env[env_key]
+
+    # 4) config file (accept both prefixed and plain keys)
+    for key in (env_key, cred.name):
+        if key in config and config[key] is not None:
+            return config[key]
 
     # 5) default
     return cred.default
@@ -198,14 +200,11 @@ def fetch_credentials(
     env = os.environ  # snapshot for testability
     service_like = None
 
-    if not config:
-        # Prefer AICORE_SERVICE_KEY if present; otherwise fall back to the VCAP service.
-        service_like = (
-            service_key
-            or sap_service_key
-            or _load_json_env(SERVICE_KEY_ENV_VAR)
-            or _get_vcap_service(VCAP_AICORE_SERVICE_NAME)
-        )
+
+    # Prefer AICORE_SERVICE_KEY if present; otherwise fall back to the VCAP service.
+    service_like = service_key or sap_service_key or _load_json_env(SERVICE_KEY_ENV_VAR) or _get_vcap_service(
+            VCAP_AICORE_SERVICE_NAME
+    )
 
     out: Dict[str, str] = {}
     for cred in CREDENTIAL_VALUES: