diff --git a/litellm/llms/xai/oauth.py b/litellm/llms/xai/oauth.py
index 871ac6e720e..2533f7a9aae 100644
--- a/litellm/llms/xai/oauth.py
+++ b/litellm/llms/xai/oauth.py
@@ -426,7 +426,7 @@ class XAIOAuthChatConfig(XAIChatConfig):
     def _get_openai_compatible_provider_info(
         self, api_base: Optional[str], api_key: Optional[str]
     ) -> Tuple[Optional[str], Optional[str]]:
-        using_stored_oauth_token = api_key is None
+        using_stored_oauth_token = not api_key
         try:
             dynamic_api_key = api_key or self.authenticator.get_access_token()
         except XAIOAuthError as exc:
@@ -474,7 +474,7 @@ class XAIOAuthResponsesAPIConfig(XAIResponsesAPIConfig):
         api_base: Optional[str],
         litellm_params: dict,
     ) -> str:
-        if litellm_params.get("api_key") is None:
+        if not litellm_params.get("api_key"):
             api_base = self.authenticator.get_api_base()
         else:
             api_base = api_base or self.authenticator.get_api_base()
diff --git a/tests/test_litellm/llms/xai/test_xai_oauth.py b/tests/test_litellm/llms/xai/test_xai_oauth.py
index dc99052b820..c88f8de7525 100644
--- a/tests/test_litellm/llms/xai/test_xai_oauth.py
+++ b/tests/test_litellm/llms/xai/test_xai_oauth.py
@@ -578,6 +578,20 @@ def test_chat_config_ignores_api_base_override_for_stored_oauth_token():
     assert api_key == "stored-oauth-token"
 
 
+def test_chat_config_treats_blank_api_key_as_stored_oauth_token():
+    config = XAIOAuthChatConfig()
+    config.authenticator = MagicMock()
+    config.authenticator.get_access_token.return_value = "stored-oauth-token"
+    config.authenticator.get_api_base.return_value = "https://api.x.ai/v1"
+
+    api_base, api_key = config._get_openai_compatible_provider_info(
+        "https://attacker.example.com/v1", ""
+    )
+
+    assert api_base == "https://api.x.ai/v1"
+    assert api_key == "stored-oauth-token"
+
+
 def test_chat_config_allows_api_base_override_with_caller_api_key():
     config = XAIOAuthChatConfig()
     config.authenticator = MagicMock()
@@ -696,6 +710,13 @@ def test_responses_config_endpoint_url_uses_oauth_authenticator():
         )
         == "https://xai.example.com/v1/responses"
     )
+    assert (
+        config.get_complete_url(
+            api_base="https://custom.example.com/v1/",
+            litellm_params={"api_key": ""},
+        )
+        == "https://xai.example.com/v1/responses"
+    )
     assert (
         config.get_complete_url(
             api_base="https://custom.example.com/v1/",