From ae83444a3e0eca7536f49101557bc8ec044b501a Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Mon, 31 Aug 2026 19:54:45 +0000 Subject: [PATCH] fix(openai): treat empty api_key as unset for WIF resolution --- litellm/llms/openai/workload_identity.py | 7 +++++-- .../llms/openai/test_openai_workload_identity.py | 16 ++++++++++------ 2 files changed, 15 insertions(+), 8 deletions(-) diff --git a/litellm/llms/openai/workload_identity.py b/litellm/llms/openai/workload_identity.py index e9ac26e26a2..ecec161ed46 100644 --- a/litellm/llms/openai/workload_identity.py +++ b/litellm/llms/openai/workload_identity.py @@ -6,7 +6,7 @@ from typing import TYPE_CHECKING, Final from urllib.parse import urlparse import litellm -from litellm.secret_managers.main import get_secret_str +from litellm.secret_managers.main import get_secret_str, normalize_nonempty_secret_str from .common_utils import OpenAIError @@ -45,7 +45,10 @@ def resolve_openai_workload_identity_config( api_key: str | None, api_base: str | None, ) -> OpenAIWorkloadIdentityConfig | None: - if api_key or get_secret_str("OPENAI_API_KEY"): + static_api_key: Final = normalize_nonempty_secret_str(api_key) or normalize_nonempty_secret_str( + get_secret_str("OPENAI_API_KEY") + ) + if static_api_key is not None: return None effective_api_base: Final = ( api_base or litellm.api_base or get_secret_str("OPENAI_BASE_URL") or get_secret_str("OPENAI_API_BASE") diff --git a/tests/test_litellm/llms/openai/test_openai_workload_identity.py b/tests/test_litellm/llms/openai/test_openai_workload_identity.py index 228d591b47a..d8d9936e9a1 100644 --- a/tests/test_litellm/llms/openai/test_openai_workload_identity.py +++ b/tests/test_litellm/llms/openai/test_openai_workload_identity.py @@ -63,14 +63,18 @@ class TestResolveConfig: monkeypatch.setenv("OPENAI_API_KEY", "sk-from-env") assert resolve_openai_workload_identity_config(api_key=None, api_base=None) is None - def test_empty_env_openai_api_key_counts_as_unset( - self, wif_env: OpenAIWorkloadIdentityConfig, monkeypatch: pytest.MonkeyPatch + @pytest.mark.parametrize("empty_key", ["", " "]) + def test_empty_api_key_arg_does_not_disable_wif( + self, wif_env: OpenAIWorkloadIdentityConfig, empty_key: str ) -> None: - monkeypatch.setenv("OPENAI_API_KEY", "") - assert resolve_openai_workload_identity_config(api_key=None, api_base=None) == wif_env + assert resolve_openai_workload_identity_config(api_key=empty_key, api_base=None) == wif_env - def test_empty_api_key_param_counts_as_unset(self, wif_env: OpenAIWorkloadIdentityConfig) -> None: - assert resolve_openai_workload_identity_config(api_key="", api_base=None) == wif_env + @pytest.mark.parametrize("empty_key", ["", " "]) + def test_empty_env_openai_api_key_does_not_disable_wif( + self, wif_env: OpenAIWorkloadIdentityConfig, monkeypatch: pytest.MonkeyPatch, empty_key: str + ) -> None: + monkeypatch.setenv("OPENAI_API_KEY", empty_key) + assert resolve_openai_workload_identity_config(api_key=None, api_base=None) == wif_env def test_foreign_api_base_disables(self, wif_env: OpenAIWorkloadIdentityConfig) -> None: assert resolve_openai_workload_identity_config(api_key=None, api_base="https://my-vllm.internal/v1") is None