From b50265d75f719bfd2dd27b46c237a0981e6f1cbe Mon Sep 17 00:00:00 2001
From: ryan <ryan@berri.ai>
Date: Fri, 18 Sep 2026 09:34:44 +0000
Subject: [PATCH] refactor(keys): freeze the service account route tuple and
 stamp metadata without seeding mutable literals

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
---
 litellm/proxy/_types.py                                  | 4 ++--
 .../management_endpoints/key_management_endpoints.py     | 9 ++++-----
 2 files changed, 6 insertions(+), 7 deletions(-)

diff --git a/litellm/proxy/_types.py b/litellm/proxy/_types.py
index a31b6f834b3..2ca6abf7873 100644
--- a/litellm/proxy/_types.py
+++ b/litellm/proxy/_types.py
@@ -660,10 +660,10 @@ class LiteLLMRoutes(enum.Enum):
         KeyManagementRoutes.AUTO_ROUTER_MANAGE.value,
     ]
 
-    team_service_account_key_routes = [
+    team_service_account_key_routes = (
         KeyManagementRoutes.KEY_GENERATE.value,
         KeyManagementRoutes.KEY_UPDATE.value,
-    ]
+    )
 
     management_routes = (
         [
diff --git a/litellm/proxy/management_endpoints/key_management_endpoints.py b/litellm/proxy/management_endpoints/key_management_endpoints.py
index 6d4b7f05532..f6f47a8ffc9 100644
--- a/litellm/proxy/management_endpoints/key_management_endpoints.py
+++ b/litellm/proxy/management_endpoints/key_management_endpoints.py
@@ -2240,13 +2240,12 @@ async def generate_service_account_key_fn(
     )
 
     if data.metadata is None or data.metadata.get("service_account_id") is None:
-        service_account_id: Final = (
-            (data.metadata or {}).get("service_account_id") or data.key_alias or str(uuid.uuid4())
-        )
-        data.metadata = {  # rebind-ok: stamp the service_account_id onto the request so it persists on the key
-            **(data.metadata or {}),
+        service_account_id: Final = data.key_alias or str(uuid.uuid4())
+        stamped_metadata: Final = {  # mutable-ok: GenerateKeyRequest.metadata is a plain dict field
+            **(data.metadata or MappingProxyType({})),
             "service_account_id": service_account_id,
         }
+        data.metadata = stamped_metadata  # rebind-ok: the request carries the stamp so it persists on the key
 
     verbose_proxy_logger.debug("entered /key/generate")