From e3fb50818c8b8971364593abd1d117c84c660c67 Mon Sep 17 00:00:00 2001 From: Ryan Crabbe Date: Wed, 25 Mar 2026 11:43:36 -0700 Subject: [PATCH] fix: not allowing default master key to be used in prod, recommended master key should be at least 32 chars --- litellm/proxy/proxy_server.py | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/litellm/proxy/proxy_server.py b/litellm/proxy/proxy_server.py index 7d3d2ceb533..9e447a48eea 100644 --- a/litellm/proxy/proxy_server.py +++ b/litellm/proxy/proxy_server.py @@ -3092,6 +3092,17 @@ class ProxyConfig: verbose_proxy_logger.critical( "LITELLM_MASTER_KEY is not set! All requests will be treated as INTERNAL_USER with no admin access. Set LITELLM_MASTER_KEY for production use." ) + + if master_key is not None and isinstance(master_key, str): + if master_key is "sk-1234": + raise ValueError( + f"LITELLM_MASTER_KEY is set to the default master-key granting proxy admin access, please change it to something stronger" + ) + if len(master_key) < 16: + verbose_proxy_logger.warning( + "A key of at least 32 characters is reccomended for production" + ) + ### USER API KEY CACHE IN-MEMORY TTL ### user_api_key_cache_ttl = general_settings.get( "user_api_key_cache_ttl", None