litellm/litellm/secret_managers
yucheng-berri f982b67d78
fix(proxy): harden secret name validation for external secret manager integrations (LIT-4201) (#32092)
key_alias can become the secret name used by external secret manager
integrations (HashiCorp Vault, CyberArk Conjur) when store_virtual_keys is
enabled. Add raise_if_unsafe_secret_name, a shared validation check applied
unconditionally before a secret name reaches either integration or the
/key/generate, /key/update, and /key/regenerate API boundary, independent
of the existing enable_key_alias_format_validation opt-in flag.

Also hardens the Vault URL builder to percent-encode reserved characters
in secret_name (preserving "/" and "@"), and switches the Conjur policy
body to a real YAML serializer instead of raw string interpolation.
2026-07-08 10:36:00 -07:00
..
aws_secret_manager.py style: unify ruff format width on 120 (#31518) 2026-06-27 12:39:29 -07:00
aws_secret_manager_v2.py style: unify ruff format width on 120 (#31518) 2026-06-27 12:39:29 -07:00
base_secret_manager.py fix(proxy): harden secret name validation for external secret manager integrations (LIT-4201) (#32092) 2026-07-08 10:36:00 -07:00
custom_secret_manager_loader.py style: unify ruff format width on 120 (#31518) 2026-06-27 12:39:29 -07:00
cyberark_secret_manager.py fix(proxy): harden secret name validation for external secret manager integrations (LIT-4201) (#32092) 2026-07-08 10:36:00 -07:00
get_azure_ad_token_provider.py style: unify ruff format width on 120 (#31518) 2026-06-27 12:39:29 -07:00
google_kms.py style: unify ruff format width on 120 (#31518) 2026-06-27 12:39:29 -07:00
google_secret_manager.py style: unify ruff format width on 120 (#31518) 2026-06-27 12:39:29 -07:00
hashicorp_secret_manager.py fix(proxy): harden secret name validation for external secret manager integrations (LIT-4201) (#32092) 2026-07-08 10:36:00 -07:00
main.py style: unify ruff format width on 120 (#31518) 2026-06-27 12:39:29 -07:00
Readme.md refactor get_secret 2024-09-03 10:42:12 -07:00
secret_manager_handler.py style: unify ruff format width on 120 (#31518) 2026-06-27 12:39:29 -07:00

Supported Secret Managers to read credentials from

Example read OPENAI_API_KEY, AZURE_API_KEY from a secret manager