litellm - 💡(How to fix) Fix [Bug]: Grace period — old API key rejected immediately despite row in LiteLLM_DeprecatedVerificationToken (Enterprise, proxy v1.82.3) [2 comments, 2 participants]

export DEV_URL="https://<litellm-host>/"
export PROXY_MASTER_KEY='<redacted-master-key>'

---

curl -sS -w "\nHTTP:%{http_code}\n" \
  -H "Authorization: Bearer $PROXY_MASTER_KEY" \
  -H "Content-Type: application/json" \
  -X POST "$DEV_URL/key/generate" \
  -d '{"models":["openai-gpt-4.1-nano-2025-04-14"],"metadata":{"purpose":"rotation-test"},"key_alias":"rotation-thorough-litellm-investigation","max_budget":1.0}'

export OLD_KEY='sk-OLD_REDACTED'

---

curl -sS -w "\nHTTP:%{http_code}\n" \
  -H "Authorization: Bearer $OLD_KEY" \
  -H "Content-Type: application/json" \
  "$DEV_URL/v1/chat/completions" \
  -d '{"model":"openai-gpt-4.1-nano-2025-04-14","messages":[{"role":"user","content":"Say hello"}],"max_tokens":10}'

---

curl -sS -w "\nHTTP:%{http_code}\n" \
  -H "Authorization: Bearer $PROXY_MASTER_KEY" \
  -H "Content-Type: application/json" \
  -X POST "$DEV_URL/key/$OLD_KEY/regenerate" \
  -d '{"grace_period":"1h","metadata":{"purpose":"rotation-thorough-after"}}'
export NEW_KEY='sk-NEW_REDACTED'   # from response "key" field

---

curl -sS -w "\nHTTP:%{http_code}\n" \
  -H "Authorization: Bearer $OLD_KEY" \
  -H "Content-Type: application/json" \
  "$DEV_URL/v1/chat/completions" \
  -d '{"model":"openai-gpt-4.1-nano-2025-04-14","messages":[{"role":"user","content":"Say hello"}],"max_tokens":10}'

---

curl -sS -w "\nHTTP:%{http_code}\n" \
  -H "Authorization: Bearer $NEW_KEY" \
  -H "Content-Type: application/json" \
  "$DEV_URL/v1/chat/completions" \
  -d '{"model":"openai-gpt-4.1-nano-2025-04-14","messages":[{"role":"user","content":"Say hello"}],"max_tokens":10}'

---

curl -sS "$DEV_URL/key/info?key=$OLD_KEY" -H "Authorization: Bearer $PROXY_MASTER_KEY"

---

Proxy log lines from kubectl logs … filtered for deprecated|grace|regenerate|rotation|error (timestamps from one run; pod name may differ):
[pod/.../litellm] {"message": "Key regeneration requested: key_alias=rotation-thorough-litellm-investigation", ...}
[pod/.../litellm] {"message": "10.x.x.x:x - \"POST /key/sk-...REDACTED/regenerate HTTP/1.1\" 200", ...}
Unfiltered lines around the same window also showed transient DB connection errors from the Prisma stack (may be unrelated noise):
[pod/.../litellm] {"timestamp":"...","level":"ERROR","fields":{"message":"Error in PostgreSQL connection: Error { kind: Closed, cause: None }"},"target":"quaint::connector::postgres"}
API response for /key/info?key=$OLD_KEY after regenerate (body):
{"error":{"message":"Key not found in database","type":"not_found_error","param":"key","code":"404"