LiteLLM API Key Renewer

Short-lived API keys are great for security, but frequent rotation can create a lot of friction. This guide documents an approach that improves developer UX while preserving the security benefits of shorter expiries.

What it does

The utility renews an LLM gateway API key in a single command, and updates the local credential store so CLI/IDE tools keep working without manual copy/paste.

It targets tools that commonly look for provider-style environment variables (OpenAI/Anthropic/Gemini compatibility).

Security model (important)

This approach does not bypass authentication. Instead, it reuses existing workstation authentication context (for example, browser session tokens obtained after MFA) to:

1. Check whether the current API key is valid
2. Renew it if expired
3. Update the local credential store

Any organisation-specific identity provider names and internal URLs have been redacted below.

Install

The original installation referenced a public install script. If you use a similar approach, prefer pinning to a commit or validating the script content before running it.

/bin/zsh -c "$(curl -fsSL https://example.com/your-installer.sh)"

Configure your shell (one-off)

The goal is:

• provide a check_litellm_key helper command
• load the current key from a local credential store
• export provider-compatible environment variables for common clients

# Run the renew/check command
alias check_litellm_key='(cd "$HOME/Applications/litellm-key-updater" && .venv/bin/python check_key.py)'

# Retrieve the master key from your credential store
export LITELLM_MASTER_KEY="$(security find-generic-password -s \"LITELLM_API_KEY\" -w)"

# Compatibility env vars expected by various tools
export OPENAI_API_KEY="$LITELLM_MASTER_KEY"
export ANTHROPIC_AUTH_TOKEN="$LITELLM_MASTER_KEY"
export GEMINI_API_KEY="$LITELLM_MASTER_KEY"

After updating your shell configuration, restart your terminal or source your profile.

Configure the renewer (one-off)

The original notes use a JSON config file that points to:

• an OAuth base URL
• an API base URL

These are organisation-specific; replace them with the appropriate values for your environment.

cd ~/Applications/litellm-key-updater/
cp config.template.json config.json

Run it

check_litellm_key

Expected behaviour:

• If the key is valid: it reports status and exits
• If the key is expired: it renews and updates the credential store

Manual approach (for understanding / debugging)

If you need to debug what the renewer is doing, the “manual way” is typically:

1. Obtain an authenticated bearer token from your browser session
2. Put it into an environment variable
3. Call an endpoint to check key validity
4. Call an endpoint to renew the key

All organisation-specific URLs are redacted here.

# Check key
curl -X GET "https://<internal-portal>/api/v1/auths/api_key" \
  -H "Authorization: Bearer $SESSION_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/plain, */*"

# Renew key
curl -X POST "https://<internal-portal>/api/v1/auths/api_key" \
  -H "Authorization: Bearer $SESSION_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/plain, */*" \
  -d '{}'

Notes

• Short-lived keys can materially reduce blast radius.
• Automation keeps the security posture high without creating constant developer interruptions.