Skip to main content
LiteLLM is an open-source LLM gateway that exposes a unified, OpenAI-compatible API in front of hundreds of large language models. Infisical supports connecting to a self-hosted LiteLLM proxy using an API Key. This connection is used to manage and rotate LiteLLM API keys via Secret Rotation.

​
Prerequisites

  • A running LiteLLM proxy that Infisical can reach over the network, along with its base URL (e.g. https://litellm.example.com).
  • A management-capable API key for that proxy. Infisical uses this key to create, list, and delete keys on your behalf, so it must be the proxy master key or an admin/management key with key-management permissions. A standard virtual key limited to model completions will not work.
See LiteLLM’s Virtual Keys documentation for details on the proxy master key and key management.

​
Create LiteLLM Connection in Infisical

1

Create a user and issue a scoped key in LiteLLM

We recommend creating a dedicated user and issuing a scoped key for Infisical to manage your API keys, rather than using the master key directly. This restricts Infisical’s access to only the routes it needs.First, create a user with the proxy_admin role. This role is required so the key can delete keys it did not issue:
Create user
curl --request POST \
  --url <LITELLM_HOST>/user/new \
  --header 'Authorization: Bearer <master-key>' \
  --header 'Content-Type: application/json' \
  --data '{
    "user_id": "infisical-user-rotation",
    "user_role": "proxy_admin",
    "user_alias": "infisical-proxy-admin-client"
  }'
Then issue a scoped key for that user:
Issue scoped key
curl --request POST \
  --url <LITELLM_HOST>/key/generate \
  --header 'Authorization: Bearer <master-key>' \
  --header 'Content-Type: application/json' \
  --data '{
    "key_alias": "admin-key-rotation",
    "user_id": "infisical-user-rotation",
    "allowed_routes": [
      "/key/generate",
      "/key/delete",
      "/key/info",
      "/health/readiness",
      "/models",
      "/v2/team/list",
      "/user/list"
    ]
  }' | jq ".key"
The /models, /v2/team/list, and /user/list routes are optional. They are only used to populate the user, team, and model dropdowns in the Infisical UI when configuring a rotation.
Use the generated key as your API Key and your instance address as the Instance URL when creating the connection below.
2

Navigate to App Connections

In your Infisical dashboard, go to Organization Settings → App Connections (or the Integrations → App Connections tab in your project).App Connections Tab
3

Select LiteLLM Connection

Click Add Connection and choose LiteLLM from the list of available connections.Select LiteLLM Connection
4

Fill out Connection Form

Complete the form with:
  • A name for the connection (e.g. litellm-prod)
  • An optional description
  • Your LiteLLM Instance URL (e.g. https://litellm.example.com)
  • Your LiteLLM API Key (a management-capable key, as described above) LiteLLM Connection Form
5

Connection Created

After clicking Connect to LiteLLM, Infisical validates the credentials against your LiteLLM instance. Your LiteLLM Connection is then ready to use for LiteLLM API Key Secret Rotation.LiteLLM Connection Created