LiteLLM Connection

LiteLLM is an open-source LLM gateway that exposes a unified, OpenAI-compatible API in front of hundreds of large language models. Infisical supports connecting to a self-hosted LiteLLM proxy using an API Key. This connection is used to manage and rotate LiteLLM API keys via Secret Rotation.

Prerequisites

A running LiteLLM proxy that Infisical can reach over the network, along with its base URL (e.g. https://litellm.example.com).
A management-capable API key for that proxy. Infisical uses this key to create, list, and delete keys on your behalf, so it must be the proxy master key or an admin/management key with key-management permissions. A standard virtual key limited to model completions will not work.

See LiteLLM’s Virtual Keys documentation for details on the proxy master key and key management.

Create LiteLLM Connection in Infisical

Infisical UI
API

Create a user and issue a scoped key in LiteLLM

We recommend creating a dedicated user and issuing a scoped key for Infisical to manage your API keys, rather than using the master key directly. This restricts Infisical’s access to only the routes it needs.First, create a user with the proxy_admin role. This role is required so the key can delete keys it did not issue:

Create user

curl --request POST \
  --url <LITELLM_HOST>/user/new \
  --header 'Authorization: Bearer <master-key>' \
  --header 'Content-Type: application/json' \
  --data '{
    "user_id": "infisical-user-rotation",
    "user_role": "proxy_admin",
    "user_alias": "infisical-proxy-admin-client"
  }'

Then issue a scoped key for that user:

Issue scoped key

curl --request POST \
  --url <LITELLM_HOST>/key/generate \
  --header 'Authorization: Bearer <master-key>' \
  --header 'Content-Type: application/json' \
  --data '{
    "key_alias": "admin-key-rotation",
    "user_id": "infisical-user-rotation",
    "allowed_routes": [
      "/key/generate",
      "/key/delete",
      "/key/info",
      "/health/readiness",
      "/models",
      "/v2/team/list",
      "/user/list"
    ]
  }' | jq ".key"

The /models, /v2/team/list, and /user/list routes are optional. They are only used to populate the user, team, and model dropdowns in the Infisical UI when configuring a rotation.

Use the generated key as your API Key and your instance address as the Instance URL when creating the connection below.

Navigate to App Connections

In your Infisical dashboard, go to Organization Settings → App Connections (or the Integrations → App Connections tab in your project). App Connections Tab

Select LiteLLM Connection

Click Add Connection and choose LiteLLM from the list of available connections. Select LiteLLM Connection

Fill out Connection Form

Complete the form with:

A name for the connection (e.g. litellm-prod)
An optional description
Your LiteLLM Instance URL (e.g. https://litellm.example.com)
Your LiteLLM API Key (a management-capable key, as described above)

Connection Created

After clicking Connect to LiteLLM, Infisical validates the credentials against your LiteLLM instance. Your LiteLLM Connection is then ready to use for LiteLLM API Key Secret Rotation. LiteLLM Connection Created

Create a LiteLLM connection via the Create LiteLLM Connection API endpoint.

Sample request

Request

curl --request POST \
  --url https://app.infisical.com/api/v1/app-connections/litellm \
  --header 'Content-Type: application/json' \
  --data '{
    "name": "my-litellm-connection",
    "method": "api-key",
    "projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
    "credentials": {
      "apiKey": "<YOUR-LITELLM-MANAGEMENT-API-KEY>",
      "instanceUrl": "https://litellm.example.com"
    }
  }'

Sample response

Response

{
  "appConnection": {
    "id": "e5d18aca-86f7-4026-a95e-efb8aeb0d8e6",
    "name": "my-litellm-connection",
    "projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
    "description": null,
    "version": 1,
    "orgId": "6f03caa1-a5de-43ce-b127-95a145d3464c",
    "createdAt": "2025-04-23T19:46:34.831Z",
    "updatedAt": "2025-04-23T19:46:34.831Z",
    "isPlatformManagedCredentials": false,
    "credentialsHash": "...",
    "app": "litellm",
    "method": "api-key",
    "credentials": {
      "instanceUrl": "https://litellm.example.com"
    }
  }
}

LDAP Connection SSH

Getting Started

Platform Reference

Connectivity

Authentication Methods

Self-host Infisical

Internals

Contributing

LiteLLM Connection

Prerequisites

Create LiteLLM Connection in Infisical

Sample request

Sample response

​Prerequisites

​Create LiteLLM Connection in Infisical

​Sample request

​Sample response

Prerequisites

Create LiteLLM Connection in Infisical

Sample request

Sample response