LiteLLM 1.103

Apply these rules to the LiteLLM Python SDK and gateway on the 1.103 release line. The gateway's credentials, routes, model catalog, and stored objects are separate trust boundaries from the application using it.

Deployment

• Use a security-supported CPython minor within LiteLLM's declared >=3.10,<3.15 range; verify integration extras against the selected interpreter. Check the actual PyPI artifact and container image independently, and verify container signatures with the release's trusted cosign public key before deploying a digest.
• Set a long, random LITELLM_MASTER_KEY and keep it only in protected operator configuration. Never give it to inference clients or use it as an application key. Keep LITELLM_SALT_KEY stable and secret so stored provider and MCP credentials remain decryptable during master-key rotation.
• On LiteLLM 1.103.0, which predates the 1.103.1 fix for GHSA-7hp6-4w63-5g45, set EXPERIMENTAL_UI_LOGIN=false explicitly on every proxy replica to disable the affected login path. This also disables CLI SSO and gateway login; limit internal-user keys while the workaround is needed.

Proxy identity

• Issue distinct expiring virtual keys per service and team with /key/generate. Set explicit models, allowed_routes, team_id, budgets, and object permissions. An empty model list and * permit broad model access; a proxy_admin key can bypass ordinary inference limits.
• Revoke and rotate keys through the key-management API; test rejection on every worker and cached authentication path. Keep key creation responses, CLI session tokens, and