docs: replace the example master key sk-1234 with placeholders

[devin-ai-integration]

Summary

Removes sk-1234 and its weak variants (sk-12345, sk-1234567890, sk-1234ewknldferwedojwojw) from every example in the docs, blog, release notes, static/ and docker-compose.yml. Wiz found about 1 in 10 exposed LiteLLM gateways accepting sk-1234, and the docs are where people (and their coding agents) copy it from. Runtime enforcement is handled separately in BerriAI/litellm#40758; this PR only changes what readers copy

Replacement rules, applied by context:

curl / shell header          Bearer sk-1234            -> Bearer $LITELLM_API_KEY
yaml general_settings        master_key: sk-1234       -> master_key: os.environ/LITELLM_MASTER_KEY
env / compose / docker -e    LITELLM_MASTER_KEY=sk-1234 -> LITELLM_MASTER_KEY=sk-<paste-a-long-random-key>
python / js / json literal   "sk-1234"                 -> "sk-<your-litellm-api-key>"
key management payloads      /key/sk-1234/regenerate   -> /key/sk-<virtual-key>/regenerate
provider credentials         api_key: sk-1234          -> api_key: sk-<your-api-key>
LITELLM_SALT_KEY             sk-1234                   -> sk-<paste-a-long-random-key>

$LITELLM_API_KEY is used only inside shell fences; Python and JavaScript blocks get the literal placeholder since a shell variable would not expand there. Angle-bracket placeholders inside MDX prose are wrapped in backticks so Docusaurus does not parse them as JSX

Left as is on purpose: the Password: sk-1234 lines in release notes and static/llms-full.txt, which are the login for the public demo at demo.litellm.ai rather than a setup example, and the guardrail demo payloads in docs/proxy/guardrails/secret_detection.md and prompt_security.md, where the fake key is the thing the detector is supposed to catch

Validation: rg -n 'sk-1234' on the branch returns only the exceptions above; npm run build succeeds with only the pre-existing HTML minifier warnings

Link to Devin session: https://app.devin.ai/sessions/48aefd15550e4376b26ee8d0550320ad
Open in Devin Desktop: https://app.devin.ai/desktop/session/48aefd15550e4376b26ee8d0550320ad?variant=devin
Requested by: @mateo-berri

---

Note

Low Risk
Documentation and example-only changes with no production code or authentication logic modified.

Overview
Replaces the default example LiteLLM proxy key sk-1234 (and similar weak variants) across blog posts, docs, and benchmark scripts so copy-paste examples do not reinforce a credential Wiz commonly sees in the wild.

cURL/shell examples now use Authorization: Bearer $LITELLM_API_KEY (or x-api-key: $LITELLM_API_KEY). YAML general_settings uses master_key: os.environ/LITELLM_MASTER_KEY instead of inline keys. Python/TypeScript/OpenAI SDK snippets use literals like sk-<your-litellm-api-key>; env/compose examples use sk-<paste-a-long-random-key> for master keys. A few MCP Cursor JSON blocks switch from $LITELLM_API_KEY to the literal placeholder where env vars do not apply.

Intentionally unchanged: demo login Password: sk-1234 in release notes and guardrail docs where fake keys are the detection target.

^{Reviewed by Cursor Bugbot for commit fe50a61. Bugbot is set up for automated code reviews on this repo. Configure here.}

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
litellm	Ready	Preview	Sep 11, 2026 9:45pm UTC

[mateo-berri]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit fe50a61. Configure here.}

[ryan-crabbe-berri]

lgtm