fix(health): stop treating custom-pricing fields as a connection override on test_connection - #41024

TLDR

Problem this solves:

• "Test Connection" fails for a working model when a price is also set
• Any custom-pricing field in the request drops the configured credentials
• The probe then runs with no API key and reports an auth error
• It hits the Add Model wizard, where price and test sit together

How it solves it:

• Split out the banned params that describe a connection
• That list is the banned list minus the custom-pricing fields
• Gate credential inheritance on that list, not the full banned list
• Pricing stays banned from request bodies; nothing else changes

User Flow

Before: an admin adds a model that is not in the cost map, sets its price, and "Test Connection" says the working model is broken

1. The admin has a configured model whose provider model string is openai/gemini-2.5-flash-lite, with its API key in the proxy config
2. They send POST https://litellm-domain/health/test_connection with {"litellm_params": {"model": "openai/gemini-2.5-flash-lite"}, "mode": "chat"} and get "status": "success"
3. They send the same request with "input_cost_per_token": 1e-9 added, as the Add Model wizard does when a price is filled in
4. They get "status": "error" with AuthenticationError: … The api_key client option must be set, for a model that works

After: the price no longer changes which credentials the test uses

1. Same configured model, same API key in the proxy config
2. POST https://litellm-domain/health/test_connection with only the model still returns "status": "success"
3. The same request with "input_cost_per_token": 1e-9 added now also returns "status": "success"
4. A request that brings its own api_base still inherits no configured credentials, as before

Relevant issues

No issue filed. Regression from the credential-inheritance guard that now lives in _request_inherits_config_credentials (#39801 and earlier).

Affected release

Linear ticket

Pre-Submission checklist

Please complete all items before asking a LiteLLM maintainer to review your PR

• I have added meaningful tests
• The handful of test files covering my change pass locally, e.g. uv run pytest tests/test_litellm/<your_test_file>.py -v. Leave the suites (make test-unit-*, make test-unit) to CI: it finishes in ~15 minutes where a laptop takes an hour or more
• My PR passes all required CI/CD checks (e.g., lint, schema.d.ts sync check, etc.)
• My PR's scope is as isolated as possible; it only solves 1 specific problem
• I have received a Greptile Confidence Score of at least 4/5 before requesting a maintainer review (Greptile reviews automatically once the PR is opened; only comment @greptileai to re-request a review after pushing changes)

Local checks on b9eff59e2e: tests/test_litellm/proxy/health_endpoints/test_health_endpoints.py 197 passed; the three new pricing cases fail with only the one-line gate swap reverted; ruff check finds nothing new against the base files and ruff format --check (pinned 0.15.3) is clean; ruff_strict_gate, type_discipline_gate, test_quality_gate and type_check_gate all OK against main.

Screenshots / Proof of Fix

Shared setup, the same for both runs: a local proxy with a Postgres database and this config. The model routes to a real OpenAI-compatible endpoint, so each successful probe is a real LLM call.

model_list:
  - model_name: pricing-probe
    litellm_params:
      model: openai/gemini-2.5-flash-lite
      api_base: os.environ/DEV_PROXY_BASE
      api_key: os.environ/DEV_PROXY_KEY
general_settings:
  master_key: sk-local-proof-1234

Each case is POST http://127.0.0.1:21431/health/test_connection with Authorization: Bearer sk-local-proof-1234.

Before (30f33a9)

Model only

1. Body: {"litellm_params":{"model":"openai/gemini-2.5-flash-lite"},"mode":"chat"}
2. HTTP 200, "status": "success"

Model plus a price

1. Body: {"litellm_params":{"model":"openai/gemini-2.5-flash-lite","input_cost_per_token":1e-9},"mode":"chat"}
2. HTTP 200, "status": "error", litellm.AuthenticationError: AuthenticationError: OpenAIException - The api_key client option must be set either by passing api_key to the client or b…

Own api_base plus a price

1. Body: {"litellm_params":{"model":"openai/gemini-2.5-flash-lite","api_base":"https://example.invalid/v1","input_cost_per_token":1e-9},"mode":"chat"}
2. HTTP 200, "status": "error", litellm.AuthenticationError: … The api_key client option must be set …

After (b9eff59)

Model only

1. Body: {"litellm_params":{"model":"openai/gemini-2.5-flash-lite"},"mode":"chat"}
2. HTTP 200, "status": "success"

Model plus a price

1. Body: {"litellm_params":{"model":"openai/gemini-2.5-flash-lite","input_cost_per_token":1e-9},"mode":"chat"}
2. HTTP 200, "status": "success"

Own api_base plus a price

1. Body: {"litellm_params":{"model":"openai/gemini-2.5-flash-lite","api_base":"https://example.invalid/v1","input_cost_per_token":1e-9},"mode":"chat"}
2. HTTP 200, "status": "error", litellm.AuthenticationError: … The api_key client option must be set … (unchanged: a request with its own endpoint still gets no configured key)

Type

🐛 Bug Fix

Caveats (if any)

Low

• Probing by public model name overrides the configured provider model string
  • Pre-existing and unrelated; the proof uses the provider string the wizard sends

Final Attestation

• The tests check the right things, including the edge cases, and regressions in the respective real-world customer use-cases are not possible after this PR