fix(service): prefix the litellm master key with sk- and add a salt key

Closes #10521

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -40,6 +40,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 - Use PostgreSQL 16 in the Outline service template. New Outline versions need PostgreSQL 14 or later, so a new Outline service restarted in a loop on `postgres:12-alpine` with `syntax error at or near "TRIGGER"`. An existing Outline service keeps PostgreSQL 12. To upgrade it, follow the steps in the Outline service documentation ([#12345](https://github.com/coollabsio/coolify/issues/12345))
 - Collect only the logs of its own stack in the Supabase service template. Before, the Vector container read the logs of all containers on the server, so with two Supabase services on one server (for example a clone for production), Supabase Studio showed the API logs of the other stack. An existing Supabase service keeps its `vector.yml`. To fix it, on the server, add `include_labels: ['com.docker.compose.project=${COOLIFY_RESOURCE_UUID}']` under `sources.docker_host` in `/data/coolify/services/<service-uuid>/volumes/logs/vector.yml`, then restart the service ([#10324](https://github.com/coollabsio/coolify/issues/10324))
 - Keep an application that uses a server only as an additional destination when you delete that server with **Delete all resources** or with `DELETE /api/v1/servers/{uuid}?force=true`. Before, Coolify deleted the application on all its servers, also after **Promote** made another server its main server. Coolify now removes the application only from the deleted server and stops its containers there. A server that has only such applications can be deleted without **Delete all resources**. The delete confirmation lists the resources that it deletes and the applications that keep running on another server
+- Fix the LiteLLM service template for new services. The master key now starts with `sk-`, as LiteLLM requires: use `sk-` followed by the value of `SERVICE_PASSWORD_MASTERKEY` as the admin API key. The template also sets a separate `LITELLM_SALT_KEY`, so stored model credentials stay readable when you change the master key, and sets `STORE_MODEL_IN_DB` to `True` by default, so you can add models in the LiteLLM UI ([#10521](https://github.com/coollabsio/coolify/issues/10521))
 
 ## [v4.6.0] - 2026-11-02
 

templates/compose/litellm.yaml

@@ -17,7 +17,8 @@ services:
       - SERVICE_URL_LITELLM_4000
       - LITELLM_LOG=${LITELLM_LOG:-ERROR}
       - LITELLM_MODE=${LITELLM_MODE:-PRODUCTION}
-      - LITELLM_MASTER_KEY=${SERVICE_PASSWORD_MASTERKEY}
+      - LITELLM_MASTER_KEY=sk-${SERVICE_PASSWORD_MASTERKEY}
+      - LITELLM_SALT_KEY=${SERVICE_PASSWORD_SALTKEY}
       - UI_USERNAME=${SERVICE_USER_UI}
       - UI_PASSWORD=${SERVICE_PASSWORD_UI}
       - DATABASE_URL=postgresql://${SERVICE_USER_POSTGRES}:${SERVICE_PASSWORD_POSTGRES}@postgres:5432/${POSTGRES_DB:-litellm}
@@ -32,7 +33,7 @@ services:
       - ANTHROPIC_API_BASE=${ANTHROPIC_API_BASE}
       - VOYAGE_API_KEY=${VOYAGE_API_KEY}
       - VOYAGE_API_BASE=${VOYAGE_API_BASE}
-      - STORE_MODEL_IN_DB=${STORE_MODEL_IN_DB}
+      - STORE_MODEL_IN_DB=${STORE_MODEL_IN_DB:-True}
     volumes:
       - type: bind
         source: ./litellm-config.yaml