Implementation:BerriAI Litellm Custom Secret Manager Loader

Attribute	Value
Sources	litellm/secret_managers/custom_secret_manager_loader.py
Domains	Secret Management, Dynamic Loading, Plugin System
last_updated	2026-02-15 16:00 GMT

Overview

The Custom Secret Manager Loader dynamically loads user-defined secret manager classes from Python files, enabling custom secret management integrations without modifying LiteLLM source code.

Description

This module provides the load_custom_secret_manager function, which dynamically loads a custom secret manager class from a Python file located alongside the proxy's config.yaml. The loading process follows the same pattern as custom guardrails: the custom_secret_manager field in key_management_settings specifies a "file_name.ClassName" string, which is split into a module file path and class name. The module is loaded using importlib.util, the class is extracted, validated as a subclass of CustomSecretManager, instantiated, and registered as litellm.secret_manager_client with the key management system set to CUSTOM.

Usage

Import load_custom_secret_manager during proxy initialization when key_management_system: custom_secret_manager is specified in the proxy configuration.

Code Reference

Source Location

litellm/secret_managers/custom_secret_manager_loader.py

Function Signature

def load_custom_secret_manager(config_file_path: Optional[str] = None) -> None:

Import

from litellm.secret_managers.custom_secret_manager_loader import load_custom_secret_manager

I/O Contract

Inputs

Parameter	Type	Description
config_file_path	Optional[str]	Absolute path to the proxy's config.yaml file. The custom module is loaded from the same directory.

Outputs

Return Type	Description
None	Side effect: sets litellm.secret_manager_client and litellm._key_management_system
Raises ValueError	If config_file_path is missing, key_management_settings is not set, or custom_secret_manager field is missing
Raises ImportError	If the custom module file cannot be found or loaded
Raises TypeError	If the loaded class is not a subclass of CustomSecretManager

Usage Examples

# In config.yaml:
# general_settings:
#   key_management_system: custom_secret_manager
#   key_management_settings:
#     custom_secret_manager: my_secret_manager.InMemorySecretManager

# The custom Python file (my_secret_manager.py) in the same directory as config.yaml:
# from litellm.integrations.custom_secret_manager import CustomSecretManager
#
# class InMemorySecretManager(CustomSecretManager):
#     def __init__(self):
#         self._store = {}
#
#     async def async_get_secret(self, secret_name, **kwargs):
#         return self._store.get(secret_name)
#     ...

# During proxy startup:
from litellm.secret_managers.custom_secret_manager_loader import load_custom_secret_manager

load_custom_secret_manager(config_file_path="/app/config.yaml")
# litellm.secret_manager_client is now an instance of InMemorySecretManager
# litellm._key_management_system is KeyManagementSystem.CUSTOM

Related Pages

• BerriAI_Litellm_Base_Secret_Manager - Abstract base class for built-in secret managers
• BerriAI_Litellm_Secret_Manager_Main - Main secret retrieval dispatcher
• BerriAI_Litellm_AWS_Secret_Manager_V2 - Built-in AWS secret manager implementation
• BerriAI_Litellm_HashiCorp_Secret_Manager - Built-in HashiCorp Vault implementation