fix(cache): log hashed cache keys

[fengjikui]

Relevant issues

Fixes #29414

Linear ticket

N/A

Pre-Submission checklist

• I have added meaningful tests
• My PR passes all unit tests on make test-unit
• My PR's scope is as isolated as possible; it only solves 1 specific problem
• I have requested a Greptile review by commenting @greptileai and received a Confidence Score of at least 4/5 before requesting a maintainer review

Delays in PR merge?

N/A

CI (LiteLLM team)

• Branch creation CI run
  Link:

• CI run for the last commit
  Link:

• Merge / cherry-pick CI run
  Links:

Screenshots / Proof of Fix

I reproduced the reported debug-log shape by calling Cache.get_cache_key() with a long system prompt, tools, response_format, and messages. The returned cache key was already a 64-character SHA-256 key, but the Created cache key debug log printed the unhashed source material before this change

After this change, the same script shows the log line contains the final hashed key and the source material length, while the prompt marker is absent from logs

cache_key_len= 64
prompt_marker_in_logs= False
Created cache key: af820855c8cf25649dea1d7decef5da2401d6019181a39ae3a881f78bde3d1ef (source material length: 2559)

Validation run locally:

uv run python -m pytest tests/test_litellm/test_model_param_helper.py tests/test_litellm/caching/test_caching.py -q
5 passed in 0.10s

uv run ruff check litellm/caching/caching.py tests/test_litellm/caching/test_caching.py
All checks passed!

uv run ruff format --check tests/test_litellm/caching/test_caching.py
1 file already formatted

git diff --check

I did not run make test-unit locally because this is a focused cache logging change and the targeted cache-key regression passed

Type

Bug Fix
Test

Changes

Cache.get_cache_key() now emits the final hashed cache key in the Created cache key debug log instead of the raw source material used to derive the hash. The log keeps source material length so operators can still spot unexpectedly large cache-key inputs without writing prompt content, tool schemas, or response schemas into debug logs

A regression test covers long prompt material with tools and response_format. It asserts the returned key remains a SHA-256 value and the Created cache key debug log does not contain prompt material

[fengjikui]

@greptileai

[greptile-apps]

Greptile Summary

This PR fixes a debug-log privacy issue in Cache.get_cache_key() where the Created cache key log line was emitting raw source material (messages, tool schemas, response formats) instead of the final SHA-256 hash. The log is now moved to after the hash and namespace steps, logging the final key and the source-material byte length.

• litellm/caching/caching.py: Relocated the verbose_logger.debug call three lines later so it fires after _get_hashed_cache_key and _add_namespace_to_cache_key, replacing the raw string with the hashed key and adding a source material length field.
• tests/test_litellm/caching/test_caching.py: New unit test that exercises get_cache_key with a long prompt marker, tools, and response_format, then asserts the returned key is a valid 64-char hex digest and that the marker string is absent from all Created cache key log records.

Confidence Score: 5/5

Safe to merge — the change is a three-line log relocation with no effect on cache key computation or lookup behavior.

The only touched logic is the placement of a debug log statement. The hash computation, namespace addition, and return value are all unchanged. The new test directly validates the fix and makes no network calls.

No files require special attention.

Important Files Changed

Filename	Overview
litellm/caching/caching.py	Moved debug log for "Created cache key" to after hash computation, now logs the final hashed key and source material length instead of raw source material
tests/test_litellm/caching/test_caching.py	New regression test verifying the cache key debug log does not contain prompt/tool/response_format content, and that the returned key is a valid SHA-256 hex string

_{Reviews (1): Last reviewed commit: "fix(cache): log hashed cache keys" | Re-trigger Greptile}

[greptile-apps]

Greptile Summary

This PR fixes a debug-logging privacy leak in Cache.get_cache_key(), where the Created cache key log line emitted the full raw source material (messages, tools, response_format) rather than the final SHA-256 hash. The fix reorders two lines so the log fires after hashing and after the namespace is applied, keeping source material length for diagnostics.

• litellm/caching/caching.py: The single verbose_logger.debug call is moved two lines down (after _get_hashed_cache_key and _add_namespace_to_cache_key) and updated to log hashed_cache_key and len(cache_key) instead of the raw cache_key string.
• tests/test_litellm/caching/test_caching.py: A new pure-local test asserts the returned key is a valid 64-char hex digest, the log contains that digest, and the log does not contain the injected prompt_marker.

Confidence Score: 5/5

The change is minimal and additive — it only reorders two existing lines and adjusts a single log call. Cache key computation and hashing are untouched; only the log output changes.

Both files are straightforward: a two-line reorder in the production code and a new local-only pytest that directly verifies the fixed behavior. There are no functional changes to the cache key derivation, hashing, or namespace logic. The test covers the exact regression described in the issue.

No files require special attention.

Important Files Changed

Filename	Overview
litellm/caching/caching.py	Moves the Created cache key debug log to after hashing so the logged value is the final SHA-256 key; adds len(cache_key) for operator diagnostics without leaking raw content.
tests/test_litellm/caching/test_caching.py	New test file that validates the returned cache key is a 64-char SHA-256 hex digest and that the Created cache key debug log does not contain raw prompt material.

_{Reviews (2): Last reviewed commit: "fix(cache): log hashed cache keys" | Re-trigger Greptile}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!