### Check for existing issues

- [x] I have searched the existing issues and checked that my issue is not a duplicate.

### What happened?

A bug happened!

**Edition:** LiteLLM **Enterprise**. We need a clear fix or upgrade path

**Image:** `[ghcr.io/berriai/litellm-database:main-v1.82.3-stable`](http://ghcr.io/berriai/litellm-database:main-v1.82.3-stable%60) (mirrored to ECR).

Per [Virtual Keys → Key Rotations](https://docs.litellm.ai/docs/proxy/virtual_keys#-key-rotations), POST /key/{key}/regenerate with "grace_period": "…" should keep **both** the old and new virtual keys working until **revoke_at**.

**Observed:** Immediately after regenerate, requests using the **pre-rotate** sk-… fail with auth errors consistent with token_not_found_in_db / “Unable to find token in cache or LiteLLM_VerificationTokenTable”, while the **new** key works.

**Database (self-hosted Postgres):** After regenerate, **SELECT token, active_token_id, revoke_at FROM "LiteLLM_DeprecatedVerificationToken"** shows a row where:

token = SHA-256 of the deprecated (pre-rotate) key material active_token_id = hash aligning with the new active key row revoke_at = rotate time **+ grace** (behaves as expected…