### Check for existing issues

- [x] I have searched the existing issues and checked that my issue is not a duplicate.

### What happened?

## Summary

When the parallel request limiter returns a 429 response, the JSON error body includes the full 64-character SHA-256 hash of the offending virtual key in the `error.message` field. This identifier is then visible to any HTTP client that hits the rate limit, including end users / customers of the proxy.

`redact_user_api_key_info: True` in `litellm_settings` does not affect this code path — only Langfuse callback metadata and a few other surfaces.

## Source

`litellm/proxy/hooks/parallel_request_limiter_v3.py`, around line 1261 (in litellm latest as of 2026-05-13 via `ghcr.io/berriai/litellm:main-stable`):

```python detail = ( f"Rate limit exceeded for {descriptor_key}: {descriptor_value}. " f"Limit type: {rate_limit_type}. " f"Current limit: {current_limit}, Remaining: {remaining_display}. " f"Limit resets at: {reset_time_formatted}" )

raise HTTPException( status_code=429, detail=detail, headers={ "retry-after": str(self.window_size), ... }, ) ```

When `descriptor_key == "api_key"`…