Exclude API keys from saved programs (#8941)

* Initial plan

* Exclude sensitive API keys from saved programs

Co-authored-by: TomeHirata <[email protected]>

* Fix linting issues in API key exclusion tests

Co-authored-by: TomeHirata <[email protected]>

* Simplify API key exclusion and consolidate tests into test_lm.py

Co-authored-by: TomeHirata <[email protected]>

* Remove redundant API key tests, keep only test_api_key_not_saved_in_json

Co-authored-by: TomeHirata <[email protected]>

* Remove docstring from test_api_key_not_saved_in_json

Co-authored-by: TomeHirata <[email protected]>

---------

Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: TomeHirata <[email protected]>

Author: Copilot

dspy/clients/lm.py

@@ -273,7 +273,9 @@ def dump_state(self):
             "launch_kwargs",
             "train_kwargs",
         ]
-        return {key: getattr(self, key) for key in state_keys} | self.kwargs
+        # Exclude api_key from kwargs to prevent API keys from being saved in plain text
+        filtered_kwargs = {k: v for k, v in self.kwargs.items() if k != "api_key"}
+        return {key: getattr(self, key) for key in state_keys} | filtered_kwargs
 
     def _check_truncation(self, results):
         if self.model_type != "responses" and any(c.finish_reason == "length" for c in results["choices"]):

tests/clients/test_lm.py

@@ -1,6 +1,8 @@
 import json
+import tempfile
 import time
 import warnings
+from pathlib import Path
 from unittest import mock
 from unittest.mock import patch
 
@@ -604,3 +606,31 @@ def test_responses_api_tool_calls(litellm_test_server):
 
         dspy_responses.assert_called_once()
         assert dspy_responses.call_args.kwargs["model"] == "openai/dspy-test-model"
+
+
+def test_api_key_not_saved_in_json():
+    lm = dspy.LM(
+        model="openai/gpt-4o-mini",
+        model_type="chat",
+        temperature=1.0,
+        max_tokens=100,
+        api_key="sk-test-api-key-12345",
+    )
+
+    predict = dspy.Predict("question -> answer")
+    predict.lm = lm
+
+    with tempfile.TemporaryDirectory() as tmpdir:
+        json_path = Path(tmpdir) / "program.json"
+        predict.save(json_path)
+
+        with open(json_path) as f:
+            saved_state = json.load(f)
+
+        # Verify API key is not in the saved state
+        assert "api_key" not in saved_state.get("lm", {}), "API key should not be saved in JSON"
+
+        # Verify other attributes are saved
+        assert saved_state["lm"]["model"] == "openai/gpt-4o-mini"
+        assert saved_state["lm"]["temperature"] == 1.0
+        assert saved_state["lm"]["max_tokens"] == 100