diff --git a/src/auth/litellm.ts b/src/auth/litellm.ts
index 00568f3..6556b13 100644
--- a/src/auth/litellm.ts
+++ b/src/auth/litellm.ts
@@ -20,8 +20,13 @@ interface LiteLLMMCPServerResponse {
  * so we create one MCP server entry per customer with the customer-specific
  * demux URL. The virtual key is then scoped to only that server.
  */
+/** LiteLLM rejects server names containing `-`; replace with `_`. */
+function toServerAlias(customerId: string): string {
+  return `sitebridge_${customerId.replace(/-/g, "_")}`;
+}
+
 export async function provisionMcpServer(customerId: string): Promise<string> {
-  const serverAlias = `sitebridge-${customerId}`;
+  const serverAlias = toServerAlias(customerId);
   const demuxUrl = `${config.agilitonAccountUrl}/mcp/demux/${customerId}/mcp`;
 
   const body = {
@@ -63,7 +68,7 @@ export async function provisionLiteLLMKey(customerId: string, email: string): Pr
 
   // 2. Create virtual key scoped to that MCP server
   const body = {
-    key_alias: `sb-${customerId}`,
+    key_alias: `sb_${customerId.replace(/-/g, "_")}`,
     models: config.defaultModels,
     mcp_servers: [mcpServerAlias],
     max_budget: config.defaultBudgetUsd,