@@ -710,7 +710,7 @@ describe("getProviderQuotas", () => {
 		expect(fetchSpy).toHaveBeenCalledTimes(2)
 	})
 
-	it("refetches when the API key changes, without keeping the key in the cache key", async () => {
+	it("refetches when the API key changes", async () => {
 		const fetchSpy = vi.fn(async () => new Response(JSON.stringify({ data: { limit: 10, limit_remaining: 5 } })))
 		await getProviderQuotas(
 			[{ apiProvider: providerIdentifiers.openrouter, openRouterApiKey: "sk-one" } as never],
@@ -725,6 +725,29 @@ describe("getProviderQuotas", () => {
 		expect(fetchSpy).toHaveBeenCalledTimes(2)
 	})
 
+	it("does not hand a result fetched with one key to a caller using another, even while the first is in flight", async () => {
+		const releases: Array<(r: Response) => void> = []
+		const fetchSpy = vi.fn(() => new Promise<Response>((resolve) => releases.push(resolve)))
+		const ok = () => new Response(JSON.stringify({ data: { limit: 10, limit_remaining: 5 } }))
+
+		const first = getProviderQuotas(
+			[{ apiProvider: providerIdentifiers.openrouter, openRouterApiKey: "sk-one" } as never],
+			{},
+			fetchSpy,
+		)
+		const second = getProviderQuotas(
+			[{ apiProvider: providerIdentifiers.openrouter, openRouterApiKey: "sk-two" } as never],
+			{},
+			fetchSpy,
+		)
+		await vi.waitFor(() => expect(fetchSpy).toHaveBeenCalledTimes(2))
+		releases.forEach((release) => release(ok()))
+		await Promise.all([first, second])
+
+		// Each key was fetched on its own; neither piggy-backed on the other's request.
+		expect(fetchSpy).toHaveBeenCalledTimes(2)
+	})
+
 	it("shares one request between concurrent callers for the same credentials", async () => {
 		let release: (r: Response) => void = () => {}
 		const fetchSpy = vi.fn(() => new Promise<Response>((resolve) => (release = resolve)))
 
@@ -5,8 +5,6 @@ import {
 	type ProviderSettings,
 } from "@roo-code/types"
 
-import { createHash } from "node:crypto"
-
 import { getGitHubCopilotQuota } from "./copilotQuota"
 import {
 	QuotaHttpError,
@@ -554,19 +552,16 @@ export async function loadProfiles(source: ProfileSource): Promise<ProviderSetti
 	return profiles.filter((p): p is ProviderSettings => !!p)
 }
 
-// Successful results only, per provider and per credential set. A missing key, a
-// sign-out or a transient error is never pinned, so fixing it shows up on the
-// next open instead of after the TTL.
-const cache = new Map<string, { at: number; result: ProviderQuota }>()
-const inflight = new Map<string, Promise<ProviderQuota>>()
-
-/** Identifies the key and URLs a result was fetched with, without keeping the key itself. */
-function fingerprint(provider: KeyedProvider, creds: KeyedCredentials): string {
-	const digest = createHash("sha256")
-		.update(`${creds.apiKey}\n${(creds.urls ?? []).join("\n")}`)
-		.digest("hex")
-		.slice(0, 16)
-	return `${provider.providerId}:${digest}`
+// Successful results only, per provider and URL set. A missing key, a sign-out or a
+// transient error is never pinned, so fixing it shows up on the next open instead of
+// after the TTL. An entry is reused only for the exact key it was fetched with, so
+// switching keys refetches. The key is compared, never hashed or used in a map key.
+const cache = new Map<string, { at: number; apiKey: string; result: ProviderQuota }>()
+const inflight = new Map<string, { apiKey: string; request: Promise<ProviderQuota> }>()
+
+/** Identifies a provider and the URLs it is queried at (the credential itself is not part of it). */
+function cacheKey(provider: KeyedProvider, creds: KeyedCredentials): string {
+	return `${provider.providerId}|${(creds.urls ?? []).join(",")}`
 }
 
 function quotaForKeyedProvider(
@@ -580,21 +575,24 @@ function quotaForKeyedProvider(
 	if (skipped) return Promise.resolve(skipped)
 
 	const resolved = creds as KeyedCredentials
-	const key = fingerprint(provider, resolved)
+	const apiKey = resolved.apiKey as string
+	const key = cacheKey(provider, resolved)
 	const hit = cache.get(key)
-	if (!force && hit && Date.now() - hit.at < CACHE_TTL_MS) return Promise.resolve(hit.result)
+	if (!force && hit && hit.apiKey === apiKey && Date.now() - hit.at < CACHE_TTL_MS) return Promise.resolve(hit.result)
 
 	// Concurrent callers (e.g. a refresh while the first load is still running) share one request.
 	const pending = inflight.get(key)
-	if (pending) return pending
+	if (pending && pending.apiKey === apiKey) return pending.request
 
 	const request = fetchKeyed(provider, resolved, fetchImpl)
 		.then((result) => {
-			if (result.ok) cache.set(key, { at: Date.now(), result })
+			if (result.ok) cache.set(key, { at: Date.now(), apiKey, result })
 			return result
 		})
-		.finally(() => inflight.delete(key))
-	inflight.set(key, request)
+		.finally(() => {
+			if (inflight.get(key)?.request === request) inflight.delete(key)
+		})
+	inflight.set(key, { apiKey, request })
 	return request
 }