BerriAI/litellm · error · ValueError

CIRCLE_OIDC_TOKEN not found in environment

Error message

CIRCLE_OIDC_TOKEN not found in environment

What it means

OIDC resolution failure for the 'circleci' provider: os.getenv('CIRCLE_OIDC_TOKEN') returned None, meaning the job is not running with an OIDC token exported (missing circleci oidc token context), so the secret cannot be fetched.

Source

Thrown at litellm/secret_managers/main.py:236

            if response.status_code == 200:
                oidc_token = response.text
                ttl: Final = _oidc_token_cache_ttl(oidc_token, 3600 - 60)
                if ttl > 0:
                    oidc_cache.set_cache(key=secret_name, value=oidc_token, ttl=ttl)
                else:
                    verbose_logger.warning(
                        "Google OIDC token for %s is already expired or expires within %ss; not caching it",
                        secret_name,
                        _OIDC_TOKEN_EXPIRY_MARGIN_SECONDS,
                    )
                return oidc_token
            else:
                raise ValueError("Google OIDC provider failed")
        elif oidc_provider == "circleci":
            # https://circleci.com/docs/openid-connect-tokens/
            env_secret = os.getenv("CIRCLE_OIDC_TOKEN")
            if env_secret is None:
                raise ValueError("CIRCLE_OIDC_TOKEN not found in environment")
            return env_secret
        elif oidc_provider == "circleci_v2":
            # https://circleci.com/docs/openid-connect-tokens/
            env_secret = os.getenv("CIRCLE_OIDC_TOKEN_V2")
            if env_secret is None:
                raise ValueError("CIRCLE_OIDC_TOKEN_V2 not found in environment")
            return env_secret
        elif oidc_provider == "github":
            # https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-cloud-providers#using-custom-actions
            actions_id_token_request_url: Final = os.getenv("ACTIONS_ID_TOKEN_REQUEST_URL")
            actions_id_token_request_token: Final = os.getenv("ACTIONS_ID_TOKEN_REQUEST_TOKEN")
            if actions_id_token_request_url is None or actions_id_token_request_token is None:
                raise ValueError(
                    "ACTIONS_ID_TOKEN_REQUEST_URL or ACTIONS_ID_TOKEN_REQUEST_TOKEN not found in environment"
                )

            oidc_token = oidc_cache.get_cache(key=secret_name)
            if oidc_token is not None:

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Run inside a CircleCI job that has an OIDC token, or export CIRCLE_OIDC_TOKEN manually.

When it happens

Trigger: Thrown at litellm/secret_managers/main.py:236 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/c33f82bc7fc04088. Report an issue: GitHub.