BerriAI/litellm · error · ValueError

CIRCLE_OIDC_TOKEN_V2 not found in environment

Error message

CIRCLE_OIDC_TOKEN_V2 not found in environment

What it means

OIDC resolution failure for the 'circleci' provider (v2 path): the CIRCLE_OIDC_TOKEN_V2 environment variable is absent, so the newer CircleCI OIDC token format cannot be read and the secret lookup fails.

Source

Thrown at litellm/secret_managers/main.py:242

                    verbose_logger.warning(
                        "Google OIDC token for %s is already expired or expires within %ss; not caching it",
                        secret_name,
                        _OIDC_TOKEN_EXPIRY_MARGIN_SECONDS,
                    )
                return oidc_token
            else:
                raise ValueError("Google OIDC provider failed")
        elif oidc_provider == "circleci":
            # https://circleci.com/docs/openid-connect-tokens/
            env_secret = os.getenv("CIRCLE_OIDC_TOKEN")
            if env_secret is None:
                raise ValueError("CIRCLE_OIDC_TOKEN not found in environment")
            return env_secret
        elif oidc_provider == "circleci_v2":
            # https://circleci.com/docs/openid-connect-tokens/
            env_secret = os.getenv("CIRCLE_OIDC_TOKEN_V2")
            if env_secret is None:
                raise ValueError("CIRCLE_OIDC_TOKEN_V2 not found in environment")
            return env_secret
        elif oidc_provider == "github":
            # https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-cloud-providers#using-custom-actions
            actions_id_token_request_url: Final = os.getenv("ACTIONS_ID_TOKEN_REQUEST_URL")
            actions_id_token_request_token: Final = os.getenv("ACTIONS_ID_TOKEN_REQUEST_TOKEN")
            if actions_id_token_request_url is None or actions_id_token_request_token is None:
                raise ValueError(
                    "ACTIONS_ID_TOKEN_REQUEST_URL or ACTIONS_ID_TOKEN_REQUEST_TOKEN not found in environment"
                )

            oidc_token = oidc_cache.get_cache(key=secret_name)
            if oidc_token is not None:
                return oidc_token

            oidc_client = _get_oidc_http_handler()
            response = oidc_client.get(
                actions_id_token_request_url,
                params={"audience": oidc_aud},

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Run inside CircleCI with OIDC v2 enabled, or export CIRCLE_OIDC_TOKEN_V2 before starting.

When it happens

Trigger: Thrown at litellm/secret_managers/main.py:242 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/755eeb598f2e6e07. Report an issue: GitHub.