BerriAI/litellm · error · HTTPException

code_challenge is required

Error message

code_challenge is required

What it means

HTTP 400 on the BYOK authorize flow: PKCE is mandatory, and the request carried no code_challenge. Without it the issued authorization code could be intercepted and redeemed, so the flow refuses to start.

Source

Thrown at litellm/proxy/_experimental/mcp_server/byok_oauth_endpoints.py:661

    """
    Show the BYOK API-key entry form.

    The MCP client navigates the user here; the user types their API key and
    clicks "Connect & Authorize", which POSTs back to this same path.

    This GET is intentionally unauthenticated: it only renders HTML with no
    state change. The POST handler enforces ``user_api_key_auth`` and pins
    the stored credential to the authenticated session.
    """
    if response_type != "code":
        raise HTTPException(status_code=400, detail="response_type must be 'code'")
    if not redirect_uri:
        raise HTTPException(status_code=400, detail="redirect_uri is required")
    # Validate here too so the user sees the rejection before typing their
    # API key into the HTML form (the POST handler also validates).
    validate_loopback_redirect_uri(redirect_uri)
    if not code_challenge:
        raise HTTPException(status_code=400, detail="code_challenge is required")

    # Resolve server metadata (name, description items, help URL).
    server_name = "MCP Server"
    access_items: list = []
    help_url = ""
    if server_id:
        try:
            from litellm.proxy._experimental.mcp_server.mcp_server_manager import (
                global_mcp_server_manager,
            )

            registry: Final = global_mcp_server_manager.get_registry()
            if server_id in registry:
                srv: Final = registry[server_id]
                server_name = srv.server_name or srv.name
                access_items = list(srv.byok_description or [])
                help_url = srv.byok_api_key_help_url or ""
        except Exception:

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Include a PKCE code_challenge (S256) in the authorization request.

Example fix

code_challenge=base64url(sha256(verifier))&code_challenge_method=S256

When it happens

Trigger: Thrown at litellm/proxy/_experimental/mcp_server/byok_oauth_endpoints.py:661 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/5a7b5f9a87196196. Report an issue: GitHub.