BerriAI/litellm · critical · AuthenticationError

CohereException - {original_exception.message}

Error message

CohereException - {original_exception.message}

What it means

LiteLLM's Cohere mapper raises AuthenticationError when the Cohere error string contains 'invalid api token' or 'No API key provided.'. Your Cohere credentials failed: the API key is absent, malformed, revoked, or from the wrong environment (trial vs production). The original provider response is attached for header-level inspection.

Source

Thrown at litellm/litellm_core_utils/exception_mapping_utils.py:1334

            message=f"Cloudflare Exception - {original_exception.message}",
            llm_provider="cloudflare",
            model=model,
            response=getattr(original_exception, "response", None),
        )


def _map_cohere_exception(
    *,
    model: str,
    original_exception: _ProviderHTTPException,
    custom_llm_provider: str,
    error_str: str,
    exception_type: str,
    exception_provider: str,
    extra_information: str,
) -> None:
    if "invalid api token" in error_str or "No API key provided." in error_str:
        raise AuthenticationError(
            message=f"CohereException - {original_exception.message}",
            llm_provider="cohere",
            model=model,
            response=getattr(original_exception, "response", None),
        )
    elif "invalid type: parameter" in error_str:
        raise BadRequestError(
            message=f"CohereException - {original_exception.message}",
            llm_provider="cohere",
            model=model,
            response=getattr(original_exception, "response", None),
        )
    elif "too many tokens" in error_str:
        raise ContextWindowExceededError(
            message=f"CohereException - {original_exception.message}",
            model=model,
            llm_provider="cohere",
            response=getattr(original_exception, "response", None),

View on GitHub (pinned to 6c2dcb801b)

Solutions

  1. Set a valid key: export COHERE_API_KEY=... or pass api_key explicitly; verify it has no whitespace/quotes
  2. Regenerate the key in the Cohere dashboard (API keys section) if revoked or unclear
  3. Match the key to the endpoint: production keys for the standard API, correct credentials for private/enterprise api_base
  4. Confirm the key's environment label (trial vs production) matches where you send traffic

Example fix

# before
resp = completion(model="command-r-plus", messages=[...])
# CohereException - No API key provided.

# after
import os
from litellm import completion
resp = completion(
    model="command-r-plus",
    messages=[...],
    api_key=os.environ["COHERE_API_KEY"].strip(),
)
Defensive patterns

Strategy: validation

Validate before calling

import os

def cohere_key_ok() -> bool:
    key = (os.environ.get("COHERE_API_KEY") or "").strip()
    return len(key) >= 20 and not key.startswith(("Bearer", " "))

assert cohere_key_ok(), "COHERE_API_KEY missing/invalid — set a dashboard-issued key"

Try / catch

import litellm

try:
    resp = litellm.completion(model="command-r-plus", messages=msgs)
except litellm.AuthenticationError as e:
    if "invalid api token" in str(e) or "No API key provided" in str(e):
        raise PermissionError("Cohere credential missing/revoked — rotate COHERE_API_KEY") from e
    raise

Prevention

When it happens

Trigger: Calling completion(model='command-r-plus', api_key=...) with a missing/None API key (COHERE_API_KEY unset), a key copied with extra characters, a revoked key, or using a Cohere platform key against an enterprise/private endpoint (and vice versa).

Common situations: COHERE_API_KEY not exported in the deployment environment; key rotated in the Cohere dashboard but stale in env/secrets; mixing up Cohere's trial and production keys which hit different rate pools; pointing api_base at a private-link deployment while sending a public-platform key.

Related errors

AI-assisted analysis of BerriAI/litellm@6c2dcb801b (2026-08-15). Data as JSON: /api/errors/e3f3159332a52b35. Report an issue: GitHub.