BerriAI/litellm · error · RuntimeError

Could not authenticate to Vault via AppRole: {e}

Error message

Could not authenticate to Vault via AppRole: {e}

What it means

AppRole authentication failure in the Vault client: the POST to the AppRole login endpoint (role_id + secret_id) raised an exception (network error, invalid credentials, or raise_for_status failure), so no client_token could be obtained and the token cache is never populated.

Source

Thrown at litellm/secret_managers/hashicorp_secret_manager.py:145

                    "role_id": self.approle_role_id,
                    "secret_id": self.approle_secret_id,
                },
            )
            resp.raise_for_status()

            auth_data: Final = resp.json()["auth"]
            token: Final = auth_data["client_token"]
            _lease_duration: Final = auth_data["lease_duration"]

            verbose_logger.debug(
                "Successfully obtained Vault token via AppRole auth. Lease duration: %ss", _lease_duration
            )

            # Cache the token with its lease duration
            self.cache.set_cache(key="hcp_vault_approle_token", value=token, ttl=_lease_duration)
            return token
        except Exception as e:
            raise RuntimeError(f"Could not authenticate to Vault via AppRole: {e}")

    def _auth_via_tls_cert(self) -> str:
        """
        Ref: https://developer.hashicorp.com/vault/api-docs/auth/cert

        Request:
        ```
        curl \
            --request POST \
            --cacert vault-ca.pem \
            --cert cert.pem \
            --key key.pem \
            --header "X-Vault-Namespace: mynamespace/" \
            --data '{"name": "my-cert-role"}' \
            https://127.0.0.1:8200/v1/auth/cert/login
        ```

        Response:

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Verify the AppRole role-id/secret-id are correct and not expired; inspect {e} for Vault's error.
2. Confirm the AppRole auth method is enabled at the expected mount path.

When it happens

Trigger: Thrown at litellm/secret_managers/hashicorp_secret_manager.py:145 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/21f28c9143f9fad3. Report an issue: GitHub.