BerriAI/litellm · critical · ImportError

cryptography package is required for OCI authentication. Ple

Error message

cryptography package is required for OCI authentication. Please install it with: pip install cryptography

What it means

OCI request signing requires the third-party 'cryptography' package (RSA PKCS1v15/SHA256 signing); litellm makes it an optional dependency and _require_cryptography() raises ImportError with install instructions the moment a signing path is entered without it.

Source

Thrown at litellm/llms/oci/common_utils.py:35

    from cryptography.hazmat.primitives.asymmetric import padding, rsa

    _CRYPTOGRAPHY_AVAILABLE = True
except ImportError:
    _CRYPTOGRAPHY_AVAILABLE = False

try:
    from litellm._version import version as _litellm_version
except ImportError:
    _litellm_version = "0.0.0"


# OCI GenAI REST API version — stable since service launch, unlikely to change
OCI_API_VERSION: Final = "20231130"


def _require_cryptography() -> None:
    if not _CRYPTOGRAPHY_AVAILABLE:
        raise ImportError(
            "cryptography package is required for OCI authentication. Please install it with: pip install cryptography"
        )


class OCIError(BaseLLMException):
    def __init__(
        self,
        status_code: int,
        message: str,
        headers: httpx.Headers | None = None,
    ):
        super().__init__(
            status_code=status_code,
            message=message,
            headers=headers,
        )

View on GitHub (pinned to 6c2dcb801b)

Solutions

pip install cryptography (or add it to requirements.txt / pyproject dependencies).
For Docker: add it to the image explicitly, e.g. RUN pip install 'litellm[oci]' cryptography.
Verify with python -c "import cryptography; print(cryptography.__version__)".
If you cannot install it, supply a pre-built oci_signer from the OCI SDK (which bundles its own crypto) via optional_params.

Example fix

# before — ImportError at first OCI call
litellm.completion(model="oci/cohere.command-r-plus", messages=m)

# after
# shell: pip install cryptography
litellm.completion(model="oci/cohere.command-r-plus", messages=m)

Defensive patterns

Strategy: validation

Validate before calling

try:
    import cryptography  # noqa: F401
    HAS_CRYPTO = True
except ImportError:
    HAS_CRYPTO = False
assert HAS_CRYPTO, "pip install cryptography"

Try / catch

try:
    litellm.completion(model="oci/...", messages=m)
except ImportError as e:
    if "cryptography" in str(e):
        subprocess.check_call([sys.executable, "-m", "pip", "install", "cryptography"])
        raise RuntimeError("cryptography installed; restart process") from e
    raise

Prevention

Add cryptography to your dependency manifest, not relying on litellm extras.
Bake it into Docker/CI images and assert the import at build time.
Startup smoke test any OCI call before serving traffic.

When it happens

Trigger: Any OCI chat/embedding/rerank call that needs manual signing (no oci_signer provided) on an environment where 'cryptography' is not installed: slim Docker images, Lambda layers, pip --no-deps installs, or air-gapped environments.

Common situations: Docker images built with 'pip install litellm' where the extra was not pulled in; upgrading Python versions in a venv that dropped optional deps; CI environments caching only core requirements. The failure appears only at first OCI call, not at import time.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of BerriAI/litellm@6c2dcb801b (2026-08-15). Data as JSON: /api/errors/d69133e135e202f5. Report an issue: GitHub.