BerriAI/litellm · error · ValueError

CyberArk secret manager is only available for premium users.

Error message

CyberArk secret manager is only available for premium users. {CommonProxyErrors.not_premium_user.value}

What it means

Licensing gate in the CyberArk secret manager constructor: after credential validation, it detects the deployment is not a premium/enterprise user, and CyberArk support is restricted to premium builds. The CommonProxyErrors.not_premium_user value appends the standard upgrade hint.

Source

Thrown at litellm/secret_managers/cyberark_secret_manager.py:56

        # Set CYBERARK_SSL_VERIFY=false to disable SSL verification
        ssl_verify_env: Final = str_to_bool(os.getenv("CYBERARK_SSL_VERIFY"))
        self.ssl_verify: bool = ssl_verify_env if ssl_verify_env is not None else True

        # Validate environment
        if not self.conjur_api_key and not (self.tls_cert_path and self.tls_key_path):
            raise ValueError(
                "Missing CyberArk credentials. Please set CYBERARK_API_KEY or both CYBERARK_CLIENT_CERT and CYBERARK_CLIENT_KEY in your environment."
            )

        litellm.secret_manager_client = self
        litellm._key_management_system = KeyManagementSystem.CYBERARK

        # Tokens expire after ~8 minutes, so we cache for 5 minutes to be safe
        _refresh_interval: Final = int(os.environ.get("CYBERARK_REFRESH_INTERVAL", "300"))
        self.cache = InMemoryCache(default_ttl=_refresh_interval)

        if premium_user is not True:
            raise ValueError(
                f"CyberArk secret manager is only available for premium users. {CommonProxyErrors.not_premium_user.value}"
            )

        if not self.ssl_verify:
            verbose_logger.warning(
                "CyberArk SSL verification is disabled. This is insecure and should only be used for testing with self-signed certificates."
            )

    def _authenticate(self) -> str:
        """
        Authenticate with CyberArk Conjur and get a session token.

        The token is a JSON object that must be base64-encoded for use in subsequent requests.

        Returns:
            str: Base64-encoded session token
        """
        # Check if we have a cached token

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Set a valid LITELLM_LICENSE (Enterprise) to enable the CyberArk secret manager.
2. Otherwise use a secret manager available in the non-premium tier.

When it happens

Trigger: Thrown at litellm/secret_managers/cyberark_secret_manager.py:56 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/1485d1f86740b529. Report an issue: GitHub.