BerriAI/litellm · error · ValueError

Failed to decrypt state parameter

Error message

Failed to decrypt state parameter

What it means

Generic decryption-failure sentinel in decode_state_hash: decrypt_value_helper returned None for the encrypted OAuth state (wrong key, tampering, or corruption), so the embedded OAuth session data cannot be recovered and the flow restarts.

Source

Thrown at litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py:191

    return encrypted_state


def decode_state_hash(encrypted_state: str) -> dict:
    """
    Decode an encrypted state to retrieve all OAuth session data.

    Args:
        encrypted_state: The encrypted string to decode

    Returns:
        A dict containing base_url, original_state, and optional PKCE parameters

    Raises:
        Exception: If decryption fails or data is malformed
    """
    decrypted_json: Final = decrypt_value_helper(encrypted_state, "oauth_state")
    if decrypted_json is None:
        raise ValueError("Failed to decrypt state parameter")

    state_data: Final = json.loads(decrypted_json)
    return state_data


_BRIDGE_AUTH_CODE_PREFIX: Final = "llm_bcode_"


class _BridgeAuthorizationCode(BaseModel):
    """The identity and upstream code the gateway seals into the authorization code it hands a DCR
    client for an interactive dcr_bridge oauth_delegate sign-in, recovered at the token endpoint."""

    model_config = ConfigDict(frozen=True)
    upstream_code: str = Field(min_length=1)
    litellm_user_id: str = Field(min_length=1)
    mcp_server_id: str = Field(min_length=1)

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Do not modify the state parameter; it must round-trip intact.
2. Check the encryption key is stable across proxy restarts.

Example fix

Pass the state value back exactly as received.

When it happens

Trigger: Thrown at litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py:191 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/d89172cf047f8186. Report an issue: GitHub.