BerriAI/litellm · error · ProxyException

GENERIC_CLIENT_ID must be set when PKCE is enabled

Error message

GENERIC_CLIENT_ID must be set when PKCE is enabled

What it means

Error "GENERIC_CLIENT_ID must be set when PKCE is enabled" thrown in BerriAI/litellm.

Source

Thrown at litellm/proxy/management_endpoints/ui_sso.py:1608

            # code (Login-CSRF / token theft).
            url_state: Final = request.query_params.get("state")
            cookie_state: Final = request.cookies.get("litellm_oauth_state")
            if not url_state or not cookie_state or not secrets.compare_digest(url_state, cookie_state):
                raise ProxyException(
                    message=("Invalid OAuth state parameter — does not match the browser-bound state cookie."),
                    type=ProxyErrorTypes.auth_error,
                    param="state",
                    code=status.HTTP_400_BAD_REQUEST,
                )
            if not authorization_code:
                raise ProxyException(
                    message="Missing authorization code in callback",
                    type=ProxyErrorTypes.auth_error,
                    param="code",
                    code=status.HTTP_400_BAD_REQUEST,
                )
            if not generic_client_id:
                raise ProxyException(
                    message="GENERIC_CLIENT_ID must be set when PKCE is enabled",
                    type=ProxyErrorTypes.auth_error,
                    param="GENERIC_CLIENT_ID",
                    code=status.HTTP_401_UNAUTHORIZED,
                )
            if not generic_token_endpoint:
                raise ProxyException(
                    message="GENERIC_TOKEN_ENDPOINT must be set when PKCE is enabled",
                    type=ProxyErrorTypes.auth_error,
                    param="GENERIC_TOKEN_ENDPOINT",
                    code=status.HTTP_401_UNAUTHORIZED,
                )
            # All guards above raise, so authorization_code is a non-empty str here.
            # Use an explicit type guard rather than assert (assert is a no-op with -O).
            if not isinstance(authorization_code, str):
                raise ProxyException(
                    message="Missing authorization code in callback",
                    type=ProxyErrorTypes.auth_error,

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Set GENERIC_CLIENT_ID in the environment when PKCE is enabled, then restart.

When it happens

Trigger: Thrown at litellm/proxy/management_endpoints/ui_sso.py:1608 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/f5f3aa74a6b15d26. Report an issue: GitHub.