BerriAI/litellm · error · ProxyException

GENERIC_TOKEN_ENDPOINT must be set when PKCE is enabled

Error message

GENERIC_TOKEN_ENDPOINT must be set when PKCE is enabled

What it means

Error "GENERIC_TOKEN_ENDPOINT must be set when PKCE is enabled" thrown in BerriAI/litellm.

Source

Thrown at litellm/proxy/management_endpoints/ui_sso.py:1615

                    param="state",
                    code=status.HTTP_400_BAD_REQUEST,
                )
            if not authorization_code:
                raise ProxyException(
                    message="Missing authorization code in callback",
                    type=ProxyErrorTypes.auth_error,
                    param="code",
                    code=status.HTTP_400_BAD_REQUEST,
                )
            if not generic_client_id:
                raise ProxyException(
                    message="GENERIC_CLIENT_ID must be set when PKCE is enabled",
                    type=ProxyErrorTypes.auth_error,
                    param="GENERIC_CLIENT_ID",
                    code=status.HTTP_401_UNAUTHORIZED,
                )
            if not generic_token_endpoint:
                raise ProxyException(
                    message="GENERIC_TOKEN_ENDPOINT must be set when PKCE is enabled",
                    type=ProxyErrorTypes.auth_error,
                    param="GENERIC_TOKEN_ENDPOINT",
                    code=status.HTTP_401_UNAUTHORIZED,
                )
            # All guards above raise, so authorization_code is a non-empty str here.
            # Use an explicit type guard rather than assert (assert is a no-op with -O).
            if not isinstance(authorization_code, str):
                raise ProxyException(
                    message="Missing authorization code in callback",
                    type=ProxyErrorTypes.auth_error,
                    param="code",
                    code=status.HTTP_400_BAD_REQUEST,
                )
            combined_response: Final = await SSOAuthenticationHandler._pkce_token_exchange(
                authorization_code=authorization_code,
                code_verifier=code_verifier,
                client_id=generic_client_id,

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Set GENERIC_TOKEN_ENDPOINT in the environment when PKCE is enabled, then restart.

When it happens

Trigger: Thrown at litellm/proxy/management_endpoints/ui_sso.py:1615 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/e6cb49f6cdb510a0. Report an issue: GitHub.