BerriAI/litellm · error · GigaChatAuthError

GigaChat authentication request failed: {e}

Error message

GigaChat authentication request failed: {e}

What it means

Raised by litellm's synchronous GigaChat OAuth token request when httpx fails at the transport level (httpx.RequestError) — DNS resolution failure, connection refused, TLS handshake error, or the 30s timeout elapsing. The error is wrapped into GigaChatAuthError with status_code=500 because no HTTP response was ever received. The message embeds the underlying httpx exception text (e.g. '[Errno -2] Name or service not known' or 'timed out').

Source

Thrown at litellm/llms/gigachat/authenticator.py:179

        "RqUID": str(uuid.uuid4()),
        "Content-Type": "application/x-www-form-urlencoded",
    }
    data: Final = {"scope": scope}

    verbose_logger.debug("Requesting GigaChat access token from %s", auth_url)

    try:
        client: Final = _get_http_client()
        response: Final = client.post(auth_url, headers=headers, data=data, timeout=30)
        response.raise_for_status()
        return _parse_token_response(response)
    except httpx.HTTPStatusError as e:
        raise GigaChatAuthError(
            status_code=e.response.status_code,
            message=f"GigaChat authentication failed: {e.response.text}",
        )
    except httpx.RequestError as e:
        raise GigaChatAuthError(
            status_code=500,
            message=f"GigaChat authentication request failed: {e}",
        )


async def _request_token_async(
    credentials: str,
    scope: str,
    auth_url: str,
) -> tuple[str, int]:
    """Async version of _request_token_sync."""
    headers: Final = {
        "Authorization": f"Basic {credentials}",
        "RqUID": str(uuid.uuid4()),
        "Content-Type": "application/x-www-form-urlencoded",
    }
    data: Final = {"scope": scope}

View on GitHub (pinned to 6c2dcb801b)

Solutions

1. Verify network reachability of the auth host: curl -v https://<gigachat-auth-host>:9443 (or your custom GIGACHAT_API_BASE) from the same machine/container.
2. If behind a proxy, set HTTPS_PROXY/HTTP_PROXY env vars (httpx honors them) or configure trustme/custom CA certs if TLS interception breaks the handshake.
3. Retry the call with backoff — transient DNS/network blips and slow token endpoints commonly resolve on retry (the timeout is a fixed 30s per attempt).
4. If the endpoint is permanently slow, report/patch the hardcoded timeout=30 in litellm/llms/gigachat/authenticator.py or self-host a faster auth proxy.

Example fix

# before: assumes network is fine, fails with 'GigaChat authentication request failed'
import litellm
litellm.completion(model="gigachat/GigaChat-Pro", messages=[{"role": "user", "content": "hi"}])

# after: pre-check connectivity to the auth host before calling litellm
import socket, os
host = (os.getenv("GIGACHAT_API_BASE") or "https://ngw.devices.sberbank.ru:9443").split("//")[1].split(":")[0]
try:
    socket.getaddrinfo(host, 9443)
except socket.gaierror:
    raise RuntimeError(f"Cannot resolve GigaChat auth host {host}; check DNS/proxy/VPN")
litellm.completion(model="gigachat/GigaChat-Pro", messages=[{"role": "user", "content": "hi"}])

import os, socket, urllib.parse

auth_base = os.getenv("GIGACHAT_API_BASE", "https://ngw.devices.sberbank.ru:9443")
host = urllib.parse.urlparse(auth_base).hostname
port = urllib.parse.urlparse(auth_base).port or 443
try:
    socket.getaddrinfo(host, port)
    reachable = True
except socket.gaierror:
    reachable = False
if not reachable:
    raise RuntimeError(f"GigaChat auth host {host} unreachable; fix DNS/proxy before calling litellm")

from litellm.exceptions import AuthenticationError
import httpx

try:
    resp = litellm.completion(model="gigachat/GigaChat-Pro", messages=msgs)
except AuthenticationError as e:
    if "authentication request failed" in str(e):
        # transport-level: safe to retry with backoff
        resp = retry_with_backoff(lambda: litellm.completion(model="gigachat/GigaChat-Pro", messages=msgs), attempts=3)
    else:
        raise  # credential failures (HTTPStatusError variant) are not retryable

When it happens

Trigger: Calling completion(..., model="gigachat/...") synchronously when: the host cannot resolve/reach the GigaChat OAuth endpoint (default ngw.devices.sberbank.ru:9443), a corporate firewall blocks egress to port 9443, a proxy is required but not configured for httpx, or the auth endpoint takes longer than the hardcoded 30s timeout.

Common situations: Running litellm inside a container or CI network without access to Sberbank endpoints; GIGACHAT_API_BASE misconfigured to an unreachable host; flaky VPN; local DNS outage. Users often confuse this with bad credentials, but credential failures raise the HTTPStatusError variant (GigaChat authentication failed) instead.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• OAuth M2M token request failed: {e}
• Invalid token response: {data}
• Error from qdrant checking if /collections exist {collection
• OpenMeter logging error: {e.response.text}
• BedrockException: Timeout Error - {error_str}

AI-assisted analysis of BerriAI/litellm@6c2dcb801b (2026-08-15). Data as JSON: /api/errors/0cf74ef2fe993a66. Report an issue: GitHub.