BerriAI/litellm · error · ValueError

Google KMS requires the encrypted secret to be in the enviro

Error message

Google KMS requires the encrypted secret to be in the environment!

What it means

Google KMS branch guard in get_secret: the encrypted secret is expected to be read from an environment variable named after secret_name, but os.getenv returned None. The ciphertext blob was never placed in the environment.

Source

Thrown at litellm/secret_managers/secret_manager_handler.py:61

    Raises:
        ValueError: If the secret cannot be retrieved or required parameters are missing
        Exception: For other errors during secret retrieval
    """
    secret = None

    if (
        key_manager == KeyManagementSystem.AZURE_KEY_VAULT.value
        or type(client).__module__ + "." + type(client).__name__ == "azure.keyvault.secrets._client.SecretClient"
    ):  # support Azure Secret Client - from azure.keyvault.secrets import SecretClient
        secret = client.get_secret(secret_name).value

    elif (
        key_manager == KeyManagementSystem.GOOGLE_KMS.value or client.__class__.__name__ == "KeyManagementServiceClient"
    ):
        encrypted_secret: Any = os.getenv(secret_name)
        if encrypted_secret is None:
            raise ValueError("Google KMS requires the encrypted secret to be in the environment!")
        b64_flag: Final = _is_base64(encrypted_secret)
        if b64_flag is True:  # if passed in as encoded b64 string
            encrypted_secret = base64.b64decode(encrypted_secret)
            ciphertext: Final = encrypted_secret
        else:
            raise ValueError(
                "Google KMS requires the encrypted secret to be encoded in base64"
            )  # fix for this vulnerability https://huntr.com/bounties/ae623c2f-b64b-4245-9ed4-f13a0a5824ce
        response = client.decrypt(
            request={
                "name": litellm._google_kms_resource_name,
                "ciphertext": ciphertext,
            }
        )
        secret = response.plaintext.decode("utf-8")  # assumes the original value was encoded with utf-8

    elif key_manager == KeyManagementSystem.AWS_KMS.value:
        """

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Set the environment variable holding the KMS-encrypted ciphertext for the requested secret.

When it happens

Trigger: Thrown at litellm/secret_managers/secret_manager_handler.py:61 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/a86a9857c3956611. Report an issue: GitHub.