BerriAI/litellm · error · ValueError

Google OIDC provider failed

Error message

Google OIDC provider failed

What it means

OIDC resolution failure for the 'google' provider: the request to the GCP metadata server for a service-account identity token returned a non-200 status (metadata server unreachable or the audience rejected), so no token can be returned to the caller.

Source

Thrown at litellm/secret_managers/main.py:231

            response = oidc_client.get(
                "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity",
                params={"audience": oidc_aud},
                headers={"Metadata-Flavor": "Google"},
            )
            if response.status_code == 200:
                oidc_token = response.text
                ttl: Final = _oidc_token_cache_ttl(oidc_token, 3600 - 60)
                if ttl > 0:
                    oidc_cache.set_cache(key=secret_name, value=oidc_token, ttl=ttl)
                else:
                    verbose_logger.warning(
                        "Google OIDC token for %s is already expired or expires within %ss; not caching it",
                        secret_name,
                        _OIDC_TOKEN_EXPIRY_MARGIN_SECONDS,
                    )
                return oidc_token
            else:
                raise ValueError("Google OIDC provider failed")
        elif oidc_provider == "circleci":
            # https://circleci.com/docs/openid-connect-tokens/
            env_secret = os.getenv("CIRCLE_OIDC_TOKEN")
            if env_secret is None:
                raise ValueError("CIRCLE_OIDC_TOKEN not found in environment")
            return env_secret
        elif oidc_provider == "circleci_v2":
            # https://circleci.com/docs/openid-connect-tokens/
            env_secret = os.getenv("CIRCLE_OIDC_TOKEN_V2")
            if env_secret is None:
                raise ValueError("CIRCLE_OIDC_TOKEN_V2 not found in environment")
            return env_secret
        elif oidc_provider == "github":
            # https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-cloud-providers#using-custom-actions
            actions_id_token_request_url: Final = os.getenv("ACTIONS_ID_TOKEN_REQUEST_URL")
            actions_id_token_request_token: Final = os.getenv("ACTIONS_ID_TOKEN_REQUEST_TOKEN")
            if actions_id_token_request_url is None or actions_id_token_request_token is None:
                raise ValueError(

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Verify GOOGLE_APPLICATION_CREDENTIALS/metadata server access so google-auth can fetch an ID token.
2. Check the audience value and network access to Google token endpoints.

When it happens

Trigger: Thrown at litellm/secret_managers/main.py:231 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/e5e62d4df8749658. Report an issue: GitHub.