BerriAI/litellm · error · ValueError

Hashicorp secret manager is only available for premium users

Error message

Hashicorp secret manager is only available for premium users. {CommonProxyErrors.not_premium_user.value}

What it means

Licensing gate in the HashiCorp Vault secret manager constructor: after reading HCP_VAULT_* settings, it determines the deployment is not a premium/enterprise user and rejects construction, since Hashicorp secret manager support is premium-only. The CommonProxyErrors text appends the upgrade hint.

Source

Thrown at litellm/secret_managers/hashicorp_secret_manager.py:48

        # If your KV engine is mounted somewhere other than "secret", set HCP_VAULT_MOUNT_NAME
        self.vault_mount_name = os.getenv("HCP_VAULT_MOUNT_NAME", "secret")
        # Optional path prefix for secrets (e.g., "myapp" -> secret/data/myapp/{secret_name})
        self.vault_path_prefix = os.getenv("HCP_VAULT_PATH_PREFIX", None)

        # Optional config for TLS cert auth
        self.tls_cert_path = os.getenv("HCP_VAULT_CLIENT_CERT", "")
        self.tls_key_path = os.getenv("HCP_VAULT_CLIENT_KEY", "")
        self.vault_cert_role = os.getenv("HCP_VAULT_CERT_ROLE", None)

        # Optional config for AppRole auth
        self.approle_role_id = os.getenv("HCP_VAULT_APPROLE_ROLE_ID", "")
        self.approle_secret_id = os.getenv("HCP_VAULT_APPROLE_SECRET_ID", "")
        self.approle_mount_path = os.getenv("HCP_VAULT_APPROLE_MOUNT_PATH", "approle")

        self._verify_required_credentials_exist()

        if premium_user is not True:
            raise ValueError(
                f"Hashicorp secret manager is only available for premium users. {CommonProxyErrors.not_premium_user.value}"
            )

        litellm.secret_manager_client = self
        litellm._key_management_system = KeyManagementSystem.HASHICORP_VAULT
        _refresh_interval = os.environ.get("HCP_VAULT_REFRESH_INTERVAL", SECRET_MANAGER_REFRESH_INTERVAL)
        _refresh_interval = int(_refresh_interval) if _refresh_interval else SECRET_MANAGER_REFRESH_INTERVAL
        self.cache = InMemoryCache(default_ttl=_refresh_interval)  # store in memory for 1 day

    def _verify_required_credentials_exist(self) -> None:
        """
        Validate that at least one authentication method is configured.

        Raises:
            ValueError: If no valid authentication credentials are provided
        """
        has_token: Final = bool(self.vault_token)
        has_approle: Final = bool(self.approle_role_id and self.approle_secret_id)

View on GitHub (pinned to 77b7c6c40c)

Solutions

  1. Set a valid LITELLM_LICENSE (Enterprise) to enable the Hashicorp Vault secret manager.
  2. Otherwise use a non-premium secret manager backend.
Defensive patterns

Strategy: validation

When it happens

Trigger: Thrown at litellm/secret_managers/hashicorp_secret_manager.py:48 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/34ff924a44aa5bbb. Report an issue: GitHub.