BerriAI/litellm · error · RuntimeError

IAM_TOKEN_DB_AUTH is enabled but required DB env var(s) are

Error message

IAM_TOKEN_DB_AUTH is enabled but required DB env var(s) are unset: {', '.join(missing)}. Set them so the writer DATABASE_URL can be assembled with a minted IAM token.

What it means

Error "IAM_TOKEN_DB_AUTH is enabled but required DB env var(s) are unset: {', '.join(missing)}. Set them so the writer DATABASE_URL can be assembled with a minted IAM token." thrown in BerriAI/litellm.

Source

Thrown at litellm/proxy/db/db_url_settings.py:143

    def build_writer_url(self) -> str | None:
        """Return the writer URL to set, or ``None`` to leave it as-is.

        Raises ``RuntimeError`` (naming the offending vars) when IAM auth is
        enabled but a required field is missing — the proxy cannot recover
        from this and a clear startup error beats a Prisma connect failure.
        """
        if self.iam_token_db_auth:
            missing: Final = [
                env
                for env, val in (
                    ("DATABASE_HOST", self.database_host),
                    ("DATABASE_USER", self.database_user),
                    ("DATABASE_NAME", self.database_name),
                )
                if not val
            ]
            if missing:
                raise RuntimeError(
                    "IAM_TOKEN_DB_AUTH is enabled but required DB env var(s) "
                    f"are unset: {', '.join(missing)}. Set them so the writer "
                    "DATABASE_URL can be assembled with a minted IAM token."
                )
            host: Final = cast(str, self.database_host)
            user: Final = cast(str, self.database_user)
            name: Final = cast(str, self.database_name)
            # IAM token is already URL-quoted by generate_iam_auth_token;
            # user/name embedded raw (parity with proxy_cli.py / IAMEndpoint).
            token: Final = rds_iam_token.generate_iam_auth_token(db_host=host, db_port=self.database_port, db_user=user)
            url = f"postgresql://{user}:{token}@{host}:{self.database_port}/{name}"
            if self.database_schema:
                url += f"?schema={self.database_schema}"
            return url

        # Password auth: an operator-pinned DATABASE_URL always wins.
        if self.database_url:
            return None

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Set the listed missing DB env vars (host, port, user, database name) so the writer DATABASE_URL can be assembled.

Example fix

export DATABASE_HOST=... DATABASE_PORT=5432 DATABASE_USER=... DATABASE_NAME=...

When it happens

Trigger: Thrown at litellm/proxy/db/db_url_settings.py:143 when the library encounters an invalid state.

Common situations: IAM_TOKEN_DB_AUTH is enabled but the env vars needed to build the writer DATABASE_URL are unset.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/7bf83a1898ece993. Report an issue: GitHub.