BerriAI/litellm · error · AwsAuthError

Invalid web identity token reference.

Error message

Invalid web identity token reference.

What it means

Error "Invalid web identity token reference." thrown in BerriAI/litellm.

Source

Thrown at litellm/llms/bedrock/base_aws_llm.py:824

        """
        Authenticate with AWS Web Identity Token
        """
        import boto3

        verbose_logger.debug(
            "IN Web Identity Token: %s | Role Name: %s | Session Name: %s",
            aws_web_identity_token,
            aws_role_name,
            aws_session_name,
        )

        # get_secret() expands environment-variable references (an os.environ/<VAR>
        # prefix, or a bare name matching an environment variable). Config-sourced
        # references are expanded at load time, so such a reference reaching here is
        # caller-supplied input; reject it rather than expanding a process-environment
        # value for use as the token.
        if aws_web_identity_token.startswith("os.environ/") or aws_web_identity_token in os.environ:
            raise AwsAuthError(
                message="Invalid web identity token reference.",
                status_code=400,
            )

        oidc_token: Final = get_secret(aws_web_identity_token)

        if oidc_token is None:
            raise AwsAuthError(
                message="OIDC token could not be retrieved from secret manager.",
                status_code=401,
            )

        sts_client_kwargs: Final = self._build_sts_client_kwargs(
            aws_sts_endpoint=aws_sts_endpoint,
            ssl_verify=ssl_verify,
        )

        with tracer.trace("boto3.client(sts)"):

View on GitHub (pinned to 6c2dcb801b)

Solutions

1. Fix the web identity token reference (env var or file path) used for AWS authentication.

When it happens

Trigger: Thrown at litellm/llms/bedrock/base_aws_llm.py:824 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@6c2dcb801b (2026-08-15). Data as JSON: /api/errors/05b97220abff88a0. Report an issue: GitHub.