BerriAI/litellm · error · ValueError

JWT issuer {self.issuer} cannot set audience and disable_aud

Error message

JWT issuer {self.issuer} cannot set audience and disable_audience_validation=True together

What it means

Model validator on JWTIssuerConfig: the issuer sets an audience while also disabling audience validation — a contradictory configuration that would silently weaken validation, so it is rejected at load time.

Source

Thrown at litellm/proxy/_types.py:4461

        description="Issuer-specific claim path to normalize into LiteLLM's organization id.",
    )
    end_user_id_jwt_field: str | None = Field(
        default=None,
        description="Issuer-specific claim path to normalize into LiteLLM's end-user id.",
    )

    model_config = {
        "extra": "forbid",
    }

    @model_validator(mode="after")
    def validate_audience_configured(self) -> "JWTIssuerConfig":
        if self.audience is None and not self.disable_audience_validation:
            raise ValueError(
                f"JWT issuer {self.issuer} must configure audience or set disable_audience_validation=True"
            )
        if self.audience is not None and self.disable_audience_validation:
            raise ValueError(
                f"JWT issuer {self.issuer} cannot set audience and disable_audience_validation=True together"
            )
        return self


class LiteLLM_JWTAuth(LiteLLMPydanticObjectBase):
    """
    A class to define the roles and permissions for a LiteLLM Proxy w/ JWT Auth.

    Attributes:
    - admin_jwt_scope: The JWT scope required for proxy admin roles.
    - admin_allowed_routes: list of allowed routes for proxy admin roles.
    - team_jwt_scope: The JWT scope required for proxy team roles.
    - team_id_jwt_field: The field in the JWT token that stores the team ID. Default - `client_id`.
    - team_allowed_routes: list of allowed routes for proxy team roles.
    - user_id_jwt_field: The field in the JWT token that stores the user id (maps to `LiteLLMUserTable`). Use this for internal employees.
    - user_email_jwt_field: The field in the JWT token that stores the user email (maps to `LiteLLMUserTable`). Use this for internal employees.
    - user_allowed_email_subdomain: If specified, only emails from specified subdomain will be allowed to access proxy.

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Set either audience or disable_audience_validation=True, not both.

Example fix

Remove audience when disable_audience_validation=True.

When it happens

Trigger: Thrown at litellm/proxy/_types.py:4461 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/e4515b97a3ff0be5. Report an issue: GitHub.