BerriAI/litellm · error · ValueError

JWT issuer {self.issuer} must configure audience or set disa

Error message

JWT issuer {self.issuer} must configure audience or set disable_audience_validation=True

What it means

JWTIssuerConfig post-validator: an issuer entry that neither pins an audience nor explicitly disables audience validation would make token verification ambiguous, so the config is rejected. extra=forbid keeps issuer blocks strict.

Source

Thrown at litellm/proxy/_types.py:4457

        description="Issuer-specific claim path to normalize into LiteLLM's team ids.",
    )
    org_id_jwt_field: str | None = Field(
        default=None,
        description="Issuer-specific claim path to normalize into LiteLLM's organization id.",
    )
    end_user_id_jwt_field: str | None = Field(
        default=None,
        description="Issuer-specific claim path to normalize into LiteLLM's end-user id.",
    )

    model_config = {
        "extra": "forbid",
    }

    @model_validator(mode="after")
    def validate_audience_configured(self) -> "JWTIssuerConfig":
        if self.audience is None and not self.disable_audience_validation:
            raise ValueError(
                f"JWT issuer {self.issuer} must configure audience or set disable_audience_validation=True"
            )
        if self.audience is not None and self.disable_audience_validation:
            raise ValueError(
                f"JWT issuer {self.issuer} cannot set audience and disable_audience_validation=True together"
            )
        return self


class LiteLLM_JWTAuth(LiteLLMPydanticObjectBase):
    """
    A class to define the roles and permissions for a LiteLLM Proxy w/ JWT Auth.

    Attributes:
    - admin_jwt_scope: The JWT scope required for proxy admin roles.
    - admin_allowed_routes: list of allowed routes for proxy admin roles.
    - team_jwt_scope: The JWT scope required for proxy team roles.
    - team_id_jwt_field: The field in the JWT token that stores the team ID. Default - `client_id`.

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Configure audience for the JWT issuer, or set disable_audience_validation=True.

Example fix

audience='my-api'

When it happens

Trigger: Thrown at litellm/proxy/_types.py:4457 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/dee6c0f6160aba62. Report an issue: GitHub.