BerriAI/litellm · error · HTTPException

Key is not in a team. Access groups cannot be assigned to pe

Error message

Key is not in a team. Access groups cannot be assigned to personal keys by non-admin callers. Disallowed access groups: {sorted(access_group_ids)}.

What it means

HTTPException(403) from the access-group assignment guard: a caller who is not a proxy admin and whose team membership is gated/non-admin tried to assign access_group_ids to a personal (teamless) key. Access groups can only be set on personal keys by proxy admins; the message lists the offending groups.

Source

Thrown at litellm/proxy/management_helpers/team_member_permission_checks.py:171

        Raises HTTPException(403) when a gated member attempts the assignment.
        """
        from fastapi import HTTPException

        from litellm.proxy.management_endpoints.key_management_endpoints import (
            _get_user_in_team,
        )

        # No-op when the request does not assign any access groups.
        if not access_group_ids:
            return

        # Proxy admins always bypass.
        if user_api_key_dict.user_role == LitellmUserRoles.PROXY_ADMIN.value:
            return

        if team_table is None:
            raise HTTPException(
                status_code=403,
                detail=(
                    "Key is not in a team. Access groups cannot be assigned to "
                    "personal keys by non-admin callers. Disallowed access groups: "
                    f"{sorted(access_group_ids)}."
                ),
            )

        team_member_object: Final = _get_user_in_team(team_table=team_table, user_id=user_api_key_dict.user_id)

        # Team admins always bypass (consistent with other member-permission checks).
        if team_member_object is not None and team_member_object.role == "admin":
            return

        permissions: Final = (
            TeamMemberPermissionChecks._get_list_of_route_enum_as_str(
                TeamMemberPermissionChecks.get_permissions_for_team_member(
                    team_member_object=team_member_object,

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Assign the key to a team first, remove the requested access groups, or call as a proxy admin.

When it happens

Trigger: Thrown at litellm/proxy/management_helpers/team_member_permission_checks.py:171 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/365b842284cad3f3. Report an issue: GitHub.