BerriAI/litellm · error · HTTPException

Key requests MCP access groups not allowed by team '{team_id

Error message

Key requests MCP access groups not allowed by team '{team_id}': {sorted(disallowed_groups)}. Team allows: {sorted(team_access_groups)}.

What it means

HTTPException(403) from key-vs-team MCP access-group validation: the key creation/update request asks for MCP access groups that are not in the creating team's allowlist (and the caller is not a teamless-admin assignment). The message lists the disallowed groups and the team's allowed set.

Source

Thrown at litellm/proxy/management_helpers/object_permission_utils.py:637

        allowed_access_groups = team_access_groups
        if teamless_admin_assignment:
            allowed_access_groups = team_access_groups | requested_access_groups

        disallowed_groups: Final = requested_access_groups - allowed_access_groups
        if disallowed_groups:
            if team_obj is not None:
                team_id = team_obj.team_id
                detail = (
                    f"Key requests MCP access groups not allowed by team '{team_id}': "
                    f"{sorted(disallowed_groups)}. "
                    f"Team allows: {sorted(team_access_groups)}."
                )
            else:
                detail = (
                    f"Key is not in a team. MCP access groups cannot be assigned to "
                    f"keys outside of a team. Disallowed groups: {sorted(disallowed_groups)}."
                )
            raise HTTPException(
                status_code=status.HTTP_403_FORBIDDEN,
                detail={"error": detail},
            )

    _validate_requested_toolsets(
        requested_toolsets=requested_toolsets,
        team_obj=team_obj,
        is_proxy_admin=is_proxy_admin,
    )

    return object_permission


def _validate_requested_toolsets(
    requested_toolsets: set[str],
    team_obj: Optional["LiteLLM_TeamTableCachedObj"],
    is_proxy_admin: bool,
) -> None:

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Remove the disallowed MCP access groups from the key request, or ask an admin to allow them for the team.

When it happens

Trigger: Thrown at litellm/proxy/management_helpers/object_permission_utils.py:637 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/7b2cb66853275a38. Report an issue: GitHub.