BerriAI/litellm · error · HTTPException

login_required

Error message

login_required

What it means

Guard in the BYOK session-cookie check: the JWT payload was structurally valid but login_method was neither 'sso' nor 'username_password', so the token is not a legitimate UI session and the BYOK endpoint refuses it.

Source

Thrown at litellm/proxy/_experimental/mcp_server/byok_oauth_endpoints.py:130

            # require=["exp"] additionally rejects tokens that omit it.
            options={"require": ["exp"]},
        )
    except jwt.InvalidTokenError:
        return None
    if payload.get("type") == "byok_session":
        return None
    if payload.get("login_method") not in ("sso", "username_password"):
        return None
    user_id: Final = payload.get("user_id")
    return user_id if isinstance(user_id, str) and user_id else None


async def _byok_session_auth(request: Request) -> UserAPIKeyAuth:
    """Require the UI session cookie. Programmatic BYOK management uses
    ``POST /v1/mcp/server/{id}/user-credential`` instead."""
    user_id: Final = _user_id_from_session_cookie(request)
    if not user_id:
        raise HTTPException(status_code=401, detail="login_required")
    return UserAPIKeyAuth(api_key="byok_session_cookie", user_id=user_id)


def _build_authorize_html(
    server_name: str,
    server_initial: str,
    client_id: str,
    redirect_uri: str,
    code_challenge: str,
    code_challenge_method: str,
    state: str,
    server_id: str,
    access_items: list,
    help_url: str,
) -> str:
    """Build the 2-step BYOK OAuth authorization page HTML."""

    # Escape all user-supplied / externally-derived values before interpolation

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Sign in to the proxy UI/CLI first, then retry the OAuth flow.

Example fix

Complete proxy login and re-open the authorize URL.

When it happens

Trigger: Thrown at litellm/proxy/_experimental/mcp_server/byok_oauth_endpoints.py:130 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/752d7b2627771e6a. Report an issue: GitHub.