BerriAI/litellm · error · ProxyException

MICROSOFT_CLIENT_SECRET

MICROSOFT_CLIENT_SECRET

Error message

MICROSOFT_CLIENT_SECRET not set. Set it in .env file

What it means

ProxyException raised in the Microsoft SSO callback: the MICROSOFT_CLIENT_SECRET environment variable is not set, so the OAuth code exchange with Microsoft cannot be signed. It is a proxy configuration error — the admin must add the secret to .env before Microsoft login can work.

Source

Thrown at litellm/proxy/management_endpoints/ui_sso.py:4204

        return f"{MicrosoftSSOHandler.get_graph_api_base_url()}/me/memberOf"

    @staticmethod
    async def get_microsoft_callback_response(
        request: Request,
        microsoft_client_id: str,
        redirect_url: str,
        return_raw_sso_response: bool = False,
    ) -> CustomOpenID | OpenID | dict:
        """
        Get the Microsoft SSO callback response

        Args:
            return_raw_sso_response: If True, return the raw SSO response
        """
        microsoft_client_secret: Final = os.getenv("MICROSOFT_CLIENT_SECRET", None)
        microsoft_tenant: Final = os.getenv("MICROSOFT_TENANT", None)
        if microsoft_client_secret is None:
            raise ProxyException(
                message="MICROSOFT_CLIENT_SECRET not set. Set it in .env file",
                type=ProxyErrorTypes.auth_error,
                param="MICROSOFT_CLIENT_SECRET",
                code=status.HTTP_500_INTERNAL_SERVER_ERROR,
            )
        if microsoft_tenant is None:
            raise ProxyException(
                message="MICROSOFT_TENANT not set. Set it in .env file",
                type=ProxyErrorTypes.auth_error,
                param="MICROSOFT_TENANT",
                code=status.HTTP_500_INTERNAL_SERVER_ERROR,
            )
        microsoft_sso: Final = CustomMicrosoftSSO(
            client_id=microsoft_client_id,
            client_secret=microsoft_client_secret,
            tenant=microsoft_tenant,
            redirect_uri=redirect_url,
            allow_insecure_http=True,

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Set MICROSOFT_CLIENT_SECRET in the .env file and restart the proxy.

When it happens

Trigger: Thrown at litellm/proxy/management_endpoints/ui_sso.py:4204 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/ef60ce42010f0579. Report an issue: GitHub.