BerriAI/litellm · error · ProxyException
Missing authorization code in callback
Error message
Missing authorization code in callback
What it means
Error "Missing authorization code in callback" thrown in BerriAI/litellm.
Source
Thrown at litellm/proxy/management_endpoints/ui_sso.py:1601
# State-to-session-cookie binding. The non-PKCE branch below
# delegates to fastapi-sso's ``verify_and_process``, which
# performs its own session-cookie check. The PKCE branch
# bypasses that helper, so we validate the URL ``state``
# against the ``litellm_oauth_state`` cookie set on the
# redirect response — without this an attacker can pre-mint
# a state + cached PKCE verifier and hijack a victim's auth
# code (Login-CSRF / token theft).
url_state: Final = request.query_params.get("state")
cookie_state: Final = request.cookies.get("litellm_oauth_state")
if not url_state or not cookie_state or not secrets.compare_digest(url_state, cookie_state):
raise ProxyException(
message=("Invalid OAuth state parameter — does not match the browser-bound state cookie."),
type=ProxyErrorTypes.auth_error,
param="state",
code=status.HTTP_400_BAD_REQUEST,
)
if not authorization_code:
raise ProxyException(
message="Missing authorization code in callback",
type=ProxyErrorTypes.auth_error,
param="code",
code=status.HTTP_400_BAD_REQUEST,
)
if not generic_client_id:
raise ProxyException(
message="GENERIC_CLIENT_ID must be set when PKCE is enabled",
type=ProxyErrorTypes.auth_error,
param="GENERIC_CLIENT_ID",
code=status.HTTP_401_UNAUTHORIZED,
)
if not generic_token_endpoint:
raise ProxyException(
message="GENERIC_TOKEN_ENDPOINT must be set when PKCE is enabled",
type=ProxyErrorTypes.auth_error,
param="GENERIC_TOKEN_ENDPOINT",
code=status.HTTP_401_UNAUTHORIZED,View on GitHub (pinned to 77b7c6c40c)
Solutions
- Restart the SSO login; ensure the identity provider redirects back with an authorization code.
When it happens
Trigger: Thrown at litellm/proxy/management_endpoints/ui_sso.py:1601 when the library encounters an invalid state.
Common situations: See trigger scenarios.
AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18).
Data as JSON: /api/errors/f4d96ef2945a3cea.
Report an issue: GitHub.