BerriAI/litellm · error · ValueError

Missing CyberArk credentials. Please set CYBERARK_API_KEY or

Error message

Missing CyberArk credentials. Please set CYBERARK_API_KEY or both CYBERARK_CLIENT_CERT and CYBERARK_CLIENT_KEY in your environment.

What it means

Environment validation error in CyberArkSecretManager.__init__: neither CYBERARK_API_KEY nor the cert/key pair (CYBERARK_CLIENT_CERT + CYBERARK_CLIENT_KEY) is set, so no authentication method is available for Conjur.

Source

Thrown at litellm/secret_managers/cyberark_secret_manager.py:44

        # CyberArk Conjur-specific config
        self.conjur_addr = os.getenv("CYBERARK_API_BASE", "http://127.0.0.1:8080")
        self.conjur_account = os.getenv("CYBERARK_ACCOUNT", "default")
        self.conjur_username = os.getenv("CYBERARK_USERNAME", "admin")
        self.conjur_api_key = os.getenv("CYBERARK_API_KEY", "")

        # Optional config for certificate-based auth
        self.tls_cert_path = os.getenv("CYBERARK_CLIENT_CERT", "")
        self.tls_key_path = os.getenv("CYBERARK_CLIENT_KEY", "")

        # SSL verification - can be disabled for self-signed certificates
        # Set CYBERARK_SSL_VERIFY=false to disable SSL verification
        ssl_verify_env: Final = str_to_bool(os.getenv("CYBERARK_SSL_VERIFY"))
        self.ssl_verify: bool = ssl_verify_env if ssl_verify_env is not None else True

        # Validate environment
        if not self.conjur_api_key and not (self.tls_cert_path and self.tls_key_path):
            raise ValueError(
                "Missing CyberArk credentials. Please set CYBERARK_API_KEY or both CYBERARK_CLIENT_CERT and CYBERARK_CLIENT_KEY in your environment."
            )

        litellm.secret_manager_client = self
        litellm._key_management_system = KeyManagementSystem.CYBERARK

        # Tokens expire after ~8 minutes, so we cache for 5 minutes to be safe
        _refresh_interval: Final = int(os.environ.get("CYBERARK_REFRESH_INTERVAL", "300"))
        self.cache = InMemoryCache(default_ttl=_refresh_interval)

        if premium_user is not True:
            raise ValueError(
                f"CyberArk secret manager is only available for premium users. {CommonProxyErrors.not_premium_user.value}"
            )

        if not self.ssl_verify:
            verbose_logger.warning(
                "CyberArk SSL verification is disabled. This is insecure and should only be used for testing with self-signed certificates."

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Set CYBERARK_API_KEY, or set both CYBERARK_CLIENT_CERT and CYBERARK_CLIENT_KEY for certificate auth.
2. Confirm the env vars are exported in the process environment before starting the proxy.

When it happens

Trigger: Thrown at litellm/secret_managers/cyberark_secret_manager.py:44 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/65e02dd1d95103c2. Report an issue: GitHub.