BerriAI/litellm · error · ValueError

Missing Vault authentication credentials. Please set either:

Error message

Missing Vault authentication credentials. Please set either:
  - HCP_VAULT_TOKEN for token-based auth, or
  - HCP_VAULT_APPROLE_ROLE_ID and HCP_VAULT_APPROLE_SECRET_ID for AppRole auth, or
  - HCP_VAULT_CLIENT_CERT and HCP_VAULT_CLIENT_KEY for TLS certificate auth

What it means

Error "Missing Vault authentication credentials. Please set either: - HCP_VAULT_TOKEN for token-based auth, or - HCP_VAULT_APPROLE_ROLE_ID and HCP_VAULT_APPROLE_SECRET_ID for AppRole auth, or - HCP_VAULT_CLIENT_CERT and HCP_VAULT_CLIENT_KEY for TLS certificate auth" thrown in BerriAI/litellm.

Source

Thrown at litellm/secret_managers/hashicorp_secret_manager.py:70

        litellm.secret_manager_client = self
        litellm._key_management_system = KeyManagementSystem.HASHICORP_VAULT
        _refresh_interval = os.environ.get("HCP_VAULT_REFRESH_INTERVAL", SECRET_MANAGER_REFRESH_INTERVAL)
        _refresh_interval = int(_refresh_interval) if _refresh_interval else SECRET_MANAGER_REFRESH_INTERVAL
        self.cache = InMemoryCache(default_ttl=_refresh_interval)  # store in memory for 1 day

    def _verify_required_credentials_exist(self) -> None:
        """
        Validate that at least one authentication method is configured.

        Raises:
            ValueError: If no valid authentication credentials are provided
        """
        has_token: Final = bool(self.vault_token)
        has_approle: Final = bool(self.approle_role_id and self.approle_secret_id)
        has_tls_cert: Final = bool(self.tls_cert_path and self.tls_key_path)

        if not has_token and not has_approle and not has_tls_cert:
            raise ValueError(
                "Missing Vault authentication credentials. Please set either:\n"
                "  - HCP_VAULT_TOKEN for token-based auth, or\n"
                "  - HCP_VAULT_APPROLE_ROLE_ID and HCP_VAULT_APPROLE_SECRET_ID for AppRole auth, or\n"
                "  - HCP_VAULT_CLIENT_CERT and HCP_VAULT_CLIENT_KEY for TLS certificate auth"
            )

    def _auth_via_approle(self) -> str:
        """
        Authenticate to Vault using AppRole auth method.
        
        Ref: https://developer.hashicorp.com/vault/api-docs/auth/approle

        Request:
        ```
        curl \
            --request POST \
            --header "X-Vault-Namespace: mynamespace/" \
            --data '{"role_id": "...", "secret_id": "..."}' \

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Set HCP_VAULT_TOKEN for token auth, or HCP_VAULT_APPROLE_ROLE_ID + HCP_VAULT_APPROLE_SECRET_ID for AppRole, or HCP_VAULT_CLIENT_CERT + HCP_VAULT_CLIENT_KEY for TLS auth.
2. Ensure HCP_VAULT_ADDR/NAMESPACE are also set correctly for your Vault cluster.

When it happens

Trigger: Thrown at litellm/secret_managers/hashicorp_secret_manager.py:70 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.
• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/4573ac2badbbb101. Report an issue: GitHub.