BerriAI/litellm · error · HTTPException

Multiple Authorization headers are not allowed

Error message

Multiple Authorization headers are not allowed

What it means

HTTP 400 from the duplicate-header check: the raw ASGI header list contains more than one Authorization header, which request-smuggling-style ambiguity the MCP auth path refuses to resolve by picking one.

Source

Thrown at litellm/proxy/_experimental/mcp_server/auth/user_api_key_auth_mcp.py:1360

    @staticmethod
    def _reject_duplicate_authorization(raw_headers: object) -> None:
        """Raise 400 when the raw ASGI headers carry more than one ``Authorization`` header."""
        if not isinstance(raw_headers, (list, tuple)):
            return
        count = 0
        for entry in raw_headers:
            if not isinstance(entry, (list, tuple)) or len(entry) < 1:
                continue
            name = entry[0]
            if (
                isinstance(name, (bytes, bytearray))
                and bytes(name).lower() == b"authorization"
                or isinstance(name, str)
                and name.lower() == "authorization"
            ):
                count += 1
        if count > 1:
            raise HTTPException(
                status_code=400,
                detail="Multiple Authorization headers are not allowed",
            )

    @staticmethod
    async def get_allowed_mcp_servers(
        user_api_key_auth: UserAPIKeyAuth | None = None,
        *,
        keyless_source: bool = False,
    ) -> list[str]:
        """
        Get list of allowed MCP servers for the given user/key based on permissions.

        Permission hierarchy (all rules are intersections):
        1. Get allowed servers from key permissions
        2. Get allowed servers from team permissions (key inherits from team, or
           intersection; or inherits nothing when require_key_mcp_access_defined
           is enabled, making the team a ceiling rather than a default)

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Send exactly one Authorization header; merge duplicates before sending.

Example fix

headers={'Authorization': 'Bearer '+token}  # set once

When it happens

Trigger: Thrown at litellm/proxy/_experimental/mcp_server/auth/user_api_key_auth_mcp.py:1360 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/f4503db4285be5d3. Report an issue: GitHub.