BerriAI/litellm · error · HTTPException

Non-admin caller is not allowed to rebind the key from user=

Error message

Non-admin caller is not allowed to rebind the key from user={existing_user_id} to user={incoming_user_id}

What it means

Error "Non-admin caller is not allowed to rebind the key from user={existing_user_id} to user={incoming_user_id}" thrown in BerriAI/litellm.

Source

Thrown at litellm/proxy/management_endpoints/key_management_endpoints.py:623

        return
    # Distinguish "user_id omitted" from "user_id explicitly set to None".
    # Both leave ``getattr(data, 'user_id', None)`` at None, but only the
    # explicit-null variant survives ``model_dump(exclude_unset=True)`` in
    # ``prepare_key_update_data`` and writes NULL to the token row —
    # detaching the key from its user and bypassing the user-row
    # role check on subsequent requests.
    fields_set: Final = getattr(data, "model_fields_set", None) or set()
    if "user_id" not in fields_set:
        return
    incoming_user_id: Final = getattr(data, "user_id", None)
    if incoming_user_id is None or incoming_user_id == "":
        raise HTTPException(
            status_code=403,
            detail="Non-admin users cannot remove the user_id from a key.",
        )
    existing_user_id: Final = getattr(existing_key_row, "user_id", None)
    if incoming_user_id != existing_user_id:
        raise HTTPException(
            status_code=403,
            detail=(
                f"Non-admin caller is not allowed to rebind the key from "
                f"user={existing_user_id} to user={incoming_user_id}"
            ),
        )


def _check_allowed_routes_caller_permission(
    allowed_routes: list | None,
    user_api_key_dict: UserAPIKeyAuth,
    *,
    allowed_routes_was_provided: bool = False,
    allow_safe_presets: bool = False,
) -> None:
    """
    Require PROXY_ADMIN when `allowed_routes` is present in the request body,
    unless the caller went through the `key_type` preset flow.

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Ask a proxy admin to reassign the key to the new user.
2. Create a new key for the target user instead of rebinding an existing key.

When it happens

Trigger: Thrown at litellm/proxy/management_endpoints/key_management_endpoints.py:623 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/d797c03e1e68f7ff. Report an issue: GitHub.