BerriAI/litellm · error · HTTPException

Non-admin users cannot remove the user_id from a key.

Error message

Non-admin users cannot remove the user_id from a key.

What it means

Error "Non-admin users cannot remove the user_id from a key." thrown in BerriAI/litellm.

Source

Thrown at litellm/proxy/management_endpoints/key_management_endpoints.py:617

    not. Sharing the check keeps both endpoints — and any future
    regenerate-style endpoint — consistent.
    """
    if user_api_key_dict.user_role == LitellmUserRoles.PROXY_ADMIN.value:
        return
    if data is None:
        return
    # Distinguish "user_id omitted" from "user_id explicitly set to None".
    # Both leave ``getattr(data, 'user_id', None)`` at None, but only the
    # explicit-null variant survives ``model_dump(exclude_unset=True)`` in
    # ``prepare_key_update_data`` and writes NULL to the token row —
    # detaching the key from its user and bypassing the user-row
    # role check on subsequent requests.
    fields_set: Final = getattr(data, "model_fields_set", None) or set()
    if "user_id" not in fields_set:
        return
    incoming_user_id: Final = getattr(data, "user_id", None)
    if incoming_user_id is None or incoming_user_id == "":
        raise HTTPException(
            status_code=403,
            detail="Non-admin users cannot remove the user_id from a key.",
        )
    existing_user_id: Final = getattr(existing_key_row, "user_id", None)
    if incoming_user_id != existing_user_id:
        raise HTTPException(
            status_code=403,
            detail=(
                f"Non-admin caller is not allowed to rebind the key from "
                f"user={existing_user_id} to user={incoming_user_id}"
            ),
        )


def _check_allowed_routes_caller_permission(
    allowed_routes: list | None,
    user_api_key_dict: UserAPIKeyAuth,
    *,

View on GitHub (pinned to 77b7c6c40c)

Solutions

  1. Keep the existing user_id on the key, or ask a proxy admin to remove it.
  2. Create a new key without a user_id instead of stripping it from an existing key.

When it happens

Trigger: Thrown at litellm/proxy/management_endpoints/key_management_endpoints.py:617 when the library encounters an invalid state.

Common situations: See trigger scenarios.


AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/c087f60a0811d1b8. Report an issue: GitHub.