BerriAI/litellm · error · DatabricksException

OAuth M2M token request failed: {e}

Error message

OAuth M2M token request failed: {e}

What it means

Raised when the HTTP POST to the Databricks OAuth machine-to-machine token endpoint itself fails at the transport level (requests.RequestException: connection refused, DNS failure, TLS error, timeout after 30s). LiteLLM wraps it as DatabricksException with status_code 500 and the underlying requests error text.

Source

Thrown at litellm/llms/databricks/common_utils.py:246

        workspace_url = api_base.rstrip("/")
        if "/serving-endpoints" in workspace_url:
            workspace_url = workspace_url.replace("/serving-endpoints", "")

        token_url: Final = f"{workspace_url}/oidc/v1/token"

        try:
            response: Final = requests.post(
                token_url,
                data={
                    "grant_type": "client_credentials",
                    "scope": "all-apis",
                },
                auth=(client_id, client_secret),
                headers={"Content-Type": "application/x-www-form-urlencoded"},
                timeout=30,
            )
        except requests.RequestException as e:
            raise DatabricksException(
                status_code=500,
                message=f"OAuth M2M token request failed: {e}",
            )

        if response.status_code != 200:
            raise DatabricksException(
                status_code=response.status_code,
                message=f"OAuth M2M token request failed: {response.text}",
            )

        token_data: Final = response.json()
        return token_data["access_token"]

    def _get_databricks_credentials(
        self, api_key: str | None, api_base: str | None, headers: dict | None
    ) -> tuple[str, dict]:
        """
        Get Databricks credentials using the Databricks SDK.

View on GitHub (pinned to 6c2dcb801b)

Solutions

1. Check the underlying requests error in the message (DNS/timeouts point to network, TLS errors to proxies)
2. Verify the workspace host in api_base is reachable: curl https://<host>/oidc/v1/token
3. Configure HTTPS_PROXY/HTTP_PROXY if the environment requires an egress proxy
4. Increase robustness with a retry, but fix root network cause first

import socket, urllib.parse
host = urllib.parse.urlparse(api_base).hostname or ""
assert host and socket.gethostbyname(host), "workspace host unresolvable"

try:
    resp = litellm.completion(model=m, messages=msgs)
except Exception as e:
    if "OAuth M2M token request failed" in str(e):
        resp = backoff_retry(lambda: litellm.completion(model=m, messages=msgs), max_attempts=3)
    else:
        raise

When it happens

Trigger: OAuth M2M auth (client_id + client_secret + api_base set) and the token request to <host>/oidc/v1/token cannot connect: network egress blocked, wrong workspace host, firewall/proxy interference, or the 30s timeout exceeded.

Common situations: Containers without outbound internet/OAuth endpoint access; on-prem proxy not configured for requests (missing HTTPS_PROXY); typo in DATABRICKS_API_BASE host; DNS resolution failures in Kubernetes pods.

Related errors

• OAuth M2M token request failed: {response.text}
• GigaChat authentication request failed: {e}
• Error from qdrant checking if /collections exist {collection
• OpenMeter logging error: {e.response.text}
• {req_token.text}

AI-assisted analysis of BerriAI/litellm@6c2dcb801b (2026-08-15). Data as JSON: /api/errors/5ca8816a7877f8c9. Report an issue: GitHub.