BerriAI/litellm · error · ValueError

oidc/file path must be absolute. Use the format 'oidc/file//

Error message

oidc/file path must be absolute. Use the format 'oidc/file//var/run/secrets/<name>' (note the leading slash after 'oidc/file/').

What it means

Path validation in _resolve_oidc_file_path: the requested oidc/file path is relative. The loader requires an absolute path (with the double slash after 'oidc/file/') so it can safely resolve and allowlist-check the credential file.

Source

Thrown at litellm/secret_managers/main.py:76

    override via the ``LITELLM_OIDC_ALLOWED_CREDENTIAL_DIRS`` environment
    variable (comma-separated list of absolute paths).
    """
    override: Final = os.getenv("LITELLM_OIDC_ALLOWED_CREDENTIAL_DIRS")
    raw_dirs: Final = (
        [d.strip() for d in override.split(",") if d.strip()]
        if override
        else list(_DEFAULT_OIDC_ALLOWED_CREDENTIAL_DIRS)
    )
    return [os.path.realpath(d) for d in raw_dirs]


def _resolve_oidc_file_path(requested_path: str) -> str:
    """
    Resolve ``requested_path`` and verify it falls within one of the allowed
    credential directories. Raises ``ValueError`` otherwise.
    """
    if not os.path.isabs(requested_path):
        raise ValueError(
            "oidc/file path must be absolute. Use the format "
            "'oidc/file//var/run/secrets/<name>' (note the leading slash "
            "after 'oidc/file/')."
        )
    resolved: Final = os.path.realpath(requested_path)
    for allowed in _get_oidc_allowed_credential_dirs():
        try:
            if os.path.commonpath([resolved, allowed]) == allowed:
                return resolved
        except ValueError:
            # commonpath raises when paths are on different drives (Windows);
            # treat as not-matching and continue.
            continue
    raise ValueError(
        "oidc/file path is outside the allowed credential directories. "
        "Set LITELLM_OIDC_ALLOWED_CREDENTIAL_DIRS to extend the allowlist."
    )

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Use an absolute path after the scheme: 'oidc/file//var/run/secrets/token' (double slash before the absolute path).

When it happens

Trigger: Thrown at litellm/secret_managers/main.py:76 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/bf7c0259b001fffb. Report an issue: GitHub.