BerriAI/litellm · error · Exception

OIDC UserInfo endpoint not configured. Set 'oidc_userinfo_en

Error message

OIDC UserInfo endpoint not configured. Set 'oidc_userinfo_endpoint' in JWT auth config.

What it means

Raised at the top of get_userinfo in litellm/proxy/auth/handle_jwt.py: the OIDC UserInfo flow was triggered (the proxy wants to fetch user claims from the IdP's UserInfo endpoint) but litellm_jwtauth.oidc_userinfo_endpoint is not set in the JWT auth config. This is a configuration gap, not a runtime failure of the IdP.

Source

Thrown at litellm/proxy/auth/handle_jwt.py:744

    async def get_oidc_userinfo(self, token: str) -> dict:
        """
        Fetch user information from OIDC UserInfo endpoint.

        This follows the OpenID Connect protocol where an access token
        is sent to the identity provider's UserInfo endpoint to retrieve
        user identity information.

        Args:
            token: The access token to use for authentication

        Returns:
            dict: User information from the UserInfo endpoint

        Raises:
            Exception: If UserInfo endpoint is not configured or request fails
        """
        if not self.litellm_jwtauth.oidc_userinfo_endpoint:
            raise Exception("OIDC UserInfo endpoint not configured. Set 'oidc_userinfo_endpoint' in JWT auth config.")

        # Check cache first
        cache_key: Final = f"oidc_userinfo_{hashlib.sha256(token.encode()).hexdigest()}"
        cached_userinfo: Final = await self.user_api_key_cache.async_get_cache(cache_key)

        if cached_userinfo is not None:
            verbose_proxy_logger.debug("Returning cached OIDC UserInfo")
            return cached_userinfo

        verbose_proxy_logger.debug("Calling OIDC UserInfo endpoint: %s", self.litellm_jwtauth.oidc_userinfo_endpoint)

        try:
            # Call the UserInfo endpoint with the access token
            response: Final = await self.http_handler.get(
                url=self.litellm_jwtauth.oidc_userinfo_endpoint,
                headers={
                    "Authorization": f"Bearer {token}",
                    "Accept": "application/json",

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Add oidc_userinfo_endpoint to the litellm_jwtauth config, pointing at the IdP's UserInfo URL (the userinfo_endpoint value in the OIDC discovery document)
2. Verify the URL by calling it manually with a bearer token before wiring it in
3. If you do not need UserInfo-based identity, disable the flow that calls it (fall back to token claims) instead of configuring an endpoint

Example fix

# config.yaml - before
litellm_settings:
  litellm_jwtauth:
    jwt_public_key_url: https://idp.example.com/certs

# config.yaml - after
litellm_settings:
  litellm_jwtauth:
    jwt_public_key_url: https://idp.example.com/certs
    oidc_userinfo_endpoint: https://idp.example.com/userinfo

def validate_jwt_auth_config(config: dict) -> None:
    jwtauth = config.get("litellm_settings", {}).get("litellm_jwtauth", {})
    if jwtauth.get("oidc_userinfo_enabled") and not jwtauth.get("oidc_userinfo_endpoint"):
        raise ValueError("oidc_userinfo_endpoint is required when the UserInfo flow is enabled")

When it happens

Trigger: A JWT-authenticated request reaches a code path that calls get_userinfo (e.g. resolving user identity/roles from UserInfo instead of token claims) while the config yaml's litellm_jwtauth section has no oidc_userinfo_endpoint key.

Common situations: Enabling OIDC login or claim mapping that relies on UserInfo without adding the endpoint; copying a minimal JWT auth config sample that omits OIDC extras; assuming the endpoint is auto-discovered from the discovery document (it is not - it must be configured explicitly).

Related errors

• JWT Auth: OIDC discovery endpoint {url} returned status {res
• JWT Auth: Failed to parse OIDC discovery document at {url}:
• JWT Auth: OIDC discovery document at {url} does not contain
• Missing JWT Public Key URL from environment.
• OIDC UserInfo endpoint returned status {response.status_code

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/291466af57833b62. Report an issue: GitHub.