BerriAI/litellm · error · Exception

Only proxy admin can be used to generate, delete, update inf

Error message

Only proxy admin can be used to generate, delete, update info for new keys/users/teams. Route={route}. Your role={user_role}. Your user_id={masked_user_id}

What it means

Admin-only gate for key/user/team management routes: the caller's role is not PROXY_ADMIN (or an accepted admin tier); route, role, and a masked user_id are embedded to make audit logs useful without leaking ids.

Source

Thrown at litellm/proxy/auth/route_checks.py:224

    ) -> None:
        """
        Raise exception for routes that require proxy admin access

        Args:
            user_obj (Optional[LiteLLM_UserTable]): The user object
            route (str): The route being accessed

        Raises:
            Exception: With user role and masked user_id information
        """
        user_role = "unknown"
        user_id = "unknown"
        if user_obj is not None:
            user_role = user_obj.user_role or "unknown"
            user_id = user_obj.user_id or "unknown"

        masked_user_id: Final = RouteChecks._mask_user_id(user_id)
        raise Exception(
            f"Only proxy admin can be used to generate, delete, update info for new keys/users/teams. Route={route}. Your role={user_role}. Your user_id={masked_user_id}"
        )

    @staticmethod
    def non_proxy_admin_allowed_routes_check(
        user_obj: LiteLLM_UserTable | None,
        _user_role: LitellmUserRoles | None,
        route: str,
        request: Request,
        valid_token: UserAPIKeyAuth,
        request_data: dict,
    ):
        """
        Checks if Non Proxy Admin User is allowed to access the route
        """

        # Check user has defined custom admin routes
        RouteChecks.custom_admin_only_route_check(

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Use a proxy admin key (or the master key) for key/user/team management routes.
2. Have an admin perform the operation or grant your user the proxy admin role.

Example fix

Retry the request with Authorization: Bearer $LITELLM_MASTER_KEY.

When it happens

Trigger: Thrown at litellm/proxy/auth/route_checks.py:224 when the library encounters an invalid state.

Common situations: A non-admin user attempted to generate, delete, or update keys/users/teams.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/ea2e4ad7c5d14bc9. Report an issue: GitHub.