BerriAI/litellm · error · HTTPException

Only proxy admins can set `allowed_routes` on a key. Use `ke

Error message

Only proxy admins can set `allowed_routes` on a key. Use `key_type` to pick a preset route bucket instead.

What it means

Error "Only proxy admins can set `allowed_routes` on a key. Use `key_type` to pick a preset route bucket instead." thrown in BerriAI/litellm.

Source

Thrown at litellm/proxy/management_endpoints/key_management_endpoints.py:664

    one that sends any explicit value.

    Post-`handle_key_type` call sites pass `allow_safe_presets=True` with the
    values derived by `handle_key_type`; those values are not from the request
    body, so `allowed_routes_was_provided` stays False and the safe-preset
    carve-out below accepts any list of tokens in
    `_NON_ADMIN_SAFE_ALLOWED_ROUTES_PRESETS`.
    """
    if not allowed_routes_was_provided and not allowed_routes:
        return
    if user_api_key_dict.user_role == LitellmUserRoles.PROXY_ADMIN.value:
        return
    if (
        allow_safe_presets
        and allowed_routes
        and all(r in _NON_ADMIN_SAFE_ALLOWED_ROUTES_PRESETS for r in allowed_routes)
    ):
        return
    raise HTTPException(
        status_code=403,
        detail={
            "error": (
                "Only proxy admins can set `allowed_routes` on a key. "
                "Use `key_type` to pick a preset route bucket instead."
            )
        },
    )


def _check_permissions_caller_permission(
    data: GenerateRequestBase,
    user_api_key_dict: UserAPIKeyAuth,
) -> None:
    """
    Require PROXY_ADMIN when `permissions` is present in the request body.

    Presence is detected via `data.model_fields_set` so a caller that

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Use the key_type parameter to select a preset route bucket instead of allowed_routes.
2. Ask a proxy admin to set allowed_routes on the key.

When it happens

Trigger: Thrown at litellm/proxy/management_endpoints/key_management_endpoints.py:664 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/59cb2b538e59c704. Report an issue: GitHub.