BerriAI/litellm · error · HTTPException

Only S256 code_challenge_method is supported

Error message

Only S256 code_challenge_method is supported

What it means

Raised in the BYOK OAuth POST handler during PKCE validation when a code_challenge is accompanied by a code_challenge_method other than S256 (typically 'plain'). Plain-text PKCE is deliberately unsupported because it defeats the point of the challenge; the MCP client must use the S256 (SHA-256 hashed) method.

Source

Thrown at litellm/proxy/_experimental/mcp_server/byok_oauth_endpoints.py:727

    user_api_key_dict: UserAPIKeyAuth = Depends(_byok_session_auth),
) -> RedirectResponse:
    """
    Process the BYOK API-key form submission.

    Stores a short-lived authorization code and redirects the client back to
    redirect_uri with ?code=...&state=... query parameters.
    """
    _purge_expired_codes()

    validate_loopback_redirect_uri(redirect_uri)

    # Reject new codes if the store is at capacity (prevents memory exhaustion
    # from a burst of abandoned OAuth flows).
    if len(_byok_auth_codes) >= _AUTH_CODES_MAX_SIZE:
        raise HTTPException(status_code=503, detail="Too many pending authorization flows")

    if code_challenge_method != "S256":
        raise HTTPException(status_code=400, detail="Only S256 code_challenge_method is supported")

    # Identity comes from the authenticated session, not the OAuth client_id
    # form field (RFC 6749 §2.2: client_id identifies the client application,
    # not the user). We do bind the code to the submitted client_id so the
    # /token call must present the same value (RFC 6749 §4.1.3).
    user_id: Final = user_api_key_dict.user_id
    if not user_id:
        raise HTTPException(status_code=401, detail="login_required")

    auth_code: Final = str(uuid.uuid4())
    _byok_auth_codes[auth_code] = {
        "api_key": api_key,
        "server_id": server_id,
        "code_challenge": code_challenge,
        "redirect_uri": redirect_uri,
        # RFC 6749 §4.1.3 defense-in-depth: if the authorization request
        # declared a client_id, the token request must submit the same
        # value. Stored even though we don't pre-register clients.

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Use code_challenge_method=S256 only.

Example fix

code_challenge_method=S256

When it happens

Trigger: Thrown at litellm/proxy/_experimental/mcp_server/byok_oauth_endpoints.py:727 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/853781beadac82d0. Report an issue: GitHub.