BerriAI/litellm · error · HTTPException

Personal key creation has been restricted by admin. Allowed

Error message

Personal key creation has been restricted by admin. Allowed roles={personal_key_generation['allowed_user_roles']}. Your role={user_api_key_dict.user_role}

What it means

Error "Personal key creation has been restricted by admin. Allowed roles={personal_key_generation['allowed_user_roles']}. Your role={user_api_key_dict.user_role}" thrown in BerriAI/litellm.

Source

Thrown at litellm/proxy/management_endpoints/key_management_endpoints.py:444

    # the team has enabled KEY_ACCESS_GROUP_ASSIGNMENT.
    TeamMemberPermissionChecks.enforce_member_can_assign_access_groups(
        user_api_key_dict=user_api_key_dict,
        team_table=team_table,
        access_group_ids=data.access_group_ids,
    )

    return True


def _personal_key_membership_check(
    user_api_key_dict: UserAPIKeyAuth,
    personal_key_generation: PersonalUIKeyGenerationConfig | None,
):
    if personal_key_generation is None or "allowed_user_roles" not in personal_key_generation:
        return True

    if user_api_key_dict.user_role not in personal_key_generation["allowed_user_roles"]:
        raise HTTPException(
            status_code=400,
            detail=f"Personal key creation has been restricted by admin. Allowed roles={personal_key_generation['allowed_user_roles']}. Your role={user_api_key_dict.user_role}",
        )

    return True


def _object_permission_to_dict(
    object_permission: LiteLLM_ObjectPermissionBase | None,
) -> ObjectPermissionDict | None:
    if object_permission is None:
        return None
    return cast(ObjectPermissionDict, object_permission.model_dump(exclude_unset=True))


def _personal_key_generation_check(user_api_key_dict: UserAPIKeyAuth, data: GenerateKeyRequest):
    TeamMemberPermissionChecks.enforce_member_can_assign_access_groups(
        user_api_key_dict=user_api_key_dict,

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Ask the proxy admin to add your role to personal_key_generation.allowed_user_roles.
2. Have a user with an allowed role create the key for you.

When it happens

Trigger: Thrown at litellm/proxy/management_endpoints/key_management_endpoints.py:444 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/5083feb469959325. Report an issue: GitHub.