BerriAI/litellm · error · ValueError

Plugin session claim expired

Error message

Plugin session claim expired

What it means

Raised by verify_plugin_session_claim when Fernet decryption fails the TTL check: the plugin session claim was issued with _CLAIM_TTL_SECONDS lifetime and that window has elapsed, so the token must be re-fetched.

Source

Thrown at litellm/proxy/plugin_routes.py:173

    return _plugin_fernet(plugin_name).encrypt(json.dumps(claim).encode()).decode()


def verify_plugin_session_claim(plugin_name: str, ciphertext: str) -> dict:
    """Verify and decode a plugin session claim.

    Raises ValueError if the HMAC is invalid, the audience is wrong, or
    the claim is expired.  Returns the decoded claim dict on success.
    """
    try:
        raw: Final = _plugin_fernet(plugin_name).decrypt(ciphertext.encode(), ttl=_CLAIM_TTL_SECONDS)
        claim: Final = json.loads(raw)
    except (InvalidToken, Exception) as exc:
        raise ValueError("Invalid, tampered, or expired plugin session claim") from exc

    if claim.get("plugin") != plugin_name:
        raise ValueError("Plugin claim audience mismatch")
    if int(claim.get("exp", 0)) < int(time.time()):
        raise ValueError("Plugin session claim expired")
    return claim


# ---------------------------------------------------------------------------
# Config
# ---------------------------------------------------------------------------
def register_plugins_from_config(general_settings: dict[str, object]) -> None:
    """Replace the plugin registry from general_settings.

    Replaces (not merges) so plugins removed from config are immediately
    unreachable without requiring a process restart.
    """
    raw: Final = general_settings.get("plugins")
    entries: Final[list[object]] = raw if isinstance(raw, list) else []
    new_registry: Final = {p.name: p for p in (PluginConfig.model_validate(entry) for entry in entries)}
    _plugin_registry.clear()
    _plugin_registry.update(new_registry)

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Refresh the plugin iframe/session from the UI to mint a new, unexpired claim.

When it happens

Trigger: Thrown at litellm/proxy/plugin_routes.py:173 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/eb07b20b53f909ec. Report an issue: GitHub.