BerriAI/litellm · error · ValueError

SAP AI Core credentials are incomplete. Invalid credentials:

Error message

SAP AI Core credentials are incomplete. Invalid credentials: provide exactly one of client_secret, (cert_str & key_str), or (cert_file_path & key_file_path).

What it means

Ambiguous authentication mode for SAP AI Core: more (or fewer) than exactly one of client_secret, (cert_str & key_str), or (cert_file_path & key_file_path) was supplied, so the authenticator cannot pick a single token-request strategy.

Source

Thrown at litellm/llms/sap/credentials.py:344

        - Exactly one authentication method must be provided:
          * client_secret, OR
          * (cert_str AND key_str), OR
          * (cert_file_path AND key_file_path)
    """
    if not auth_url or not client_id or not base_url:
        raise ValueError(
            "SAP AI Core credentials not found. "
            "Please provide credentials by setting appropriate environment variables "
            "(e.g. AICORE_CLIENT_ID, AICORE_CLIENT_SECRET, etc.)"
        )

    modes: Final = [
        bool(client_secret),
        bool(cert_str) and bool(key_str),
        bool(cert_file_path) and bool(key_file_path),
    ]
    if sum(bool(m) for m in modes) != 1:
        raise ValueError(
            "SAP AI Core credentials are incomplete. "
            "Invalid credentials: provide exactly one of client_secret, "
            "(cert_str & key_str), or (cert_file_path & key_file_path)."
        )


def _request_token(
    client_id: str, auth_url: str, timeout: float, cert_pair=None, client_secret=None
) -> tuple[str, datetime]:
    data: Final = {"grant_type": "client_credentials", "client_id": client_id}
    if client_secret:
        data["client_secret"] = client_secret

    resp: httpx.Response | None = None
    try:
        if cert_pair:
            with httpx.Client(cert=cert_pair) as raw_client:
                handler = HTTPHandler(client=raw_client)

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Provide exactly one credential form: client_secret, or cert_str & key_str, or cert_file_path & key_file_path.
2. Remove the extra/mixed credential fields.

Example fix

# keep only AICORE_CLIENT_SECRET, or only the cert/key pair.

When it happens

Trigger: Triggered when SAP AI Core credentials are incomplete: provide exactly one of client_secret, cert_str & key_str, or cert_file_path & key_file_path.

Common situations: See trigger scenarios.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/566851cb2341291c. Report an issue: GitHub.