BerriAI/litellm · error · HTTPException

Setting a model access group on a wildcard model is only ava

Error message

Setting a model access group on a wildcard model is only available for LiteLLM Enterprise users.{CommonProxyErrors.not_premium_user.value}

What it means

_check_model_access_group rejects a key or request whose model list puts a model access group (e.g. 'openai-o1-group' defined under model_access_groups in the router config) on a wildcard route (a deployment whose model_name is a pattern like '*'). Combining access groups with wildcards is an Enterprise-gated feature; on non-premium (OSS) LiteLLM the check returns 403 with CommonProxyErrors.not_premium_user guidance. Premium status comes from the LITELLM_LICENSE env var validated against the enterprise token.

Source

Thrown at litellm/proxy/management_endpoints/key_management_endpoints.py:3733

        return {"key": key, "info": key_info}
    except Exception as e:
        raise handle_exception_on_proxy(e)


def _check_model_access_group(models: list[str] | None, llm_router: Router | None, premium_user: bool) -> Literal[True]:
    """
    if is_model_access_group is True + is_wildcard_route is True, check if user is a premium user

    Return True if user is a premium user, False otherwise
    """
    if models is None or llm_router is None:
        return True

    for model in models:
        if llm_router._is_model_access_group_for_wildcard_route(model_access_group=model):
            if not premium_user:
                raise HTTPException(
                    status_code=status.HTTP_403_FORBIDDEN,
                    detail={
                        "error": f"Setting a model access group on a wildcard model is only available for LiteLLM Enterprise users.{CommonProxyErrors.not_premium_user.value}"
                    },
                )

    return True


async def generate_key_helper_fn(
    request_type: Literal["user", "key"],  # identifies if this request is from /user/new or /key/generate
    duration: str | None = None,
    models: list = [],
    aliases: dict = {},
    config: dict = {},
    spend: float = 0.0,
    key_max_budget: float | None = None,  # key_max_budget is used to Budget Per key
    key_budget_duration: str | None = None,

View on GitHub (pinned to 77b7c6c40c)

Solutions

  1. Set a valid LITELLM_LICENSE (Enterprise) in the proxy environment if you have one — get a trial key from litellm.ai/enterprise#trial.
  2. If staying on OSS, stop combining model access groups with wildcard models: replace wildcards with explicit model names in the key's models list and deployment model_name.
  3. Audit config.yaml: find deployments with wildcard model_name that also appear in model_access_groups and restructure them.

Example fix

# before (config.yaml)
# model_list:
#   - model_name: "*"
#     litellm_params: {model: openai/*}
# and key request:
client.post("/key/generate", json={"models": ["my-access-group"]})

# after (OSS-compatible: explicit models)
client.post("/key/generate", json={"models": ["gpt-4o", "gpt-4o-mini"]})
Defensive patterns

Strategy: fallback

Validate before calling

def uses_access_group_with_wildcard(models: list[str] | None, access_groups: set[str]) -> bool:
    return models is not None and any(m in access_groups for m in models) and not premium_user

# guard before calling /key/generate on OSS:
if uses_access_group_with_wildcard(models, configured_access_groups):
    models = expand_access_group_to_model_names(models)

Type guard

def is_enterprise_configured() -> bool:
    return bool(os.environ.get("LITELLM_LICENSE"))

Try / catch

try:
    client.post("/key/generate", json={"models": models})
except HTTPError as e:
    if e.response.status_code == 403 and "LiteLLM Enterprise" in e.response.text:
        models = expand_access_group_to_model_names(models)  # fall back to explicit list
        client.post("/key/generate", json={"models": models})
    else:
        raise

Prevention

When it happens

Trigger: POST /key/generate with models=['*'] or a wildcard-adjacent pattern while your config defines model_access_groups on wildcard deployments; OSS deployment with no LITELLM_LICENSE using access groups together with wildcard model routing.

Common situations: Config written against Enterprise docs then deployed on OSS; license key missing/expired in the container so premium_user resolves False; wildcard deployment added later under an existing access-group config.

Related errors

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/51a8a0c1f51934ce. Report an issue: GitHub.