BerriAI/litellm · error · ProxyException

SSO authentication failed: {provider_name} requires PKCE (Pr

Error message

SSO authentication failed: {provider_name} requires PKCE (Proof Key for Code Exchange) but it's not enabled in your LiteLLM configuration.

SOLUTION: Add this environment variable and restart your proxy:
  GENERIC_CLIENT_USE_PKCE=true

Original error: {error_message}

What it means

Error "SSO authentication failed: {provider_name} requires PKCE (Proof Key for Code Exchange) but it's not enabled in your LiteLLM configuration. SOLUTION: Add this environment variable and restart your proxy: GENERIC_CLIENT_USE_PKCE=true Original error: {error_message}" thrown in BerriAI/litellm.

Source

Thrown at litellm/proxy/management_endpoints/ui_sso.py:1481

            generic_token_endpoint and "okta" in generic_token_endpoint.lower()
        )
        provider_name: Final = "Okta" if is_okta else "Your OAuth provider"

        detailed_message = (
            f"SSO authentication failed: {provider_name} requires PKCE (Proof Key for Code Exchange) "
            f"but it's not enabled in your LiteLLM configuration.\n\n"
            f"SOLUTION: Add this environment variable and restart your proxy:\n"
            f"  GENERIC_CLIENT_USE_PKCE=true\n\n"
        )
        if is_okta:
            detailed_message += (
                "For AWS ECS: Add the environment variable to your task definition.\n"
                "For Docker: Add -e GENERIC_CLIENT_USE_PKCE=true to your docker run command.\n"
                "For .env file: Add GENERIC_CLIENT_USE_PKCE=true to your .env file.\n\n"
            )
        detailed_message += f"Original error: {error_message}"

        raise ProxyException(
            message=detailed_message,
            type=ProxyErrorTypes.auth_error,
            param="GENERIC_CLIENT_USE_PKCE",
            code=status.HTTP_401_UNAUTHORIZED,
        )

    if isinstance(e, ProxyException):
        verbose_proxy_logger.error(
            "SSO authentication failed: %s. Passed in headers: %s",
            e,
            additional_headers,
        )
    else:
        verbose_proxy_logger.exception(
            "Error verifying and processing generic SSO: %s. Passed in headers: %s",
            e,
            additional_headers,
        )

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Set GENERIC_CLIENT_USE_PKCE=true in the environment and restart the proxy.

When it happens

Trigger: Thrown at litellm/proxy/management_endpoints/ui_sso.py:1481 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/0e198fe4214e4432. Report an issue: GitHub.