BerriAI/litellm · critical · AuthenticationError

str(e)

Error message

str(e)

What it means

Raised in the responses transformation when get_api_key() throws GetAPIKeyError; re-wrapped as AuthenticationError with str(e) as the message. Same pass-through pattern as 1630/1632/1633, hit from the responses API path. The embedded string names the real authenticator failure (refresh exhausted, missing token in refresh response, or cache save OSError).

Source

Thrown at litellm/llms/github_copilot/responses/transformation.py:237

            input_param: Final = self._get_input_from_params(litellm_params)

            # Add X-Initiator header based on input analysis
            if input_param is not None:
                initiator: Final = self._get_initiator(input_param)
                merged_headers["X-Initiator"] = initiator
                verbose_logger.debug("GitHub Copilot Responses API: Set X-Initiator=%s", initiator)

                # Add vision header if input contains images
                if self._has_vision_input(input_param):
                    merged_headers["copilot-vision-request"] = "true"
                    verbose_logger.debug("GitHub Copilot Responses API: Enabled vision request")

            verbose_logger.debug("GitHub Copilot Responses API: Successfully configured headers for model %s", model)

            return merged_headers

        except GetAPIKeyError as e:
            raise AuthenticationError(
                model=model,
                llm_provider="github_copilot",
                message=str(e),
            )

    def get_complete_url(
        self,
        api_base: str | None,
        litellm_params: dict,
    ) -> str:
        """
        Get the complete URL for GitHub Copilot Responses API endpoint.
        """
        # Use provided api_base or fall back to authenticator's base or default
        effective_api_base = (
            api_base
            or self.authenticator.get_api_base()
            or os.getenv("GITHUB_COPILOT_API_BASE")

View on GitHub (pinned to 6c2dcb801b)

Solutions

  1. Decode str(e) to find the root failure and fix it (re-login, cache permissions, entitlement).
  2. Run the device-flow login once per host and persist the token cache volume.
  3. Add a boot-time pre-flight call (get_api_key) so auth failures crash deployment, not user requests.
  4. Upgrade litellm to keep the Copilot authenticator aligned with GitHub's current token endpoints.

Example fix

# before: responses call before OAuth done
litellm.responses(model="github_copilot/gpt-4o", input="hello")
# AuthenticationError: Failed to refresh API key after maximum retries

# after: startup gate + authenticated runtime
from litellm.llms.github_copilot.authenticator import GitHubCopilotAuthenticator
try:
    GitHubCopilotAuthenticator().get_api_key()
except Exception as e:
    raise SystemExit(f"Copilot auth not ready: {e}")
litellm.responses(model="github_copilot/gpt-4o", input="hello")
Defensive patterns

Strategy: try-catch

Validate before calling

from litellm.llms.github_copilot.authenticator import GitHubCopilotAuthenticator

try:
    GitHubCopilotAuthenticator().get_api_key()
except Exception as e:
    raise SystemExit(f"github_copilot responses API unavailable: {e}")

Try / catch

from litellm.exceptions import AuthenticationError

try:
    resp = litellm.responses(model="github_copilot/gpt-4o", input="hello")
except AuthenticationError as e:
    msg = str(e)
    if "save API key" in msg:
        fix_token_dir_permissions(); resp = litellm.responses(model="github_copilot/gpt-4o", input="hello")
    elif "missing token" in msg:
        clear_copilot_cache(); raise SystemExit("Re-run copilot login after cache clear") from e
    else:
        raise

Prevention

When it happens

Trigger: litellm.responses(model="github_copilot/...", ...) with no completed OAuth login, an expired access token that fails refresh across retries, an unwritable token cache directory, or refresh responses consistently lacking 'token'.

Common situations: New deployments skipping the interactive OAuth step; long-running services whose cached access token outlived its refresh window; containerized runs with root-owned or read-only token dirs; GitHub Copilot entitlement lapsing.

Related errors

AI-assisted analysis of BerriAI/litellm@6c2dcb801b (2026-08-15). Data as JSON: /api/errors/38abeb2eb41c1667. Report an issue: GitHub.