BerriAI/litellm · error · HTTPException

This MCP server does not support BYOK credentials

Error message

This MCP server does not support BYOK credentials

What it means

Returned (400) by the store-BYOK-credential endpoint when the target MCP server was fetched successfully but does not carry the is_byok flag (checked with getattr(mcp_server, 'is_byok', False)). BYOK (bring-your-own-key) credential storage is only meaningful for servers explicitly created to accept per-user credentials, so all other servers are rejected before any credential is written.

Source

Thrown at litellm/proxy/management_endpoints/mcp_management_endpoints.py:2048

        return Response(status_code=status.HTTP_202_ACCEPTED)

    @router.post(
        "/server/{server_id}/user-credential",
        description="Store or update the calling user's API key for a BYOK MCP server",
        dependencies=[Depends(user_api_key_auth)],
        response_model=MCPUserCredentialResponse,
    )
    @management_endpoint_wrapper
    async def store_mcp_user_credential(
        server_id: str,
        payload: MCPUserCredentialRequest,
        user_api_key_dict: UserAPIKeyAuth = Depends(user_api_key_auth),
    ):
        """Store a BYOK credential for the calling user."""
        prisma_client: Final = get_prisma_client_or_throw("Database not connected. Connect a database to your proxy")
        mcp_server: Final = await _authorize_and_fetch_mcp_server(prisma_client, user_api_key_dict, server_id)
        if not getattr(mcp_server, "is_byok", False):
            raise HTTPException(
                status_code=status.HTTP_400_BAD_REQUEST,
                detail={"error": "This MCP server does not support BYOK credentials"},
            )
        user_id: Final = user_api_key_dict.user_id or ""
        if not user_id:
            raise HTTPException(
                status_code=status.HTTP_400_BAD_REQUEST,
                detail={"error": "User ID not found in token"},
            )
        if payload.save:
            await store_user_credential(prisma_client, user_id, server_id, payload.credential)
            from litellm.proxy._experimental.mcp_server.server import (
                _invalidate_byok_cred_cache,
            )

            _invalidate_byok_cred_cache(user_id, server_id)
            return MCPUserCredentialResponse(server_id=server_id, has_credential=True)
        # save=False: credential not persisted

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Check the server definition and confirm it was created as a BYOK/authenticate-enabled MCP server.
2. Re-create (or update) the server with the BYOK/authenticate option enabled, then store the user credential.
3. If shared credentials are intended, configure them on the server definition instead of per-user credential storage.

server = requests.get(f"{PROXY}/v1/mcp/server/{server_id}", headers=AUTH).json().get("mcp_server", {})
if not server.get("is_byok"):
    raise ValueError("server is not BYOK-enabled; recreate it with the authenticate/byok option")

def supports_byok(server: dict) -> bool:
    return bool(server.get("is_byok"))

try:
    store_credential(server_id, cred)
except HTTPError as e:
    if e.response.status_code == 400 and "BYOK" in e.response.text:
        raise ValueError("enable BYOK on the server definition first")
    raise

When it happens

Trigger: POST to the per-user credential store endpoint for a regular server created without the BYOK/authenticate option; UI 'add my credential' flow run against a server that uses shared server-side credentials; calling the endpoint by iterating all servers generically.

Common situations: Server created from a plain URL template (shared credentials) and later expected to support per-user keys; UI affordance shown for servers where it does not apply; env mismatch where the BYOK-enabled server exists in another environment.

Related errors

• MCP Server with id {payload.server_id} is special and cannot
• User ID not found in token
• Failed to retrieve file {file_id} from provider: {str(e)}
• max_budget cannot be negative. Received: {data.max_budget}
• soft_budget cannot be negative. Received: {data.soft_budget}

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/ac13e2146ae1109e. Report an issue: GitHub.