BerriAI/litellm · error · ProxyException

token_exchange

token_exchange

Error message

Token endpoint returned invalid JSON: {json_err}

What it means

ProxyException raised when the SSO identity provider's token endpoint responds with a body that is not valid JSON (json parse threw); the parse exception text is embedded. Fires when the IdP returns an HTML error page, a non-JSON payload, or truncated body at the /token step of the OAuth code exchange.

Source

Thrown at litellm/proxy/management_endpoints/ui_sso.py:3881

        return code_verifier, code_challenge

    @staticmethod
    def _validate_token_response(response: "httpx.Response") -> dict:
        """
        Parse and validate the token endpoint response.

        Ensures the response is valid JSON, a dict, and contains a non-null
        access_token string. Raises ProxyException on any validation failure.
        """
        try:
            token_response_raw: Final[object] = _as_object(response.json())
        except Exception as json_err:
            verbose_proxy_logger.error(
                "Failed to parse token response as JSON: %s. Body: %s",
                json_err,
                response.text[:500],
            )
            raise ProxyException(
                message=f"Token endpoint returned invalid JSON: {json_err}",
                type=ProxyErrorTypes.auth_error,
                param="token_exchange",
                code=status.HTTP_401_UNAUTHORIZED,
            )

        if not isinstance(token_response_raw, dict):
            verbose_proxy_logger.error(
                "Token endpoint returned non-dict JSON (type=%s). Body: %s",
                type(token_response_raw).__name__,
                response.text[:500],
            )
            raise ProxyException(
                message=(
                    f"Token endpoint returned unexpected response format "
                    f"(expected JSON object, got {type(token_response_raw).__name__})"
                ),
                type=ProxyErrorTypes.auth_error,

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Verify the GENERIC_TOKEN_ENDPOINT returns valid JSON; check the IdP configuration and proxy logs.

When it happens

Trigger: Thrown at litellm/proxy/management_endpoints/ui_sso.py:3881 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/f05b9dec3d57f214. Report an issue: GitHub.