BerriAI/litellm · error · ValueError

Token is not active

Error message

Token is not active

What it means

Raised in the OAuth2 token introspection path after a successful request to the token-info/userinfo endpoint when the response indicates the presented token is not active (e.g. introspection body has active=false, or the handler's post-processing deemed it invalid). It is the expected failure for expired or revoked upstream tokens and surfaces as an auth rejection to the caller.

Source

Thrown at litellm/proxy/auth/oauth2_check.py:192

                verbose_proxy_logger.debug("Using generic token info endpoint (GET)")
                headers = Oauth2Handler._prepare_token_info_request(token=token)
                response = await client.get(token_info_endpoint, headers=headers)

            # if it's a bad token we expect it to raise an HTTPStatusError
            response.raise_for_status()

            # If we get here, the request was successful
            data = response.json()

            verbose_proxy_logger.debug(
                "Oauth2 token validation for token=%s, response from endpoint=%s",
                token,
                data,
            )

            # For introspection endpoints, check if token is active
            if is_introspection_endpoint and not data.get("active", True):
                raise ValueError("Token is not active")

            # Extract user information from response
            user_id, user_role, user_team_id = Oauth2Handler._extract_user_info(
                response_data=data,
                user_id_field_name=user_id_field_name,
                user_role_field_name=user_role_field_name,
                user_team_id_field_name=user_team_id_field_name,
            )

            return UserAPIKeyAuth(
                api_key=token,
                team_id=user_team_id,
                user_id=user_id,
                user_role=cast(LitellmUserRoles, user_role),
            )
        except httpx.HTTPStatusError as e:
            # This will catch any 4xx or 5xx errors
            raise ValueError(f"Oauth 2.0 Token validation failed: {e}")

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Obtain a fresh, active token from your identity provider.
2. Check that the token has not expired or been revoked at the introspection endpoint.

Example fix

Re-authenticate with your IdP and retry with the new access token.

When it happens

Trigger: Thrown at litellm/proxy/auth/oauth2_check.py:192 when the library encounters an invalid state.

Common situations: The introspected OAuth2 token is expired, revoked, or was never issued by the configured provider.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/18cb5f7d08b9f85b. Report an issue: GitHub.