BerriAI/litellm · error · HTTPException

token_validation_failed

token_validation_failed

Error message

OAuth token rejected: required field '{key}' is absent

What it means

Fires inside the token-response validation loop when a rule key (top-level or dot-notation path) resolves to nothing in the IdP's token response; the admin-declared validation rule cannot be evaluated, so the token is rejected as untrusted rather than silently passing.

Source

Thrown at litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py:502

    (``"org_id": "12345"``).  Booleans are normalised to JSON-style ``"true"`` /
    ``"false"`` so admin rules written as ``{"verified": "true"}`` match upstream
    responses of ``{"verified": true}``.
    """
    for key, expected in validation_rules.items():
        actual: Any = token_response.get(key)
        # Try dot-notation traversal when top-level lookup returns None
        if actual is None and "." in key:
            obj: Any = token_response
            for part in key.split("."):
                if isinstance(obj, dict):
                    obj = obj.get(part)
                else:
                    obj = None
                    break
            actual = obj
        # Treat absent fields as a distinct failure from a mismatched value
        if actual is None:
            raise HTTPException(
                status_code=403,
                detail={
                    "error": "token_validation_failed",
                    "server_id": server_id,
                    "field": key,
                    "message": (f"OAuth token rejected: required field '{key}' is absent"),
                },
            )
        if _normalize_for_token_comparison(actual) != _normalize_for_token_comparison(expected):
            raise HTTPException(
                status_code=403,
                detail={
                    "error": "token_validation_failed",
                    "server_id": server_id,
                    "field": key,
                    "message": (f"OAuth token rejected: '{key}' = '{actual}', expected '{expected}'"),
                },
            )

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Ensure the upstream token response contains the required field (e.g. access_token, token_type).
2. Check the upstream provider's error response.

Example fix

Log the token response body and verify required keys.

When it happens

Trigger: Thrown at litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py:502 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/d02a0629b2b0d931. Report an issue: GitHub.