BerriAI/litellm · error · HTTPException

Too many pending authorization flows

Error message

Too many pending authorization flows

What it means

HTTP 503 from the BYOK code store: the in-memory pending-authorization-code store is at capacity after purging expired entries. A burst of abandoned OAuth flows is the usual cause; retrying after existing codes expire succeeds.

Source

Thrown at litellm/proxy/_experimental/mcp_server/byok_oauth_endpoints.py:724

    state: str = Form(default=""),
    server_id: str = Form(default=""),
    api_key: str = Form(...),
    user_api_key_dict: UserAPIKeyAuth = Depends(_byok_session_auth),
) -> RedirectResponse:
    """
    Process the BYOK API-key form submission.

    Stores a short-lived authorization code and redirects the client back to
    redirect_uri with ?code=...&state=... query parameters.
    """
    _purge_expired_codes()

    validate_loopback_redirect_uri(redirect_uri)

    # Reject new codes if the store is at capacity (prevents memory exhaustion
    # from a burst of abandoned OAuth flows).
    if len(_byok_auth_codes) >= _AUTH_CODES_MAX_SIZE:
        raise HTTPException(status_code=503, detail="Too many pending authorization flows")

    if code_challenge_method != "S256":
        raise HTTPException(status_code=400, detail="Only S256 code_challenge_method is supported")

    # Identity comes from the authenticated session, not the OAuth client_id
    # form field (RFC 6749 §2.2: client_id identifies the client application,
    # not the user). We do bind the code to the submitted client_id so the
    # /token call must present the same value (RFC 6749 §4.1.3).
    user_id: Final = user_api_key_dict.user_id
    if not user_id:
        raise HTTPException(status_code=401, detail="login_required")

    auth_code: Final = str(uuid.uuid4())
    _byok_auth_codes[auth_code] = {
        "api_key": api_key,
        "server_id": server_id,
        "code_challenge": code_challenge,
        "redirect_uri": redirect_uri,

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Complete or let expire existing authorization flows before starting new ones.
2. Increase the pending-flow limit if legitimate.

Example fix

Finish pending sign-ins, then retry.

When it happens

Trigger: Thrown at litellm/proxy/_experimental/mcp_server/byok_oauth_endpoints.py:724 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/bd2b3b4171ea2b90. Report an issue: GitHub.