BerriAI/litellm · error · HTTPException

User not allowed to access proxy. User role={user_role}, pro

Error message

User not allowed to access proxy. User role={user_role}, proxy mode={ui_access_mode}

What it means

Error "User not allowed to access proxy. User role={user_role}, proxy mode={ui_access_mode}" thrown in BerriAI/litellm.

Source

Thrown at litellm/proxy/management_endpoints/ui_sso.py:3578

            table_name="key",
        )

        key = response["token"]
        user_id = response["user_id"]

        user_role = user_defined_values["user_role"] or LitellmUserRoles.INTERNAL_USER_VIEW_ONLY.value
        if user_id and isinstance(user_id, str):
            user_role = await check_and_update_if_proxy_admin_id(
                user_role=user_role, user_id=user_id, prisma_client=prisma_client
            )

        verbose_proxy_logger.debug("user_role: %s; ui_access_mode: %s", user_role, ui_access_mode)
        ## CHECK IF ROLE ALLOWED TO USE PROXY ##
        is_admin_only_access: Final = check_is_admin_only_access(ui_access_mode or {})
        if is_admin_only_access:
            has_access: Final = has_admin_ui_access(user_role or "")
            if not has_access:
                raise HTTPException(
                    status_code=401,
                    detail={
                        "error": f"User not allowed to access proxy. User role={user_role}, proxy mode={ui_access_mode}"
                    },
                )

        if isinstance(user_id, str) and user_id:
            await retain_sso_identity_assertion_for_ema(user_id=user_id, assertion=sso_assertion)

        disabled_non_admin_personal_key_creation: Final = get_disabled_non_admin_personal_key_creation()
        litellm_dashboard_ui = get_custom_url(request_base_url=str(request.base_url), route="ui/")

        if get_secret_bool("EXPERIMENTAL_UI_LOGIN"):
            _user_info: LiteLLM_UserTable | None = None
            if user_defined_values is not None and user_defined_values["user_id"] is not None:
                _user_info = LiteLLM_UserTable(
                    user_id=user_defined_values["user_id"],
                    user_role=user_defined_values["user_role"] or user_role,

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Use an account whose role is permitted by the proxy's ui_access_mode, or ask the admin to adjust ui_access_mode.

When it happens

Trigger: Thrown at litellm/proxy/management_endpoints/ui_sso.py:3578 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/714bb300a6e5af48. Report an issue: GitHub.