BerriAI/litellm · error · ProxyException

userinfo

userinfo

Error message

Failed to decode id_token JWT: {decode_err}

What it means

ProxyException raised during SSO login fallback: the userinfo endpoint failed, so LiteLLM attempts to decode the id_token JWT to recover identity claims, and that decode throws (malformed JWT, bad base64, wrong signing setup). The decode error text is embedded; the login cannot establish identity.

Source

Thrown at litellm/proxy/management_endpoints/ui_sso.py:4123

                verbose_proxy_logger.warning("Userinfo endpoint error: %s, falling back to id_token", e)

        # Only fall back to id_token when the userinfo request failed (None).
        # Empty dict ({}) and JSON null are both treated as failure (set to None above) since
        # they contain no identity claims — id_token fallback is attempted in that case too.
        # Explicitly check for a non-empty string to avoid attempting JWT decode on
        # a blank or non-string id_token field from a misbehaving provider.
        if userinfo is None and isinstance(id_token, str) and id_token:
            try:
                userinfo = jwt.decode(id_token, options={"verify_signature": False})
                if not userinfo:
                    # jwt.decode returned an empty dict (payload-free JWT or provider bug).
                    # Treat this the same as a missing userinfo — the session would have no
                    # identity claims, which is equivalent to a broken session.
                    verbose_proxy_logger.warning("id_token decoded to an empty payload — treating as failure.")
                    userinfo = None
            except Exception as decode_err:
                verbose_proxy_logger.error("Failed to decode id_token: %s", decode_err)
                raise ProxyException(
                    message=f"Failed to decode id_token JWT: {decode_err}",
                    type=ProxyErrorTypes.auth_error,
                    param="userinfo",
                    code=status.HTTP_401_UNAUTHORIZED,
                )

        if userinfo is None:
            id_token_attempted: Final = isinstance(id_token, str) and bool(id_token)
            if userinfo_endpoint:
                if id_token_attempted:
                    detail = (
                        "userinfo endpoint failed and id_token was present but "
                        "decoded to an empty payload — no identity claims available"
                    )
                else:
                    detail = "userinfo endpoint failed and no id_token was present in the token response"
            else:
                if id_token_attempted:

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Verify the IdP returns a valid JWT id_token; check token signing/algorithms configuration and proxy logs.

When it happens

Trigger: Thrown at litellm/proxy/management_endpoints/ui_sso.py:4123 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/a584656f46a28eb2. Report an issue: GitHub.