BerriAI/litellm · error · ValueError

You must be a LiteLLM Enterprise user to use this feature. I

Error message

You must be a LiteLLM Enterprise user to use this feature. If you have a license please set `LITELLM_LICENSE` in your env. Get a 7 day trial key here: https://www.litellm.ai/enterprise#trial. 
Pricing: https://www.litellm.ai/#pricing

What it means

ValueError from the enterprise custom SSO sign-in flow: it requires premium_user is True. When the proxy does not have a valid enterprise license, invoking the custom UI SSO sign-in handler raises CommonProxyErrors.not_premium_user before any SSO logic runs.

Source

Thrown at enterprise/litellm_enterprise/proxy/auth/custom_sso_handler.py:65

            This method is typically called when a user has already been authenticated by an
            external OAuth proxy and the proxy has added custom headers containing user information.
            The custom handler extracts this information and converts it to an OpenID object.
        """
        from fastapi_sso.sso.base import OpenID

        from litellm.integrations.custom_sso_handler import CustomSSOLoginHandler
        from litellm.proxy.proxy_server import (
            CommonProxyErrors,
            general_settings,
            premium_user,
            user_custom_ui_sso_sign_in_handler,
        )
        from litellm.proxy.auth.trusted_proxy_utils import (
            require_trusted_proxy_request,
        )

        if premium_user is not True:
            raise ValueError(CommonProxyErrors.not_premium_user.value)

        if user_custom_ui_sso_sign_in_handler is None:
            raise ValueError(
                "custom_ui_sso_sign_in_handler is not configured. Please set it in general_settings."
            )

        require_trusted_proxy_request(
            request=request,
            general_settings=general_settings,
            feature_name="Custom UI SSO",
        )

        custom_sso_login_handler = cast(
            CustomSSOLoginHandler, user_custom_ui_sso_sign_in_handler
        )
        openid_response: OpenID = (
            await custom_sso_login_handler.handle_custom_ui_sso_sign_in(
                request=request,

View on GitHub (pinned to 6c2dcb801b)

Solutions

Set LITELLM_LICENSE to a valid enterprise key in the proxy's environment and restart (trial keys available at litellm.ai/enterprise#trial)
Without a license, remove custom_ui_sso_sign_in_handler from general_settings and use built-in SSO (Google/Azure/Okta/OIDC) instead
Confirm premium_user resolves True by checking startup logs for license validation

Example fix

# before
general_settings:
  custom_ui_sso_sign_in_handler: my_module.handler
# no license -> ValueError on sign-in

# after
export LITELLM_LICENSE=<valid-key>
# keep general_settings as-is, restart proxy

Defensive patterns

Strategy: validation

Validate before calling

def can_use_custom_sso() -> bool:
    return os.environ.get('LITELLM_LICENSE') is not None
# plus a post-deploy canary hit of the SSO endpoint

Try / catch

try:
    resp = httpx.get(f'{PROXY_URL}/sso/ui/sign-in', params=p)
except ValueError as e:
    if 'not_premium_user' in str(e):
        raise ConfigError('custom UI SSO needs an enterprise license') from e
    raise

Prevention

Deploy LITELLM_LICENSE alongside any config referencing custom SSO
Gate custom-SSO config behind a feature flag that checks license presence in CI

When it happens

Trigger: Enabling custom_ui_sso_sign_in_handler in general_settings and hitting the SSO sign-in route on a proxy without a valid LITELLM_LICENSE. The premium check is the first gate in the handler.

Common situations: Building a custom SSO integration during evaluation without a trial key; license expired mid-development; LITELLM_LICENSE present in the shell but not in the systemd unit/Docker env so the proxy never saw it.

Related errors

AI-assisted analysis of BerriAI/litellm@6c2dcb801b (2026-08-15). Data as JSON: /api/errors/f111e2f609cfc8a5. Report an issue: GitHub.