BerriAI/litellm · error · ValueError

You must be a LiteLLM Enterprise user to use this feature…

Error message

You must be a LiteLLM Enterprise user to use this feature. If you have a license please set `LITELLM_LICENSE` in your env. Get a 7 day trial key here: https://www.litellm.ai/enterprise#trial. 
Pricing: https://www.litellm.ai/#pricing

What it means

Raised as a ValueError when a custom UI SSO sign-in is attempted and the proxy's premium_user flag is not True. LiteLLM gates custom SSO login handlers behind an Enterprise license; the check runs before any handler code executes. The message is the standard not_premium_user text pointing to LITELLM_LICENSE and the trial/pricing pages.

Solutions

Set a valid LITELLM_LICENSE in the proxy environment and restart: export LITELLM_LICENSE=<key>
Verify premium status at runtime via the proxy's enterprise/premium endpoints or startup logs (look for 'Premium User' verification)
If you do not have a license, remove custom_ui_sso_sign_in_handler from general_settings and use the built-in SSO (Google/Azure AD/Okta) instead
Get a 7-day trial key from https://www.litellm.ai/enterprise#trial to evaluate before purchasing
If the license is valid but the error persists, check that all replicas/workers receive LITELLM_LICENSE (e.g. k8s secret mounted env)

Example fix

# before
# general_settings.custom_ui_sso_sign_in_handler set, but no license
# -> ValueError: not_premium_user

# after (docker-compose)
environment:
  LITELLM_LICENSE: "${LITELLM_LICENSE}"

Defensive patterns

Strategy: validation

Validate before calling

# Before enabling custom UI SSO, assert premium status
import litellm.proxy.proxy_server as ps
if getattr(ps, "premium_user", False) is not True:
    raise SystemExit("LITELLM_LICENSE missing/invalid - custom UI SSO disabled")

Try / catch

try:
    await custom_sso_login(request)
except ValueError as e:
    if "not_premium_user" in str(e) or "Enterprise user" in str(e):
        return RedirectResponse("/sso/keycloak")  # fall back to built-in SSO
    raise

Prevention

Gate enterprise features behind a startup check on premium_user
Keep LITELLM_LICENSE in a managed secret mounted into every replica
Run a canary request against the custom SSO route after deploys

When it happens

Trigger: Configuring general_settings.custom_ui_sso_sign_in_handler (or hitting the /sso/custom-login style route that calls this handler) on a proxy running without a valid LITELLM_LICENSE, with an expired license, or before the license verification has run (premium_user still defaults to False at import time).

Common situations: Self-hosting LiteLLM with enterprise features copied from an enterprise config, license expired or not propagated into the container env, license key validated but the call happens in a worker/process that never loaded the premium check, or a typo'd LITELLM_LICENSE value.

Related errors

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/f111e2f609cfc8a5. Report an issue: GitHub.

Appendix: source

Thrown at enterprise/litellm_enterprise/proxy/auth/custom_sso_handler.py:65

            This method is typically called when a user has already been authenticated by an
            external OAuth proxy and the proxy has added custom headers containing user information.
            The custom handler extracts this information and converts it to an OpenID object.
        """
        from fastapi_sso.sso.base import OpenID

        from litellm.integrations.custom_sso_handler import CustomSSOLoginHandler
        from litellm.proxy.proxy_server import (
            CommonProxyErrors,
            general_settings,
            premium_user,
            user_custom_ui_sso_sign_in_handler,
        )
        from litellm.proxy.auth.trusted_proxy_utils import (
            require_trusted_proxy_request,
        )

        if premium_user is not True:
            raise ValueError(CommonProxyErrors.not_premium_user.value)

        if user_custom_ui_sso_sign_in_handler is None:
            raise ValueError(
                "custom_ui_sso_sign_in_handler is not configured. Please set it in general_settings."
            )

        require_trusted_proxy_request(
            request=request,
            general_settings=general_settings,
            feature_name="Custom UI SSO",
        )

        custom_sso_login_handler = cast(
            CustomSSOLoginHandler, user_custom_ui_sso_sign_in_handler
        )
        openid_response: OpenID = (
            await custom_sso_login_handler.handle_custom_ui_sso_sign_in(
                request=request,

View on GitHub (pinned to 77b7c6c40c)