{"record":{"id":"00e9b55328bc1774","repo":"BerriAI/litellm","slug":"invalid-or-expired-credential","errorCode":null,"errorMessage":"Invalid or expired credential","messagePattern":"Invalid or expired credential","errorType":"http","errorClass":"HTTPException","httpStatus":401,"severity":"error","filePath":"litellm/proxy/_experimental/mcp_server/auth/user_api_key_auth_mcp.py","lineNumber":800,"sourceCode":"        if not master_key:\n            raise HTTPException(status_code=500, detail=\"Server misconfigured: master_key is not set\")\n\n        await MCPRequestHandler._run_pre_db_read_auth_checks(request=request, route=route)\n\n        keys: Final = envelope_keys_from_master_key(master_key)\n        result: Final = resolve_bridge_envelope(authorization_value, keys, datetime.now(timezone.utc), server.server_id)\n        match result:\n            case BridgeEnvelopeAdmitted():\n                header_key: Final = server.alias or server.server_name\n                if header_key is None:\n                    raise HTTPException(status_code=500, detail=\"Server misconfigured: MCP server has no routable name\")\n                admitted: Final = await MCPRequestHandler._reload_admitted_principal(result.identity)\n                await MCPRequestHandler._enforce_admitted_live_policy(admitted=admitted, request=request, route=route)\n                injected: Final = {header_key: {\"Authorization\": result.upstream_authorization.get_secret_value()}}\n                new_headers: Final = {**(mcp_server_auth_headers or {}), **injected}\n                return admitted, new_headers\n            case BridgeEnvelopeInvalid() | NotBridgeEnvelope():\n                raise HTTPException(status_code=401, detail=\"Invalid or expired credential\")\n            case _:\n                assert_never(result)\n\n    @staticmethod\n    async def _admit_gateway_session(\n        authorization_value: str,\n        request: Request,\n        route: str,\n        mcp_servers: list[str] | None,\n    ) -> UserAPIKeyAuth:\n        \"\"\"Open a gateway DCR session bearer and admit the live litellm user it references.\n\n        Identity-only sibling of :meth:`_admit_dcr_bridge_delegate`: the session token seals no\n        upstream credential (those are vaulted per user, resolved at egress), so authorization is\n        resolved fresh via :meth:`_reload_admitted_user` + the centralized policy gate rather than a\n        mint-time snapshot. Pre-DB gates (size, IP, route allowlist) run first, mirroring the standard\n        pipeline. Fails closed with the requested scope's ``invalid_token`` challenge on an expired,\n        tampered, foreign, or refresh token, or a missing/deactivated/policy-rejected user.\"\"\"","sourceCodeStart":782,"sourceCodeEnd":818,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/_experimental/mcp_server/auth/user_api_key_auth_mcp.py#L782-L818","documentation":"HTTP 401 from MCP auth: the bridge envelope's signature/expiry check failed, or the referenced key is missing, blocked, or expired. It deliberately hides which check failed so an attacker cannot probe the envelope format.","triggerScenarios":"Thrown at litellm/proxy/_experimental/mcp_server/auth/user_api_key_auth_mcp.py:800 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Re-authenticate: the credential (token/cookie) is invalid or expired.","Check the Authorization header value."],"exampleFix":"Obtain a fresh token and retry the request.","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}