{"record":{"id":"0cf74ef2fe993a66","repo":"BerriAI/litellm","slug":"gigachat-authentication-request-failed-e","errorCode":null,"errorMessage":"GigaChat authentication request failed: {e}","messagePattern":"GigaChat authentication request failed: (.+?)","errorType":"exception","errorClass":"GigaChatAuthError","httpStatus":500,"severity":"error","filePath":"litellm/llms/gigachat/authenticator.py","lineNumber":179,"sourceCode":"        \"RqUID\": str(uuid.uuid4()),\n        \"Content-Type\": \"application/x-www-form-urlencoded\",\n    }\n    data: Final = {\"scope\": scope}\n\n    verbose_logger.debug(\"Requesting GigaChat access token from %s\", auth_url)\n\n    try:\n        client: Final = _get_http_client()\n        response: Final = client.post(auth_url, headers=headers, data=data, timeout=30)\n        response.raise_for_status()\n        return _parse_token_response(response)\n    except httpx.HTTPStatusError as e:\n        raise GigaChatAuthError(\n            status_code=e.response.status_code,\n            message=f\"GigaChat authentication failed: {e.response.text}\",\n        )\n    except httpx.RequestError as e:\n        raise GigaChatAuthError(\n            status_code=500,\n            message=f\"GigaChat authentication request failed: {e}\",\n        )\n\n\nasync def _request_token_async(\n    credentials: str,\n    scope: str,\n    auth_url: str,\n) -> tuple[str, int]:\n    \"\"\"Async version of _request_token_sync.\"\"\"\n    headers: Final = {\n        \"Authorization\": f\"Basic {credentials}\",\n        \"RqUID\": str(uuid.uuid4()),\n        \"Content-Type\": \"application/x-www-form-urlencoded\",\n    }\n    data: Final = {\"scope\": scope}\n","sourceCodeStart":161,"sourceCodeEnd":197,"githubUrl":"https://github.com/BerriAI/litellm/blob/6c2dcb801bf2b75c18f1bb24140e7cf57465cc4d/litellm/llms/gigachat/authenticator.py#L161-L197","documentation":"Raised by litellm's synchronous GigaChat OAuth token request when httpx fails at the transport level (httpx.RequestError) — DNS resolution failure, connection refused, TLS handshake error, or the 30s timeout elapsing. The error is wrapped into GigaChatAuthError with status_code=500 because no HTTP response was ever received. The message embeds the underlying httpx exception text (e.g. '[Errno -2] Name or service not known' or 'timed out').","triggerScenarios":"Calling completion(..., model=\"gigachat/...\") synchronously when: the host cannot resolve/reach the GigaChat OAuth endpoint (default ngw.devices.sberbank.ru:9443), a corporate firewall blocks egress to port 9443, a proxy is required but not configured for httpx, or the auth endpoint takes longer than the hardcoded 30s timeout.","commonSituations":"Running litellm inside a container or CI network without access to Sberbank endpoints; GIGACHAT_API_BASE misconfigured to an unreachable host; flaky VPN; local DNS outage. Users often confuse this with bad credentials, but credential failures raise the HTTPStatusError variant (GigaChat authentication failed) instead.","solutions":["Verify network reachability of the auth host: curl -v https://<gigachat-auth-host>:9443 (or your custom GIGACHAT_API_BASE) from the same machine/container.","If behind a proxy, set HTTPS_PROXY/HTTP_PROXY env vars (httpx honors them) or configure trustme/custom CA certs if TLS interception breaks the handshake.","Retry the call with backoff — transient DNS/network blips and slow token endpoints commonly resolve on retry (the timeout is a fixed 30s per attempt).","If the endpoint is permanently slow, report/patch the hardcoded timeout=30 in litellm/llms/gigachat/authenticator.py or self-host a faster auth proxy."],"exampleFix":"# before: assumes network is fine, fails with 'GigaChat authentication request failed'\nimport litellm\nlitellm.completion(model=\"gigachat/GigaChat-Pro\", messages=[{\"role\": \"user\", \"content\": \"hi\"}])\n\n# after: pre-check connectivity to the auth host before calling litellm\nimport socket, os\nhost = (os.getenv(\"GIGACHAT_API_BASE\") or \"https://ngw.devices.sberbank.ru:9443\").split(\"//\")[1].split(\":\")[0]\ntry:\n    socket.getaddrinfo(host, 9443)\nexcept socket.gaierror:\n    raise RuntimeError(f\"Cannot resolve GigaChat auth host {host}; check DNS/proxy/VPN\")\nlitellm.completion(model=\"gigachat/GigaChat-Pro\", messages=[{\"role\": \"user\", \"content\": \"hi\"}])","handlingStrategy":"retry","validationCode":"import os, socket, urllib.parse\n\nauth_base = os.getenv(\"GIGACHAT_API_BASE\", \"https://ngw.devices.sberbank.ru:9443\")\nhost = urllib.parse.urlparse(auth_base).hostname\nport = urllib.parse.urlparse(auth_base).port or 443\ntry:\n    socket.getaddrinfo(host, port)\n    reachable = True\nexcept socket.gaierror:\n    reachable = False\nif not reachable:\n    raise RuntimeError(f\"GigaChat auth host {host} unreachable; fix DNS/proxy before calling litellm\")","typeGuard":null,"tryCatchPattern":"from litellm.exceptions import AuthenticationError\nimport httpx\n\ntry:\n    resp = litellm.completion(model=\"gigachat/GigaChat-Pro\", messages=msgs)\nexcept AuthenticationError as e:\n    if \"authentication request failed\" in str(e):\n        # transport-level: safe to retry with backoff\n        resp = retry_with_backoff(lambda: litellm.completion(model=\"gigachat/GigaChat-Pro\", messages=msgs), attempts=3)\n    else:\n        raise  # credential failures (HTTPStatusError variant) are not retryable","preventionTips":["Smoke-test connectivity to the GigaChat auth host (port 9443) in deployment health checks.","Configure HTTPS_PROXY/HTTP_PROXY for httpx when egress requires a proxy.","Distinguish message text: 'request failed' = network, 'authentication failed' = credentials — only the former is retryable.","Wrap GigaChat calls in bounded retry with exponential backoff for transient transport errors."],"tags":["gigachat","authentication","network","httpx","timeout","oauth"],"backgroundTag":null,"analyzedSha":"6c2dcb801bf2b75c18f1bb24140e7cf57465cc4d","analyzedAt":"2026-08-15T07:12:03.035Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}