{"record":{"id":"0e198fe4214e4432","repo":"BerriAI/litellm","slug":"sso-authentication-failed-provider-name-require","errorCode":null,"errorMessage":"SSO authentication failed: {provider_name} requires PKCE (Proof Key for Code Exchange) but it's not enabled in your LiteLLM configuration.\n\nSOLUTION: Add this environment variable and restart your proxy:\n  GENERIC_CLIENT_USE_PKCE=true\n\nOriginal error: {error_message}","messagePattern":"SSO authentication failed: (.+?) requires PKCE \\(Proof Key for Code Exchange\\) but it's not enabled in your LiteLLM configuration\\.\n\nSOLUTION: Add this environment variable and restart your proxy:\n  GENERIC_CLIENT_USE_PKCE=true\n\nOriginal error: (.+?)","errorType":"http","errorClass":"ProxyException","httpStatus":401,"severity":"error","filePath":"litellm/proxy/management_endpoints/ui_sso.py","lineNumber":1481,"sourceCode":"            generic_token_endpoint and \"okta\" in generic_token_endpoint.lower()\n        )\n        provider_name: Final = \"Okta\" if is_okta else \"Your OAuth provider\"\n\n        detailed_message = (\n            f\"SSO authentication failed: {provider_name} requires PKCE (Proof Key for Code Exchange) \"\n            f\"but it's not enabled in your LiteLLM configuration.\\n\\n\"\n            f\"SOLUTION: Add this environment variable and restart your proxy:\\n\"\n            f\"  GENERIC_CLIENT_USE_PKCE=true\\n\\n\"\n        )\n        if is_okta:\n            detailed_message += (\n                \"For AWS ECS: Add the environment variable to your task definition.\\n\"\n                \"For Docker: Add -e GENERIC_CLIENT_USE_PKCE=true to your docker run command.\\n\"\n                \"For .env file: Add GENERIC_CLIENT_USE_PKCE=true to your .env file.\\n\\n\"\n            )\n        detailed_message += f\"Original error: {error_message}\"\n\n        raise ProxyException(\n            message=detailed_message,\n            type=ProxyErrorTypes.auth_error,\n            param=\"GENERIC_CLIENT_USE_PKCE\",\n            code=status.HTTP_401_UNAUTHORIZED,\n        )\n\n    if isinstance(e, ProxyException):\n        verbose_proxy_logger.error(\n            \"SSO authentication failed: %s. Passed in headers: %s\",\n            e,\n            additional_headers,\n        )\n    else:\n        verbose_proxy_logger.exception(\n            \"Error verifying and processing generic SSO: %s. Passed in headers: %s\",\n            e,\n            additional_headers,\n        )","sourceCodeStart":1463,"sourceCodeEnd":1499,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/management_endpoints/ui_sso.py#L1463-L1499","documentation":"Error \"SSO authentication failed: {provider_name} requires PKCE (Proof Key for Code Exchange) but it's not enabled in your LiteLLM configuration.\n\nSOLUTION: Add this environment variable and restart your proxy:\n  GENERIC_CLIENT_USE_PKCE=true\n\nOriginal error: {error_message}\" thrown in BerriAI/litellm.","triggerScenarios":"Thrown at litellm/proxy/management_endpoints/ui_sso.py:1481 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Set GENERIC_CLIENT_USE_PKCE=true in the environment and restart the proxy."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}