{"record":{"id":"18cb5f7d08b9f85b","repo":"BerriAI/litellm","slug":"token-is-not-active","errorCode":null,"errorMessage":"Token is not active","messagePattern":"Token is not active","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"litellm/proxy/auth/oauth2_check.py","lineNumber":192,"sourceCode":"                verbose_proxy_logger.debug(\"Using generic token info endpoint (GET)\")\n                headers = Oauth2Handler._prepare_token_info_request(token=token)\n                response = await client.get(token_info_endpoint, headers=headers)\n\n            # if it's a bad token we expect it to raise an HTTPStatusError\n            response.raise_for_status()\n\n            # If we get here, the request was successful\n            data = response.json()\n\n            verbose_proxy_logger.debug(\n                \"Oauth2 token validation for token=%s, response from endpoint=%s\",\n                token,\n                data,\n            )\n\n            # For introspection endpoints, check if token is active\n            if is_introspection_endpoint and not data.get(\"active\", True):\n                raise ValueError(\"Token is not active\")\n\n            # Extract user information from response\n            user_id, user_role, user_team_id = Oauth2Handler._extract_user_info(\n                response_data=data,\n                user_id_field_name=user_id_field_name,\n                user_role_field_name=user_role_field_name,\n                user_team_id_field_name=user_team_id_field_name,\n            )\n\n            return UserAPIKeyAuth(\n                api_key=token,\n                team_id=user_team_id,\n                user_id=user_id,\n                user_role=cast(LitellmUserRoles, user_role),\n            )\n        except httpx.HTTPStatusError as e:\n            # This will catch any 4xx or 5xx errors\n            raise ValueError(f\"Oauth 2.0 Token validation failed: {e}\")","sourceCodeStart":174,"sourceCodeEnd":210,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/auth/oauth2_check.py#L174-L210","documentation":"Raised in the OAuth2 token introspection path after a successful request to the token-info/userinfo endpoint when the response indicates the presented token is not active (e.g. introspection body has active=false, or the handler's post-processing deemed it invalid). It is the expected failure for expired or revoked upstream tokens and surfaces as an auth rejection to the caller.","triggerScenarios":"Thrown at litellm/proxy/auth/oauth2_check.py:192 when the library encounters an invalid state.","commonSituations":"The introspected OAuth2 token is expired, revoked, or was never issued by the configured provider.","solutions":["Obtain a fresh, active token from your identity provider.","Check that the token has not expired or been revoked at the introspection endpoint."],"exampleFix":"Re-authenticate with your IdP and retry with the new access token.","handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}