{"record":{"id":"21f28c9143f9fad3","repo":"BerriAI/litellm","slug":"could-not-authenticate-to-vault-via-approle-e","errorCode":null,"errorMessage":"Could not authenticate to Vault via AppRole: {e}","messagePattern":"Could not authenticate to Vault via AppRole: (.+?)","errorType":"exception","errorClass":"RuntimeError","httpStatus":null,"severity":"error","filePath":"litellm/secret_managers/hashicorp_secret_manager.py","lineNumber":145,"sourceCode":"                    \"role_id\": self.approle_role_id,\n                    \"secret_id\": self.approle_secret_id,\n                },\n            )\n            resp.raise_for_status()\n\n            auth_data: Final = resp.json()[\"auth\"]\n            token: Final = auth_data[\"client_token\"]\n            _lease_duration: Final = auth_data[\"lease_duration\"]\n\n            verbose_logger.debug(\n                \"Successfully obtained Vault token via AppRole auth. Lease duration: %ss\", _lease_duration\n            )\n\n            # Cache the token with its lease duration\n            self.cache.set_cache(key=\"hcp_vault_approle_token\", value=token, ttl=_lease_duration)\n            return token\n        except Exception as e:\n            raise RuntimeError(f\"Could not authenticate to Vault via AppRole: {e}\")\n\n    def _auth_via_tls_cert(self) -> str:\n        \"\"\"\n        Ref: https://developer.hashicorp.com/vault/api-docs/auth/cert\n\n        Request:\n        ```\n        curl \\\n            --request POST \\\n            --cacert vault-ca.pem \\\n            --cert cert.pem \\\n            --key key.pem \\\n            --header \"X-Vault-Namespace: mynamespace/\" \\\n            --data '{\"name\": \"my-cert-role\"}' \\\n            https://127.0.0.1:8200/v1/auth/cert/login\n        ```\n\n        Response:","sourceCodeStart":127,"sourceCodeEnd":163,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/secret_managers/hashicorp_secret_manager.py#L127-L163","documentation":"AppRole authentication failure in the Vault client: the POST to the AppRole login endpoint (role_id + secret_id) raised an exception (network error, invalid credentials, or raise_for_status failure), so no client_token could be obtained and the token cache is never populated.","triggerScenarios":"Thrown at litellm/secret_managers/hashicorp_secret_manager.py:145 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the AppRole role-id/secret-id are correct and not expired; inspect {e} for Vault's error.","Confirm the AppRole auth method is enabled at the expected mount path."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}