{"record":{"id":"2da7f9413d3056aa","repo":"BerriAI/litellm","slug":"invalid-proxy-server-token-passed","errorCode":null,"errorMessage":"Invalid proxy server token passed","messagePattern":"Invalid proxy server token passed","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"litellm/proxy/auth/user_api_key_auth.py","lineNumber":2092,"sourceCode":"            valid_token_dict = valid_token.model_dump(exclude_none=True)\n            valid_token_dict.pop(\"token\", None)\n            # budget_throttle_pct is excluded from model_dump (it must not leak\n            # into serialized responses), so carry the request-scoped decision\n            # forward by hand to the auth object the rate limiter receives.\n            if valid_token.budget_throttle_pct is not None:\n                valid_token_dict[\"budget_throttle_pct\"] = valid_token.budget_throttle_pct\n\n            if _end_user_object is not None:\n                valid_token_dict.update(end_user_params)\n                valid_token_dict[\"end_user_object_permission\"] = _end_user_object.object_permission\n\n        # check if token is from litellm-ui, litellm ui makes keys to allow users to login with sso. These keys can only be used for LiteLLM UI functions\n        # sso/login, ui/login, /key functions and /user functions\n        # this will never be allowed to call /chat/completions\n\n        if valid_token is None:\n            # No token was found when looking up in the DB\n            raise Exception(\"Invalid proxy server token passed\")\n        if valid_token_dict is not None:\n            virtual_key_auth_obj: Final = await _return_user_api_key_auth_obj(\n                user_obj=user_obj,\n                api_key=api_key,\n                parent_otel_span=parent_otel_span,\n                valid_token_dict=valid_token_dict,\n                route=route,\n                start_time=start_time,\n            )\n            virtual_key_auth_obj.via_virtual_key = True\n            return virtual_key_auth_obj\n    except Exception as e:\n        return await UserAPIKeyAuthExceptionHandler._handle_authentication_error(\n            e=e,\n            request=request,\n            request_data=request_data,\n            route=route,\n            parent_otel_span=parent_otel_span,","sourceCodeStart":2074,"sourceCodeEnd":2110,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/auth/user_api_key_auth.py#L2074-L2110","documentation":"Legacy terminal guard in the litellm-ui token section: after budget checks, if `valid_token` is still None the proxy rejects the credential as an unknown proxy token (generic Exception, so surfaced as a 500-style error unless wrapped). In practice it means the key resolved to no token record — unknown, deleted, or from another environment.","triggerScenarios":"Presenting a key that no lookup (cache or DB) resolved, in the flow that reaches the UI-key comment block — e.g. a UI/SSO login key used where it is not recognized, or any token-shaped credential that slipped past the earlier 401 checks.","commonSituations":"SSO/UI session keys replayed against the wrong proxy or after DB resets; older LiteLLM versions where this is the primary 'key not found' error; clients ignoring earlier 401s and retrying.","solutions":["Treat like any invalid-credential 401/500: verify the key exists via admin `/key/info` on the same proxy+DB","Re-authenticate (new `/key/generate` or fresh SSO/UI login) and use the newly issued key","Upgrade the proxy — newer code paths return the cleaner 401 'Invalid API key' for this condition"],"exampleFix":"# before\nresp = client.chat.completions.create(...)  # Exception: Invalid proxy server token passed\n\n# after\nkey = admin.post(\"/key/generate\", json={\"key_alias\": \"app\"}).json()[\"key\"]\nclient = OpenAI(base_url=..., api_key=key)","handlingStrategy":"try-catch","validationCode":"r = httpx.get(f\"{PROXY}/v1/models\", headers={\"Authorization\": f\"Bearer {key}\"})\nif r.status_code in (401, 500) and not r.is_success:\n    raise RuntimeError(\"proxy did not recognize this token — obtain a fresh key\")","typeGuard":null,"tryCatchPattern":"try:\n    resp = client.chat.completions.create(...)\nexcept Exception as e:\n    if \"Invalid proxy server token passed\" in str(e):\n        client.api_key = reauthenticate()  # fresh /key/generate or SSO login\n        resp = client.chat.completions.create(...)\n    else:\n        raise","preventionTips":["Re-authenticate on unknown-token errors instead of retrying the same credential","Keep the proxy current — newer builds map this to a clean 401","Use proxy-issued keys rather than tokens minted elsewhere"],"tags":["auth","invalid-key","token-lookup","litellm"],"backgroundTag":"invalid-api-key","analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}