{"record":{"id":"3bc7e67d55188201","repo":"BerriAI/litellm","slug":"user-does-not-have-permission-to-create-temporary","errorCode":null,"errorMessage":"User does not have permission to create temporary mcp servers. You can only create temporary mcp servers if you are a PROXY_ADMIN.","messagePattern":"User does not have permission to create temporary mcp servers\\. You can only create temporary mcp servers if you are a PROXY_ADMIN\\.","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"error","filePath":"litellm/proxy/management_endpoints/mcp_management_endpoints.py","lineNumber":1635,"sourceCode":"        litellm_changed_by: str | None = Header(\n            None,\n            description=\"The litellm-changed-by header enables tracking of actions performed by authorized users on behalf of other users, providing an audit trail for accountability\",\n        ),\n    ):\n        \"\"\"\n        Cache MCP server info in memory for a short duration (~5 minutes).\n\n        This endpoint does not write to the database. If the same server_id is provided\n        again while the cache entry is active, it will refresh the cached data + TTL.\n        \"\"\"\n\n        # Validate and normalize payload fields (alias/server name rules)\n        validate_and_normalize_mcp_server_payload(payload)\n        stamp_omitted_oauth2_flow(payload)\n\n        # Restrict to proxy admins similar to the persistent create endpoint\n        if LitellmUserRoles.PROXY_ADMIN != user_api_key_dict.user_role:\n            raise HTTPException(\n                status_code=status.HTTP_403_FORBIDDEN,\n                detail={\n                    \"error\": \"User does not have permission to create temporary mcp servers. You can only create temporary mcp servers if you are a PROXY_ADMIN.\"\n                },\n            )\n\n        created_by: Final = user_api_key_dict.user_id or LITELLM_PROXY_ADMIN_NAME\n        payload_with_credentials: Final = _inherit_credentials_from_existing_server(payload)\n        temp_record: Final = _build_temporary_mcp_server_record(\n            payload_with_credentials,\n            created_by,\n            await _resolve_session_server_id(payload_with_credentials),\n        )\n\n        try:\n            temporary_server: Final = await global_mcp_server_manager.build_mcp_server_from_table(\n                temp_record,\n                credentials_are_encrypted=False,","sourceCodeStart":1617,"sourceCodeEnd":1653,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/management_endpoints/mcp_management_endpoints.py#L1617-L1653","documentation":"Returned (403) by the temporary/session MCP server endpoint (used for the short-lived, Redis-cached servers of the admin OAuth setup flow). Like the persistent create endpoint it validates the payload first, then requires user_role to be exactly LitellmUserRoles.PROXY_ADMIN; non-admin keys cannot register temporary servers.","triggerScenarios":"Calling the temporary MCP server / OAuth session endpoint with an internal-user, team, or org-admin key; automating the admin OAuth connect flow with a non-admin virtual key.","commonSituations":"Trying to script the MCP OAuth setup with the wrong key; team members attempting to register their own OAuth-connected MCP servers during a session.","solutions":["Run the temporary-server/session flow with the proxy master key or a PROXY_ADMIN user's key.","Verify the key's user_role via /key/info before starting the flow.","For user-facing OAuth flows, use the user-side endpoints with a real server_id instead of creating temp servers."],"exampleFix":"# before\nrequests.post(f\"{PROXY}/v1/mcp/server/oauth/session\", headers={\"Authorization\": f\"Bearer {USER_KEY}\"}, json=payload)\n\n# after\nrequests.post(f\"{PROXY}/v1/mcp/server/oauth/session\", headers={\"Authorization\": f\"Bearer {os.environ['LITELLM_MASTER_KEY']}\"}, json=payload)","handlingStrategy":"validation","validationCode":"info = requests.get(f\"{PROXY}/key/info\", headers=AUTH, params={\"key\": KEY}).json()\nif info.get(\"key_info\", info).get(\"user_role\") != \"proxy_admin\":\n    raise PermissionError(\"temporary MCP servers require a PROXY_ADMIN key\")","typeGuard":"def can_create_temp_server(user_role: str | None) -> bool:\n    return user_role == \"proxy_admin\"","tryCatchPattern":"try:\n    create_temp_server(payload)\nexcept HTTPError as e:\n    if e.response.status_code == 403:\n        raise PermissionError(\"re-run the OAuth session flow with the master/admin key\")\n    raise","preventionTips":["Reserve the OAuth session/temp-server flow for admin keys.","Document which automation may use admin keys for MCP setup."],"tags":["litellm","mcp","forbidden","authorization","oauth","session"],"backgroundTag":"authorization-forbidden","analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}