{"record":{"id":"4573ac2badbbb101","repo":"BerriAI/litellm","slug":"missing-vault-authentication-credentials-please-s","errorCode":null,"errorMessage":"Missing Vault authentication credentials. Please set either:\n  - HCP_VAULT_TOKEN for token-based auth, or\n  - HCP_VAULT_APPROLE_ROLE_ID and HCP_VAULT_APPROLE_SECRET_ID for AppRole auth, or\n  - HCP_VAULT_CLIENT_CERT and HCP_VAULT_CLIENT_KEY for TLS certificate auth","messagePattern":"Missing Vault authentication credentials\\. Please set either:\n  - HCP_VAULT_TOKEN for token-based auth, or\n  - HCP_VAULT_APPROLE_ROLE_ID and HCP_VAULT_APPROLE_SECRET_ID for AppRole auth, or\n  - HCP_VAULT_CLIENT_CERT and HCP_VAULT_CLIENT_KEY for TLS certificate auth","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"litellm/secret_managers/hashicorp_secret_manager.py","lineNumber":70,"sourceCode":"        litellm.secret_manager_client = self\n        litellm._key_management_system = KeyManagementSystem.HASHICORP_VAULT\n        _refresh_interval = os.environ.get(\"HCP_VAULT_REFRESH_INTERVAL\", SECRET_MANAGER_REFRESH_INTERVAL)\n        _refresh_interval = int(_refresh_interval) if _refresh_interval else SECRET_MANAGER_REFRESH_INTERVAL\n        self.cache = InMemoryCache(default_ttl=_refresh_interval)  # store in memory for 1 day\n\n    def _verify_required_credentials_exist(self) -> None:\n        \"\"\"\n        Validate that at least one authentication method is configured.\n\n        Raises:\n            ValueError: If no valid authentication credentials are provided\n        \"\"\"\n        has_token: Final = bool(self.vault_token)\n        has_approle: Final = bool(self.approle_role_id and self.approle_secret_id)\n        has_tls_cert: Final = bool(self.tls_cert_path and self.tls_key_path)\n\n        if not has_token and not has_approle and not has_tls_cert:\n            raise ValueError(\n                \"Missing Vault authentication credentials. Please set either:\\n\"\n                \"  - HCP_VAULT_TOKEN for token-based auth, or\\n\"\n                \"  - HCP_VAULT_APPROLE_ROLE_ID and HCP_VAULT_APPROLE_SECRET_ID for AppRole auth, or\\n\"\n                \"  - HCP_VAULT_CLIENT_CERT and HCP_VAULT_CLIENT_KEY for TLS certificate auth\"\n            )\n\n    def _auth_via_approle(self) -> str:\n        \"\"\"\n        Authenticate to Vault using AppRole auth method.\n        \n        Ref: https://developer.hashicorp.com/vault/api-docs/auth/approle\n\n        Request:\n        ```\n        curl \\\n            --request POST \\\n            --header \"X-Vault-Namespace: mynamespace/\" \\\n            --data '{\"role_id\": \"...\", \"secret_id\": \"...\"}' \\","sourceCodeStart":52,"sourceCodeEnd":88,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/secret_managers/hashicorp_secret_manager.py#L52-L88","documentation":"Error \"Missing Vault authentication credentials. Please set either:\n  - HCP_VAULT_TOKEN for token-based auth, or\n  - HCP_VAULT_APPROLE_ROLE_ID and HCP_VAULT_APPROLE_SECRET_ID for AppRole auth, or\n  - HCP_VAULT_CLIENT_CERT and HCP_VAULT_CLIENT_KEY for TLS certificate auth\" thrown in BerriAI/litellm.","triggerScenarios":"Thrown at litellm/secret_managers/hashicorp_secret_manager.py:70 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Set HCP_VAULT_TOKEN for token auth, or HCP_VAULT_APPROLE_ROLE_ID + HCP_VAULT_APPROLE_SECRET_ID for AppRole, or HCP_VAULT_CLIENT_CERT + HCP_VAULT_CLIENT_KEY for TLS auth.","Ensure HCP_VAULT_ADDR/NAMESPACE are also set correctly for your Vault cluster."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}