{"record":{"id":"60c64032e2f4a592","repo":"BerriAI/litellm","slug":"user-role-is-required-for-cli-jwt-login","errorCode":null,"errorMessage":"User role is required for CLI JWT login","messagePattern":"User role is required for CLI JWT login","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"litellm/proxy/auth/auth_checks.py","lineNumber":2944,"sourceCode":"        Args:\n            user_info: User information from the database\n            team_id: Team ID for the user (optional, uses user's team if available)\n            team_alias: Team alias for the selected team, if available\n            team_models: Model allowlist granted by the selected team\n            team_model_aliases: Team model aliases for the selected team\n\n        Returns:\n            Encrypted JWT token string\n        \"\"\"\n        import secrets\n        from datetime import timedelta\n\n        from litellm.proxy.common_utils.encrypt_decrypt_utils import (\n            encrypt_value_helper,\n        )\n\n        if user_info.user_role is None:\n            raise Exception(\"User role is required for CLI JWT login\")\n\n        # Calculate expiration time (configurable via LITELLM_CLI_JWT_EXPIRATION_HOURS env var)\n        expiration_time: Final = get_utc_datetime() + timedelta(hours=CLI_JWT_EXPIRATION_HOURS)\n\n        # Format the expiration time as ISO 8601 string\n        expires: Final = expiration_time.strftime(\"%Y-%m-%dT%H:%M:%S.%f\")[:-3] + \"+00:00\"\n\n        # Use provided team_id, or fall back to user's teams if available\n        _team_id = team_id\n        if _team_id is None and hasattr(user_info, \"teams\") and user_info.teams:\n            # Use first team if user has teams\n            _team_id = user_info.teams[0] if len(user_info.teams) > 0 else None\n\n        session_token: Final = f\"{CLI_SESSION_KEY_PREFIX}-{secrets.token_urlsafe(16)}\"\n        session_alias: Final = f\"{CLI_SESSION_KEY_PREFIX}-{user_info.user_id}\"\n\n        valid_token: Final = UserAPIKeyAuth(\n            token=session_token,","sourceCodeStart":2926,"sourceCodeEnd":2962,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/auth/auth_checks.py#L2926-L2962","documentation":"Raised by the CLI JWT login token generator when user_info.user_role is None. This flow mints an encrypted JWT (expiry LITELLM_CLI_JWT_EXPIRATION_HOURS, default configurable) for CLI authentication and embeds the user's role; a NULL role means authorization decisions in the CLI cannot be made, so the Exception is thrown before any token is produced.","triggerScenarios":"Invoking the CLI JWT login endpoint for a user whose DB row has no user_role (NULL) — commonly an auto-provisioned user from custom JWT/SSO auth with no default role, or a manually created user row.","commonSituations":"Users provisioned by SSO without default_user_role; DB rows created outside the API; environments where role assignment was skipped during onboarding automation.","solutions":["Set the role on the user: POST /user/update {\"user_id\": \"...\", \"user_role\": \"proxy_admin\" | \"internal_user\" | \"customer\"}","Configure default_user_role in your SSO/JWT auth settings so future auto-created users get a role at first login","Retry the CLI login after the update"],"exampleFix":"curl -X POST http://localhost:4000/user/update \\\n  -H \"Authorization: Bearer $MASTER_KEY\" \\\n  -d '{\"user_id\": \"user-7\", \"user_role\": \"internal_user\"}'","handlingStrategy":"validation","validationCode":"assert user_info.user_role is not None, \"CLI JWT login requires user_role to be set\"","typeGuard":"def user_has_role(user: LiteLLM_UserTable) -> bool:\n    return user.user_role is not None","tryCatchPattern":"try:\n    token = get_cli_jwt_auth_token(user_info)\nexcept Exception as e:\n    if \"User role is required for CLI JWT login\" in str(e):\n        raise RuntimeError(\"Set user_role via /user/update before CLI login\") from e\n    raise","preventionTips":["Assign roles during user provisioning automation","Configure default_user_role for SSO-created users"],"tags":["litellm","cli","jwt","user-role","login"],"backgroundTag":"missing-user-role","analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}