{"record":{"id":"680b66207e3d7cbb","repo":"BerriAI/litellm","slug":"only-proxy-admins-can-enable-throttle-on-budget-ex","errorCode":null,"errorMessage":"Only proxy admins can enable throttle_on_budget_exceeded on a key.","messagePattern":"Only proxy admins can enable throttle_on_budget_exceeded on a key\\.","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"error","filePath":"litellm/proxy/management_endpoints/key_management_endpoints.py","lineNumber":867,"sourceCode":") -> GenerateKeyResponse:\n    from litellm.proxy.proxy_server import (\n        litellm_proxy_admin_name,\n        llm_router,\n        premium_user,\n        prisma_client,\n    )\n\n    common_key_access_checks(\n        user_api_key_dict=user_api_key_dict,\n        data=data,\n        llm_router=llm_router,\n        premium_user=premium_user,\n    )\n\n    validate_budget_duration(data.budget_duration)\n\n    if data.throttle_on_budget_exceeded is True and user_api_key_dict.user_role != LitellmUserRoles.PROXY_ADMIN.value:\n        raise HTTPException(\n            status_code=403,\n            detail={\"error\": \"Only proxy admins can enable throttle_on_budget_exceeded on a key.\"},\n        )\n\n    enforce_output_token_estimates_are_admin_only(\n        data=data,\n        existing_metadata=None,\n        user_api_key_dict=user_api_key_dict,\n        entity=\"key\",\n    )\n\n    if data.metadata is not None and data.metadata.get(\"service_account_id\") is not None and data.team_id is None:\n        await validate_team_id_used_in_service_account_request(\n            team_id=data.team_id,\n            prisma_client=prisma_client,\n        )\n\n    # Capture caller-supplied max_budget and team_id before any defaults or","sourceCodeStart":849,"sourceCodeEnd":885,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/management_endpoints/key_management_endpoints.py#L849-L885","documentation":"LiteLLM Proxy rejects key creation/update when the request body sets throttle_on_budget_exceeded=true but the authenticated caller is not a proxy admin (user_role != PROXY_ADMIN). This flag throttles (instead of blocks) a key once its budget is exceeded, an admin-only control. The check runs in _common_key_generation_helper, so it applies to both /key/generate and /key/update.","triggerScenarios":"A POST /key/generate or POST /key/update request whose JSON body contains \"throttle_on_budget_exceeded\": true, sent with a virtual key whose role is internal_user, team_member, team_admin, or org_admin rather than proxy_admin.","commonSituations":"Automation scripts copy an admin-only flag from a template; a team admin tries to soften budget enforcement for their team's keys; the UI or a copied curl example includes the flag and the caller uses a non-admin key.","solutions":["Remove throttle_on_budget_exceeded from the request body if you do not need it","Re-send the same request with a proxy admin virtual key (a key issued to the admin user, role proxy_admin)","Have a proxy admin create/update the key on behalf of the non-admin caller"],"exampleFix":"// before (caller is a team admin key)\ncurl -X POST http://localhost:4000/key/generate \\\n  -H \"Authorization: Bearer sk-team-admin-key\" \\\n  -d '{\"max_budget\": 5, \"throttle_on_budget_exceeded\": true}'\n\n// after (use the proxy admin key for this flag)\ncurl -X POST http://localhost:4000/key/generate \\\n  -H \"Authorization: Bearer sk-proxy-admin-key\" \\\n  -d '{\"max_budget\": 5, \"throttle_on_budget_exceeded\": true}'","handlingStrategy":"validation","validationCode":"// Only include the admin-only flag when authed as an admin\npayload = {\"max_budget\": 5}\nif caller_is_proxy_admin:  # track this where you store credentials\n    payload[\"throttle_on_budget_exceeded\"] = True\nrequests.post(f\"{PROXY}/key/generate\", headers=AUTH, json=payload)","typeGuard":null,"tryCatchPattern":"try:\n    resp = requests.post(f\"{PROXY}/key/generate\", headers=AUTH, json=payload)\n    resp.raise_for_status()\nexcept requests.HTTPError as e:\n    if e.response.status_code == 403 and \"throttle_on_budget_exceeded\" in e.response.text:\n        # retry without the flag, or escalate to an admin key\n        payload.pop(\"throttle_on_budget_exceeded\", None)\n        resp = requests.post(f\"{PROXY}/key/generate\", headers=AUTH, json=payload)\n    else:\n        raise","preventionTips":["Keep per-role request templates so non-admin callers never carry admin-only fields","Audit copied curl/SDK examples for flags like throttle_on_budget_exceeded before reuse","Store which of your keys are proxy-admin keys and gate admin-only operations on that flag in your client library"],"tags":["litellm-proxy","authorization","virtual-keys","budget","throttling"],"backgroundTag":"admin-privilege-required","analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}