{"record":{"id":"752d7b2627771e6a","repo":"BerriAI/litellm","slug":"login-required","errorCode":null,"errorMessage":"login_required","messagePattern":"login_required","errorType":"http","errorClass":"HTTPException","httpStatus":401,"severity":"error","filePath":"litellm/proxy/_experimental/mcp_server/byok_oauth_endpoints.py","lineNumber":130,"sourceCode":"            # require=[\"exp\"] additionally rejects tokens that omit it.\n            options={\"require\": [\"exp\"]},\n        )\n    except jwt.InvalidTokenError:\n        return None\n    if payload.get(\"type\") == \"byok_session\":\n        return None\n    if payload.get(\"login_method\") not in (\"sso\", \"username_password\"):\n        return None\n    user_id: Final = payload.get(\"user_id\")\n    return user_id if isinstance(user_id, str) and user_id else None\n\n\nasync def _byok_session_auth(request: Request) -> UserAPIKeyAuth:\n    \"\"\"Require the UI session cookie. Programmatic BYOK management uses\n    ``POST /v1/mcp/server/{id}/user-credential`` instead.\"\"\"\n    user_id: Final = _user_id_from_session_cookie(request)\n    if not user_id:\n        raise HTTPException(status_code=401, detail=\"login_required\")\n    return UserAPIKeyAuth(api_key=\"byok_session_cookie\", user_id=user_id)\n\n\ndef _build_authorize_html(\n    server_name: str,\n    server_initial: str,\n    client_id: str,\n    redirect_uri: str,\n    code_challenge: str,\n    code_challenge_method: str,\n    state: str,\n    server_id: str,\n    access_items: list,\n    help_url: str,\n) -> str:\n    \"\"\"Build the 2-step BYOK OAuth authorization page HTML.\"\"\"\n\n    # Escape all user-supplied / externally-derived values before interpolation","sourceCodeStart":112,"sourceCodeEnd":148,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/_experimental/mcp_server/byok_oauth_endpoints.py#L112-L148","documentation":"Guard in the BYOK session-cookie check: the JWT payload was structurally valid but login_method was neither 'sso' nor 'username_password', so the token is not a legitimate UI session and the BYOK endpoint refuses it.","triggerScenarios":"Thrown at litellm/proxy/_experimental/mcp_server/byok_oauth_endpoints.py:130 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Sign in to the proxy UI/CLI first, then retry the OAuth flow."],"exampleFix":"Complete proxy login and re-open the authorize URL.","handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}