{"record":{"id":"866c32c9035e6286","repo":"BerriAI/litellm","slug":"pkce-cache-miss","errorCode":"PKCE_CACHE_MISS","errorMessage":"PKCE verifier for state '{state}' has an unrecognized format (type={type(cached_data).__name__}). The cached entry may be corrupt.","messagePattern":"PKCE verifier for state '(.+?)' has an unrecognized format \\(type=(.+?)\\)\\. The cached entry may be corrupt\\.","errorType":"exception","errorClass":"ProxyException","httpStatus":401,"severity":"error","filePath":"litellm/proxy/management_endpoints/ui_sso.py","lineNumber":3777,"sourceCode":"                raise ProxyException(\n                    message=(\n                        f\"PKCE verifier for state '{state}' was found in cache but \"\n                        f\"has an empty or null code_verifier value — possible storage bug.\"\n                    ),\n                    type=ProxyErrorTypes.auth_error,\n                    param=\"PKCE_CACHE_MISS\",\n                    code=status.HTTP_401_UNAUTHORIZED,\n                )\n            elif cached_data is not None:\n                await SSOAuthenticationHandler._delete_pkce_verifier(cache_key)\n                verbose_proxy_logger.error(\n                    \"PKCE verifier for state '%s' has an unrecognized format (type=%s); \"\n                    \"treating as a cache miss. Investigate the cached value — it may be \"\n                    \"a corrupt or stale entry.\",\n                    state,\n                    type(cached_data).__name__,\n                )\n                raise ProxyException(\n                    message=(\n                        f\"PKCE verifier for state '{state}' has an unrecognized format \"\n                        f\"(type={type(cached_data).__name__}). The cached entry may be corrupt.\"\n                    ),\n                    type=ProxyErrorTypes.auth_error,\n                    param=\"PKCE_CACHE_MISS\",\n                    code=status.HTTP_401_UNAUTHORIZED,\n                )\n            else:\n                if redis_usage_cache is not None:\n                    cause = (\n                        \"The authorization and callback were likely handled by different \"\n                        \"instances — the verifier was stored on one pod but not found on another.\"\n                    )\n                else:\n                    cause = (\n                        \"The verifier may have expired (TTL), been lost on a pod restart, \"\n                        \"or the PKCE authorization step was never completed. \"","sourceCodeStart":3759,"sourceCodeEnd":3795,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/management_endpoints/ui_sso.py#L3759-L3795","documentation":"Logged (and surfaced) during SSO PKCE callback handling: the cached PKCE entry for 'state' exists but its type is not a recognized shape (not a dict/tuple carrying code_verifier), so the verifier cannot be extracted. Indicates cache corruption or an incompatible writer stored the entry; the stale entry is deleted.","triggerScenarios":"Thrown at litellm/proxy/management_endpoints/ui_sso.py:3777 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Restart the SSO login flow; if it persists, flush the corrupted cache entry (Redis/cache) for that state."],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}