{"record":{"id":"90be97ac915dfd42","repo":"gravitational/teleport","slug":"unable-to-serve-request-due-to-an-app-configuratio","errorCode":null,"errorMessage":"unable to serve request due to an app configuration error. Contact your Teleport administrator","messagePattern":"unable to serve request due to an app configuration error\\. Contact your Teleport administrator","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/srv/app/llm/errors/errors.go","lineNumber":45,"sourceCode":")\n\nvar (\n\t// ErrTimeout returned when the request times out.\n\tErrTimeout = errors.New(\"the request timed out. Try again or use streaming for long responses\")\n\t// ErrBadRequest returned when the request has bad format or invalid fields.\n\tErrBadRequest = errors.New(\"the inference provider rejected the request as invalid. Check the request body for unsupported or invalid fields\")\n\t// ErrCanceled returned when the request is canceled.\n\tErrCanceled = errors.New(\"the request was canceled\")\n\t// ErrUnauthorized returned when the request is unauthorized.\n\tErrUnauthorized = errors.New(\"the inference provider rejected the request due to authentication or authorization configuration. Contact your Teleport administrator\")\n\t// ErrRejected returned when the provider rejects the request.\n\tErrRejected = errors.New(\"the inference provider rejected the request due to usage limits. Contact your Teleport administrator\")\n\t// ErrUnsupported returned when the requested endpoint is not supported.\n\tErrUnsupported = errors.New(\"teleport doesn't support the requested endpoint, please check the list of supported endpoints in the documentation\")\n\t// ErrBadResponse returned when the provider replied the request with an unsupported message or format.\n\tErrBadResponse = errors.New(\"the inference provider returned an unexpected response. Contact your Teleport administrator\")\n\t// ErrConfig returned when the app or app service are misconfigured, requiring admin intervention.\n\tErrConfig = errors.New(\"unable to serve request due to an app configuration error. Contact your Teleport administrator\")\n\t// ErrInternal returned when there is a Teleport processing error (nothing to do with the inference provider).\n\tErrInternal = errors.New(\"unable to serve the request due to an internal error. Contact your Teleport administrator\")\n\t// ErrLimitExceeded returned when Teleport rejects the request due to limit exceeded.\n\tErrLimitExceeded = errors.New(\"tokens quota exceeded. Contact your Teleport administrator\")\n\t// ErrUnknown returned when the handler could not identify the error.\n\tErrUnknown = errors.New(\"the inference provider returned an unexpected error. Contact your Teleport administrator\")\n)\n\n// ProviderError is an error in the provider format.\ntype ProviderError struct {\n\terr    error\n\tdetail string\n}\n\n// NewProviderError creates a new provider error with details.\nfunc NewProviderError(err error, detail string, args ...any) *ProviderError {\n\tif len(args) > 0 {\n\t\tdetail = fmt.Sprintf(detail, args...)","sourceCodeStart":27,"sourceCodeEnd":63,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/lib/srv/app/llm/errors/errors.go#L27-L63","documentation":"ErrConfig is a sentinel error in Teleport's LLM app proxy (lib/srv/app/llm/errors). It is returned when the Teleport app or app service itself is misconfigured — e.g. the inference provider credentials, model allowlist, or app integration settings are wrong — so the request cannot be served until an administrator fixes the configuration. It deliberately hides internals from end users and tells them to contact their Teleport administrator.","triggerScenarios":"Calling the LLM app proxy (NewRequest / findConfigFile path) when the app's provider configuration is missing or invalid, e.g. missing inference config file, bad provider settings, or app service misregistration; the handler wraps provider setup failures with ErrConfig.","commonSituations":"Admins deploy the llm app without the required config file, misconfigure the app service YAML, or reference a nonexistent provider/model; end users then see this generic contact-your-admin message.","solutions":["Check the Teleport app/app_service configuration for the LLM app and ensure the inference provider config file exists and is valid","Verify the app service logs to see which configuration field failed validation","Fix credentials/API keys/model settings in the provider config and restart the app service","If you are the end user, contact your Teleport administrator — nothing on the client side can fix it"],"exampleFix":"// before: app config missing inference settings\nkind: app\nspec:\n  uri: http://127.0.0.1\n// after: supply the required llm config\nkind: app\nspec:\n  uri: http://127.0.0.1\n  llm:\n    providers:\n      openai:\n        api_key_env: OPENAI_API_KEY","handlingStrategy":"try-catch","validationCode":"// admin: preflight the app config before users hit the app\n// teleport app config must include the llm provider settings file:\nif _, err := os.Stat(cfgPath); err != nil {\n  return fmt.Errorf(\"llm provider config missing: %w\", err)\n}","typeGuard":"func isAppConfigError(err error) bool {\n  return errors.Is(err, llmerrors.ErrConfig)\n}","tryCatchPattern":"if err := doLLMRequest(ctx, req); err != nil {\n  if errors.Is(err, llmerrors.ErrConfig) {\n    return fmt.Errorf(\"app misconfigured; contact your Teleport administrator: %w\", err)\n  }\n  return err\n}","preventionTips":["Validate the LLM app configuration during deployment with a smoke request","Keep provider config files under version control with CI validation","Watch app service logs for config load failures at startup"],"tags":["teleport","configuration","llm-proxy"],"backgroundTag":"app-configuration-error","analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}