{"record":{"id":"94f0c3502eeca258","repo":"BerriAI/litellm","slug":"exception-provider-message-this-error-occu","errorCode":null,"errorMessage":"{exception_provider} - {message}\n\n This error occurs when load balancing Responses API across deployments with different API keys.\n   Encrypted content is tied to the organization that created it and cannot be decrypted by other organizations.\n\n   Solution: Enable 'encrypted_content_affinity' to route follow-up requests to the correct deployment:\n\n   router_settings:\n     enable_pre_call_checks: true\n     optional_pre_call_checks:\n       - encrypted_content_affinity\n\n   Learn more: https://docs.litellm.ai/docs/response_api#encrypted-content-affinity-multi-region-load-balancing","messagePattern":"\\{exception_provider\\} - \\{message\\}\n\n This error occurs when load balancing Responses API across deployments with different API keys\\.\n   Encrypted content is tied to the organization that created it and cannot be decrypted by other organizations\\.\n\n   Solution: Enable 'encrypted_content_affinity' to route follow-up requests to the correct deployment:\n\n   router_settings:\n     enable_pre_call_checks: true\n     optional_pre_call_checks:\n       - encrypted_content_affinity\n\n   Learn more: https://docs\\.litellm\\.ai/docs/response_api#encrypted-content-affinity-multi-region-load-balancing","errorType":"exception","errorClass":"BadRequestError","httpStatus":400,"severity":"error","filePath":"litellm/litellm_core_utils/exception_mapping_utils.py","lineNumber":344,"sourceCode":"            message=f\"ContentPolicyViolationError: {exception_provider} - {message}\",\n            llm_provider=custom_llm_provider,\n            model=model,\n            response=getattr(original_exception, \"response\", None),\n            litellm_debug_info=extra_information,\n        )\n    elif \"invalid_encrypted_content\" in error_str or \"could not be verified\" in error_str:\n        helpful_message: Final = (\n            f\"{exception_provider} - {message}\\n\\n\"\n            \" This error occurs when load balancing Responses API across deployments with different API keys.\\n\"\n            \"   Encrypted content is tied to the organization that created it and cannot be decrypted by other organizations.\\n\\n\"\n            \"   Solution: Enable 'encrypted_content_affinity' to route follow-up requests to the correct deployment:\\n\\n\"\n            \"   router_settings:\\n\"\n            \"     enable_pre_call_checks: true\\n\"\n            \"     optional_pre_call_checks:\\n\"\n            \"       - encrypted_content_affinity\\n\\n\"\n            \"   Learn more: https://docs.litellm.ai/docs/response_api#encrypted-content-affinity-multi-region-load-balancing\"\n        )\n        raise BadRequestError(\n            message=helpful_message,\n            llm_provider=custom_llm_provider,\n            model=model,\n            response=getattr(original_exception, \"response\", None),\n            litellm_debug_info=extra_information,\n            body=getattr(original_exception, \"body\", None),\n        )\n    elif \"invalid_request_error\" in error_str and \"Incorrect API key provided\" not in error_str:\n        raise BadRequestError(\n            message=f\"{exception_provider} - {message}\",\n            llm_provider=custom_llm_provider,\n            model=model,\n            response=getattr(original_exception, \"response\", None),\n            litellm_debug_info=extra_information,\n            body=getattr(original_exception, \"body\", None),\n        )\n    elif (\n        \"Web server is returning an unknown error\" in error_str","sourceCodeStart":326,"sourceCodeEnd":362,"githubUrl":"https://github.com/BerriAI/litellm/blob/6c2dcb801bf2b75c18f1bb24140e7cf57465cc4d/litellm/litellm_core_utils/exception_mapping_utils.py#L326-L362","documentation":"Normalized BadRequestError with an appended how-to: the provider error contained 'invalid_encrypted_content' or 'could not be verified', which happens with the Responses API when encrypted reasoning/content items created by one organization (API key) are sent to a deployment under a different key — the ciphertext cannot be decrypted, so the provider rejects the request. LiteLLM's message explains enabling 'encrypted_content_affinity' routing so follow-ups return to the originating deployment.","triggerScenarios":"Load-balancing OpenAI Responses API calls across deployments with different API keys/orgs: call 1 (with encrypted reasoning items) lands on deployment A, call 2 referencing those items is routed to deployment B, provider returns invalid_encrypted_content, and this mapped error is raised.","commonSituations":"Router configs with multiple OpenAI keys/orgs for the Responses API; adding capacity mid-session; weighted routing ignoring conversation affinity; mixing proxy-managed keys from different orgs behind one model name.","solutions":["Enable affinity as the message instructs — in router settings: enable_pre_call_checks: true and optional_pre_call_checks: [encrypted_content_affinity] — so follow-ups stick to the deployment that created the encrypted content.","Alternatively route all Responses-API traffic for a given session/model to a single deployment/key (pin the deployment or remove cross-org mixing).","As a workaround, strip encrypted/reasoning items from follow-up payloads when cross-deployment replay is intended, at the cost of losing that state."],"exampleFix":"# before (config.yaml)\nrouter_settings:\n  routing_strategy: simple_shuffle   # follow-ups may hit other org's key\n# -> BadRequestError: invalid_encrypted_content ...\n\n# after\nrouter_settings:\n  enable_pre_call_checks: true\n  optional_pre_call_checks:\n    - encrypted_content_affinity","handlingStrategy":"fallback","validationCode":"null","typeGuard":"def is_encrypted_content_error(exc: BaseException) -> bool:\n    text = str(exc)\n    return \"invalid_encrypted_content\" in text or \"could not be verified\" in text","tryCatchPattern":"from litellm import BadRequestError\n\ntry:\n    resp = router.responses(model=m, input=inp)\nexcept BadRequestError as e:\n    if \"encrypted_content_affinity\" in str(e) or \"invalid_encrypted_content\" in str(e):\n        resp = router.responses(model=m, input=strip_encrypted_items(inp))  # degrade gracefully\n    else:\n        raise","preventionTips":["Enable encrypted_content_affinity pre-call checks when load-balancing the Responses API across keys/orgs.","Avoid mixing API keys from different organizations under one Responses-API model.","Keep conversation state pinned to the deployment that created it."],"tags":["responses-api","encrypted-content","load-balancing","router","affinity"],"backgroundTag":null,"analyzedSha":"6c2dcb801bf2b75c18f1bb24140e7cf57465cc4d","analyzedAt":"2026-08-15T07:12:03.035Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}