{"record":{"id":"ac13e2146ae1109e","repo":"BerriAI/litellm","slug":"this-mcp-server-does-not-support-byok-credentials","errorCode":null,"errorMessage":"This MCP server does not support BYOK credentials","messagePattern":"This MCP server does not support BYOK credentials","errorType":"http","errorClass":"HTTPException","httpStatus":400,"severity":"error","filePath":"litellm/proxy/management_endpoints/mcp_management_endpoints.py","lineNumber":2048,"sourceCode":"        return Response(status_code=status.HTTP_202_ACCEPTED)\n\n    @router.post(\n        \"/server/{server_id}/user-credential\",\n        description=\"Store or update the calling user's API key for a BYOK MCP server\",\n        dependencies=[Depends(user_api_key_auth)],\n        response_model=MCPUserCredentialResponse,\n    )\n    @management_endpoint_wrapper\n    async def store_mcp_user_credential(\n        server_id: str,\n        payload: MCPUserCredentialRequest,\n        user_api_key_dict: UserAPIKeyAuth = Depends(user_api_key_auth),\n    ):\n        \"\"\"Store a BYOK credential for the calling user.\"\"\"\n        prisma_client: Final = get_prisma_client_or_throw(\"Database not connected. Connect a database to your proxy\")\n        mcp_server: Final = await _authorize_and_fetch_mcp_server(prisma_client, user_api_key_dict, server_id)\n        if not getattr(mcp_server, \"is_byok\", False):\n            raise HTTPException(\n                status_code=status.HTTP_400_BAD_REQUEST,\n                detail={\"error\": \"This MCP server does not support BYOK credentials\"},\n            )\n        user_id: Final = user_api_key_dict.user_id or \"\"\n        if not user_id:\n            raise HTTPException(\n                status_code=status.HTTP_400_BAD_REQUEST,\n                detail={\"error\": \"User ID not found in token\"},\n            )\n        if payload.save:\n            await store_user_credential(prisma_client, user_id, server_id, payload.credential)\n            from litellm.proxy._experimental.mcp_server.server import (\n                _invalidate_byok_cred_cache,\n            )\n\n            _invalidate_byok_cred_cache(user_id, server_id)\n            return MCPUserCredentialResponse(server_id=server_id, has_credential=True)\n        # save=False: credential not persisted","sourceCodeStart":2030,"sourceCodeEnd":2066,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/management_endpoints/mcp_management_endpoints.py#L2030-L2066","documentation":"Returned (400) by the store-BYOK-credential endpoint when the target MCP server was fetched successfully but does not carry the is_byok flag (checked with getattr(mcp_server, 'is_byok', False)). BYOK (bring-your-own-key) credential storage is only meaningful for servers explicitly created to accept per-user credentials, so all other servers are rejected before any credential is written.","triggerScenarios":"POST to the per-user credential store endpoint for a regular server created without the BYOK/authenticate option; UI 'add my credential' flow run against a server that uses shared server-side credentials; calling the endpoint by iterating all servers generically.","commonSituations":"Server created from a plain URL template (shared credentials) and later expected to support per-user keys; UI affordance shown for servers where it does not apply; env mismatch where the BYOK-enabled server exists in another environment.","solutions":["Check the server definition and confirm it was created as a BYOK/authenticate-enabled MCP server.","Re-create (or update) the server with the BYOK/authenticate option enabled, then store the user credential.","If shared credentials are intended, configure them on the server definition instead of per-user credential storage."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"server = requests.get(f\"{PROXY}/v1/mcp/server/{server_id}\", headers=AUTH).json().get(\"mcp_server\", {})\nif not server.get(\"is_byok\"):\n    raise ValueError(\"server is not BYOK-enabled; recreate it with the authenticate/byok option\")","typeGuard":"def supports_byok(server: dict) -> bool:\n    return bool(server.get(\"is_byok\"))","tryCatchPattern":"try:\n    store_credential(server_id, cred)\nexcept HTTPError as e:\n    if e.response.status_code == 400 and \"BYOK\" in e.response.text:\n        raise ValueError(\"enable BYOK on the server definition first\")\n    raise","preventionTips":["Check is_byok on the server detail before offering the 'store my credential' action.","Create BYOK-enabled servers deliberately; do not convert shared-credential servers implicitly."],"tags":["litellm","mcp","byok","credentials","validation"],"backgroundTag":"unsupported-feature","analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}