{"record":{"id":"ae07573dff31f887","repo":"BerriAI/litellm","slug":"invalid-proxy-server-token-passed-valid-token-non","errorCode":null,"errorMessage":"Invalid proxy server token passed. valid_token=None.","messagePattern":"Invalid proxy server token passed\\. valid_token=None\\.","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"litellm/proxy/auth/auth_checks.py","lineNumber":999,"sourceCode":"        return LitellmUserRoles.INTERNAL_USER\n\n    return role\n\n\ndef _is_api_route_allowed(\n    route: str,\n    request: Request,\n    request_data: dict,\n    valid_token: UserAPIKeyAuth | None,\n    user_obj: LiteLLM_UserTable | None = None,\n) -> bool:\n    \"\"\"\n    - Route b/w api token check and normal token check\n    \"\"\"\n    _user_role: Final = _get_user_role(user_obj=user_obj)\n\n    if valid_token is None:\n        raise Exception(\"Invalid proxy server token passed. valid_token=None.\")\n\n    if not _is_user_proxy_admin(user_obj=user_obj):  # if non-admin\n        RouteChecks.non_proxy_admin_allowed_routes_check(\n            user_obj=user_obj,\n            _user_role=_user_role,\n            route=route,\n            request=request,\n            request_data=request_data,\n            valid_token=valid_token,\n        )\n    return True\n\n\ndef _is_user_proxy_admin(user_obj: LiteLLM_UserTable | None):\n    if user_obj is None:\n        return False\n\n    if user_obj.user_role is not None and user_obj.user_role == LitellmUserRoles.PROXY_ADMIN.value:","sourceCodeStart":981,"sourceCodeEnd":1017,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/auth/auth_checks.py#L981-L1017","documentation":"Raised in _is_api_route_allowed when the route-authorization step runs with valid_token=None, i.e. user_api_key_auth could not resolve the presented bearer token to any virtual key or master key. It indicates the request reached the allowed-routes check with no authenticated identity at all.","triggerScenarios":"Calling a proxy route with an unknown, deleted, or malformed key in the Authorization header; keys whose lookup returns None (DB absent so key rows cannot load, rotated key still in use, key value with trailing whitespace/newline from env expansion).","commonSituations":"Key rotated or revoked but clients still hold the old value; DATABASE_URL missing so virtual keys cannot be resolved; copied key with a stray newline from a .env file or k8s secret; hitting the wrong port with an upstream provider key.","solutions":["Verify the key exists and is active: GET /key/info?key=sk-... with an admin key","Regenerate the key and redeploy it to clients, checking for trailing whitespace/newlines","Confirm the proxy has a database connected (virtual keys are DB-backed)","Check the Authorization header format is exactly 'Bearer <key>'"],"exampleFix":"# before\nAPI_KEY=\"sk-abc123\\n\"  # stray newline from env file\n\n# after\nAPI_KEY=$(echo -n \"$API_KEY\" | tr -d '\\n')\n# or fix the .env / secret so no newline is stored","handlingStrategy":"try-catch","validationCode":"# preflight: confirm the key resolves before real traffic (admin key required)\ndef key_is_valid(proxy_url: str, admin_key: str, key: str) -> bool:\n    resp = requests.get(\n        f\"{proxy_url}/key/info\",\n        params={\"key\": key.strip()},\n        headers={\"Authorization\": f\"Bearer {admin_key}\"},\n    )\n    return resp.status_code == 200","typeGuard":null,"tryCatchPattern":"try:\n    resp = client.chat.completions.create(model=\"gpt-4o\", messages=messages)\nexcept Exception as e:\n    if \"Invalid proxy server token\" in str(e) or \"valid_token=None\" in str(e):\n        raise PermissionError(\"key not recognized by proxy - check/rotate it\") from e\n    raise","preventionTips":["Strip whitespace/newlines from keys loaded from env files or secrets","Verify keys with /key/info after rotation or DB restores","Ensure the proxy has DATABASE_URL set so virtual keys can resolve"],"tags":["auth","api-key","invalid-token","litellm-proxy"],"backgroundTag":"invalid-api-key","analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}