{"record":{"id":"b99e3252bf6acc86","repo":"BerriAI/litellm","slug":"actions-id-token-request-url-or-actions-id-token-r","errorCode":null,"errorMessage":"ACTIONS_ID_TOKEN_REQUEST_URL or ACTIONS_ID_TOKEN_REQUEST_TOKEN not found in environment","messagePattern":"ACTIONS_ID_TOKEN_REQUEST_URL or ACTIONS_ID_TOKEN_REQUEST_TOKEN not found in environment","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"litellm/secret_managers/main.py","lineNumber":249,"sourceCode":"                raise ValueError(\"Google OIDC provider failed\")\n        elif oidc_provider == \"circleci\":\n            # https://circleci.com/docs/openid-connect-tokens/\n            env_secret = os.getenv(\"CIRCLE_OIDC_TOKEN\")\n            if env_secret is None:\n                raise ValueError(\"CIRCLE_OIDC_TOKEN not found in environment\")\n            return env_secret\n        elif oidc_provider == \"circleci_v2\":\n            # https://circleci.com/docs/openid-connect-tokens/\n            env_secret = os.getenv(\"CIRCLE_OIDC_TOKEN_V2\")\n            if env_secret is None:\n                raise ValueError(\"CIRCLE_OIDC_TOKEN_V2 not found in environment\")\n            return env_secret\n        elif oidc_provider == \"github\":\n            # https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-cloud-providers#using-custom-actions\n            actions_id_token_request_url: Final = os.getenv(\"ACTIONS_ID_TOKEN_REQUEST_URL\")\n            actions_id_token_request_token: Final = os.getenv(\"ACTIONS_ID_TOKEN_REQUEST_TOKEN\")\n            if actions_id_token_request_url is None or actions_id_token_request_token is None:\n                raise ValueError(\n                    \"ACTIONS_ID_TOKEN_REQUEST_URL or ACTIONS_ID_TOKEN_REQUEST_TOKEN not found in environment\"\n                )\n\n            oidc_token = oidc_cache.get_cache(key=secret_name)\n            if oidc_token is not None:\n                return oidc_token\n\n            oidc_client = _get_oidc_http_handler()\n            response = oidc_client.get(\n                actions_id_token_request_url,\n                params={\"audience\": oidc_aud},\n                headers={\n                    \"Authorization\": f\"Bearer {actions_id_token_request_token}\",\n                    \"Accept\": \"application/json; api-version=2.0\",\n                },\n            )\n            if response.status_code == 200:\n                oidc_token = response.json().get(\"value\", None)","sourceCodeStart":231,"sourceCodeEnd":267,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/secret_managers/main.py#L231-L267","documentation":"Guard in the github OIDC branch: one of ACTIONS_ID_TOKEN_REQUEST_URL or ACTIONS_ID_TOKEN_REQUEST_TOKEN is unset. These are normally injected into GitHub Actions runners; missing values mean the code is not running inside Actions with an id-token permission.","triggerScenarios":"Thrown at litellm/secret_managers/main.py:249 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Request the OIDC token inside a GitHub Actions job with 'permissions: id-token: write' so ACTIONS_ID_TOKEN_REQUEST_URL and ACTIONS_ID_TOKEN_REQUEST_TOKEN are injected."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}