{"record":{"id":"d89172cf047f8186","repo":"BerriAI/litellm","slug":"failed-to-decrypt-state-parameter","errorCode":null,"errorMessage":"Failed to decrypt state parameter","messagePattern":"Failed to decrypt state parameter","errorType":"exception","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py","lineNumber":191,"sourceCode":"    return encrypted_state\n\n\ndef decode_state_hash(encrypted_state: str) -> dict:\n    \"\"\"\n    Decode an encrypted state to retrieve all OAuth session data.\n\n    Args:\n        encrypted_state: The encrypted string to decode\n\n    Returns:\n        A dict containing base_url, original_state, and optional PKCE parameters\n\n    Raises:\n        Exception: If decryption fails or data is malformed\n    \"\"\"\n    decrypted_json: Final = decrypt_value_helper(encrypted_state, \"oauth_state\")\n    if decrypted_json is None:\n        raise ValueError(\"Failed to decrypt state parameter\")\n\n    state_data: Final = json.loads(decrypted_json)\n    return state_data\n\n\n_BRIDGE_AUTH_CODE_PREFIX: Final = \"llm_bcode_\"\n\n\nclass _BridgeAuthorizationCode(BaseModel):\n    \"\"\"The identity and upstream code the gateway seals into the authorization code it hands a DCR\n    client for an interactive dcr_bridge oauth_delegate sign-in, recovered at the token endpoint.\"\"\"\n\n    model_config = ConfigDict(frozen=True)\n    upstream_code: str = Field(min_length=1)\n    litellm_user_id: str = Field(min_length=1)\n    mcp_server_id: str = Field(min_length=1)\n\n","sourceCodeStart":173,"sourceCodeEnd":209,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py#L173-L209","documentation":"Generic decryption-failure sentinel in decode_state_hash: decrypt_value_helper returned None for the encrypted OAuth state (wrong key, tampering, or corruption), so the embedded OAuth session data cannot be recovered and the flow restarts.","triggerScenarios":"Thrown at litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py:191 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Do not modify the state parameter; it must round-trip intact.","Check the encryption key is stable across proxy restarts."],"exampleFix":"Pass the state value back exactly as received.","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}