{"record":{"id":"dbe619c9fb315b94","repo":"BerriAI/litellm","slug":"server-misconfigured-master-key-is-not-set","errorCode":null,"errorMessage":"Server misconfigured: master_key is not set","messagePattern":"Server misconfigured: master_key is not set","errorType":"http","errorClass":"HTTPException","httpStatus":500,"severity":"error","filePath":"litellm/proxy/_experimental/mcp_server/auth/user_api_key_auth_mcp.py","lineNumber":783,"sourceCode":"        snapshot frozen at mint time. The inner upstream token is injected under the\n        server's per-server auth-header key so egress forwards it via the\n        ``PassthroughConfig`` override; the envelope ``Authorization`` the leak-defense\n        strips never reaches the upstream. A new headers dict is returned rather than\n        mutating the input. Fails closed with a 401 on an invalid or expired envelope, or\n        when the referenced key is missing, blocked, or expired, its owner is\n        SCIM-deactivated, or the centralized policy gate rejects it (blocked team or\n        project, org or budget limits).\n\n        The sealed token is keyed alias-first, matching the order egress resolves\n        (``lookup_mcp_server_auth_in_headers`` tries ``alias`` before ``server_name``). Keying\n        under ``server_name`` would leave a caller-supplied ``x-mcp-{alias}-authorization`` at the\n        higher-priority alias slot, pairing the admitted identity with an attacker's upstream\n        credential; the alias-keyed injection overwrites any such caller value.\n        \"\"\"\n        from litellm.proxy.proxy_server import master_key\n\n        if not master_key:\n            raise HTTPException(status_code=500, detail=\"Server misconfigured: master_key is not set\")\n\n        await MCPRequestHandler._run_pre_db_read_auth_checks(request=request, route=route)\n\n        keys: Final = envelope_keys_from_master_key(master_key)\n        result: Final = resolve_bridge_envelope(authorization_value, keys, datetime.now(timezone.utc), server.server_id)\n        match result:\n            case BridgeEnvelopeAdmitted():\n                header_key: Final = server.alias or server.server_name\n                if header_key is None:\n                    raise HTTPException(status_code=500, detail=\"Server misconfigured: MCP server has no routable name\")\n                admitted: Final = await MCPRequestHandler._reload_admitted_principal(result.identity)\n                await MCPRequestHandler._enforce_admitted_live_policy(admitted=admitted, request=request, route=route)\n                injected: Final = {header_key: {\"Authorization\": result.upstream_authorization.get_secret_value()}}\n                new_headers: Final = {**(mcp_server_auth_headers or {}), **injected}\n                return admitted, new_headers\n            case BridgeEnvelopeInvalid() | NotBridgeEnvelope():\n                raise HTTPException(status_code=401, detail=\"Invalid or expired credential\")\n            case _:","sourceCodeStart":765,"sourceCodeEnd":801,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/_experimental/mcp_server/auth/user_api_key_auth_mcp.py#L765-L801","documentation":"HTTP 500 from the MCP bridge-envelope minting path: the proxy's master_key is unset, so the envelope encryption keys derived from it cannot exist. This is a server configuration problem (master_key env/config), not a caller error.","triggerScenarios":"Thrown at litellm/proxy/_experimental/mcp_server/auth/user_api_key_auth_mcp.py:783 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Set the proxy master_key in config or LITELLM_MASTER_KEY env var."],"exampleFix":"general_settings: {master_key: sk-...}","handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}