{"record":{"id":"dee6c0f6160aba62","repo":"BerriAI/litellm","slug":"jwt-issuer-self-issuer-must-configure-audience-o","errorCode":null,"errorMessage":"JWT issuer {self.issuer} must configure audience or set disable_audience_validation=True","messagePattern":"JWT issuer (.+?) must configure audience or set disable_audience_validation=True","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"litellm/proxy/_types.py","lineNumber":4457,"sourceCode":"        description=\"Issuer-specific claim path to normalize into LiteLLM's team ids.\",\n    )\n    org_id_jwt_field: str | None = Field(\n        default=None,\n        description=\"Issuer-specific claim path to normalize into LiteLLM's organization id.\",\n    )\n    end_user_id_jwt_field: str | None = Field(\n        default=None,\n        description=\"Issuer-specific claim path to normalize into LiteLLM's end-user id.\",\n    )\n\n    model_config = {\n        \"extra\": \"forbid\",\n    }\n\n    @model_validator(mode=\"after\")\n    def validate_audience_configured(self) -> \"JWTIssuerConfig\":\n        if self.audience is None and not self.disable_audience_validation:\n            raise ValueError(\n                f\"JWT issuer {self.issuer} must configure audience or set disable_audience_validation=True\"\n            )\n        if self.audience is not None and self.disable_audience_validation:\n            raise ValueError(\n                f\"JWT issuer {self.issuer} cannot set audience and disable_audience_validation=True together\"\n            )\n        return self\n\n\nclass LiteLLM_JWTAuth(LiteLLMPydanticObjectBase):\n    \"\"\"\n    A class to define the roles and permissions for a LiteLLM Proxy w/ JWT Auth.\n\n    Attributes:\n    - admin_jwt_scope: The JWT scope required for proxy admin roles.\n    - admin_allowed_routes: list of allowed routes for proxy admin roles.\n    - team_jwt_scope: The JWT scope required for proxy team roles.\n    - team_id_jwt_field: The field in the JWT token that stores the team ID. Default - `client_id`.","sourceCodeStart":4439,"sourceCodeEnd":4475,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/_types.py#L4439-L4475","documentation":"JWTIssuerConfig post-validator: an issuer entry that neither pins an audience nor explicitly disables audience validation would make token verification ambiguous, so the config is rejected. extra=forbid keeps issuer blocks strict.","triggerScenarios":"Thrown at litellm/proxy/_types.py:4457 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Configure audience for the JWT issuer, or set disable_audience_validation=True."],"exampleFix":"audience='my-api'","handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}