{"record":{"id":"e4515b97a3ff0be5","repo":"BerriAI/litellm","slug":"jwt-issuer-self-issuer-cannot-set-audience-and-d","errorCode":null,"errorMessage":"JWT issuer {self.issuer} cannot set audience and disable_audience_validation=True together","messagePattern":"JWT issuer (.+?) cannot set audience and disable_audience_validation=True together","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"litellm/proxy/_types.py","lineNumber":4461,"sourceCode":"        description=\"Issuer-specific claim path to normalize into LiteLLM's organization id.\",\n    )\n    end_user_id_jwt_field: str | None = Field(\n        default=None,\n        description=\"Issuer-specific claim path to normalize into LiteLLM's end-user id.\",\n    )\n\n    model_config = {\n        \"extra\": \"forbid\",\n    }\n\n    @model_validator(mode=\"after\")\n    def validate_audience_configured(self) -> \"JWTIssuerConfig\":\n        if self.audience is None and not self.disable_audience_validation:\n            raise ValueError(\n                f\"JWT issuer {self.issuer} must configure audience or set disable_audience_validation=True\"\n            )\n        if self.audience is not None and self.disable_audience_validation:\n            raise ValueError(\n                f\"JWT issuer {self.issuer} cannot set audience and disable_audience_validation=True together\"\n            )\n        return self\n\n\nclass LiteLLM_JWTAuth(LiteLLMPydanticObjectBase):\n    \"\"\"\n    A class to define the roles and permissions for a LiteLLM Proxy w/ JWT Auth.\n\n    Attributes:\n    - admin_jwt_scope: The JWT scope required for proxy admin roles.\n    - admin_allowed_routes: list of allowed routes for proxy admin roles.\n    - team_jwt_scope: The JWT scope required for proxy team roles.\n    - team_id_jwt_field: The field in the JWT token that stores the team ID. Default - `client_id`.\n    - team_allowed_routes: list of allowed routes for proxy team roles.\n    - user_id_jwt_field: The field in the JWT token that stores the user id (maps to `LiteLLMUserTable`). Use this for internal employees.\n    - user_email_jwt_field: The field in the JWT token that stores the user email (maps to `LiteLLMUserTable`). Use this for internal employees.\n    - user_allowed_email_subdomain: If specified, only emails from specified subdomain will be allowed to access proxy.","sourceCodeStart":4443,"sourceCodeEnd":4479,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/_types.py#L4443-L4479","documentation":"Model validator on JWTIssuerConfig: the issuer sets an audience while also disabling audience validation — a contradictory configuration that would silently weaken validation, so it is rejected at load time.","triggerScenarios":"Thrown at litellm/proxy/_types.py:4461 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Set either audience or disable_audience_validation=True, not both."],"exampleFix":"Remove audience when disable_audience_validation=True.","handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}