{"record":{"id":"e5e62d4df8749658","repo":"BerriAI/litellm","slug":"google-oidc-provider-failed","errorCode":null,"errorMessage":"Google OIDC provider failed","messagePattern":"Google OIDC provider failed","errorType":"exception","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"litellm/secret_managers/main.py","lineNumber":231,"sourceCode":"            response = oidc_client.get(\n                \"http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/identity\",\n                params={\"audience\": oidc_aud},\n                headers={\"Metadata-Flavor\": \"Google\"},\n            )\n            if response.status_code == 200:\n                oidc_token = response.text\n                ttl: Final = _oidc_token_cache_ttl(oidc_token, 3600 - 60)\n                if ttl > 0:\n                    oidc_cache.set_cache(key=secret_name, value=oidc_token, ttl=ttl)\n                else:\n                    verbose_logger.warning(\n                        \"Google OIDC token for %s is already expired or expires within %ss; not caching it\",\n                        secret_name,\n                        _OIDC_TOKEN_EXPIRY_MARGIN_SECONDS,\n                    )\n                return oidc_token\n            else:\n                raise ValueError(\"Google OIDC provider failed\")\n        elif oidc_provider == \"circleci\":\n            # https://circleci.com/docs/openid-connect-tokens/\n            env_secret = os.getenv(\"CIRCLE_OIDC_TOKEN\")\n            if env_secret is None:\n                raise ValueError(\"CIRCLE_OIDC_TOKEN not found in environment\")\n            return env_secret\n        elif oidc_provider == \"circleci_v2\":\n            # https://circleci.com/docs/openid-connect-tokens/\n            env_secret = os.getenv(\"CIRCLE_OIDC_TOKEN_V2\")\n            if env_secret is None:\n                raise ValueError(\"CIRCLE_OIDC_TOKEN_V2 not found in environment\")\n            return env_secret\n        elif oidc_provider == \"github\":\n            # https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-cloud-providers#using-custom-actions\n            actions_id_token_request_url: Final = os.getenv(\"ACTIONS_ID_TOKEN_REQUEST_URL\")\n            actions_id_token_request_token: Final = os.getenv(\"ACTIONS_ID_TOKEN_REQUEST_TOKEN\")\n            if actions_id_token_request_url is None or actions_id_token_request_token is None:\n                raise ValueError(","sourceCodeStart":213,"sourceCodeEnd":249,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/secret_managers/main.py#L213-L249","documentation":"OIDC resolution failure for the 'google' provider: the request to the GCP metadata server for a service-account identity token returned a non-200 status (metadata server unreachable or the audience rejected), so no token can be returned to the caller.","triggerScenarios":"Thrown at litellm/secret_managers/main.py:231 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify GOOGLE_APPLICATION_CREDENTIALS/metadata server access so google-auth can fetch an ID token.","Check the audience value and network access to Google token endpoints."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}