{"record":{"id":"e6cb49f6cdb510a0","repo":"BerriAI/litellm","slug":"generic-token-endpoint-must-be-set-when-pkce-is-en","errorCode":null,"errorMessage":"GENERIC_TOKEN_ENDPOINT must be set when PKCE is enabled","messagePattern":"GENERIC_TOKEN_ENDPOINT must be set when PKCE is enabled","errorType":"http","errorClass":"ProxyException","httpStatus":401,"severity":"error","filePath":"litellm/proxy/management_endpoints/ui_sso.py","lineNumber":1615,"sourceCode":"                    param=\"state\",\n                    code=status.HTTP_400_BAD_REQUEST,\n                )\n            if not authorization_code:\n                raise ProxyException(\n                    message=\"Missing authorization code in callback\",\n                    type=ProxyErrorTypes.auth_error,\n                    param=\"code\",\n                    code=status.HTTP_400_BAD_REQUEST,\n                )\n            if not generic_client_id:\n                raise ProxyException(\n                    message=\"GENERIC_CLIENT_ID must be set when PKCE is enabled\",\n                    type=ProxyErrorTypes.auth_error,\n                    param=\"GENERIC_CLIENT_ID\",\n                    code=status.HTTP_401_UNAUTHORIZED,\n                )\n            if not generic_token_endpoint:\n                raise ProxyException(\n                    message=\"GENERIC_TOKEN_ENDPOINT must be set when PKCE is enabled\",\n                    type=ProxyErrorTypes.auth_error,\n                    param=\"GENERIC_TOKEN_ENDPOINT\",\n                    code=status.HTTP_401_UNAUTHORIZED,\n                )\n            # All guards above raise, so authorization_code is a non-empty str here.\n            # Use an explicit type guard rather than assert (assert is a no-op with -O).\n            if not isinstance(authorization_code, str):\n                raise ProxyException(\n                    message=\"Missing authorization code in callback\",\n                    type=ProxyErrorTypes.auth_error,\n                    param=\"code\",\n                    code=status.HTTP_400_BAD_REQUEST,\n                )\n            combined_response: Final = await SSOAuthenticationHandler._pkce_token_exchange(\n                authorization_code=authorization_code,\n                code_verifier=code_verifier,\n                client_id=generic_client_id,","sourceCodeStart":1597,"sourceCodeEnd":1633,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/management_endpoints/ui_sso.py#L1597-L1633","documentation":"Error \"GENERIC_TOKEN_ENDPOINT must be set when PKCE is enabled\" thrown in BerriAI/litellm.","triggerScenarios":"Thrown at litellm/proxy/management_endpoints/ui_sso.py:1615 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Set GENERIC_TOKEN_ENDPOINT in the environment when PKCE is enabled, then restart."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}