{"record":{"id":"f111e2f609cfc8a5","repo":"BerriAI/litellm","slug":"you-must-be-a-litellm-enterprise-user-to-use-this","errorCode":null,"errorMessage":"You must be a LiteLLM Enterprise user to use this feature. If you have a license please set `LITELLM_LICENSE` in your env. Get a 7 day trial key here: https://www.litellm.ai/enterprise#trial. \nPricing: https://www.litellm.ai/#pricing","messagePattern":"You must be a LiteLLM Enterprise user to use this feature\\. If you have a license please set `LITELLM_LICENSE` in your env\\. Get a 7 day trial key here: https://www\\.litellm\\.ai/enterprise#trial\\. \nPricing: https://www\\.litellm\\.ai/#pricing","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"enterprise/litellm_enterprise/proxy/auth/custom_sso_handler.py","lineNumber":65,"sourceCode":"            This method is typically called when a user has already been authenticated by an\n            external OAuth proxy and the proxy has added custom headers containing user information.\n            The custom handler extracts this information and converts it to an OpenID object.\n        \"\"\"\n        from fastapi_sso.sso.base import OpenID\n\n        from litellm.integrations.custom_sso_handler import CustomSSOLoginHandler\n        from litellm.proxy.proxy_server import (\n            CommonProxyErrors,\n            general_settings,\n            premium_user,\n            user_custom_ui_sso_sign_in_handler,\n        )\n        from litellm.proxy.auth.trusted_proxy_utils import (\n            require_trusted_proxy_request,\n        )\n\n        if premium_user is not True:\n            raise ValueError(CommonProxyErrors.not_premium_user.value)\n\n        if user_custom_ui_sso_sign_in_handler is None:\n            raise ValueError(\n                \"custom_ui_sso_sign_in_handler is not configured. Please set it in general_settings.\"\n            )\n\n        require_trusted_proxy_request(\n            request=request,\n            general_settings=general_settings,\n            feature_name=\"Custom UI SSO\",\n        )\n\n        custom_sso_login_handler = cast(\n            CustomSSOLoginHandler, user_custom_ui_sso_sign_in_handler\n        )\n        openid_response: OpenID = (\n            await custom_sso_login_handler.handle_custom_ui_sso_sign_in(\n                request=request,","sourceCodeStart":47,"sourceCodeEnd":83,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/enterprise/litellm_enterprise/proxy/auth/custom_sso_handler.py#L47-L83","documentation":"Raised as a ValueError when a custom UI SSO sign-in is attempted and the proxy's premium_user flag is not True. LiteLLM gates custom SSO login handlers behind an Enterprise license; the check runs before any handler code executes. The message is the standard not_premium_user text pointing to LITELLM_LICENSE and the trial/pricing pages.","triggerScenarios":"Configuring general_settings.custom_ui_sso_sign_in_handler (or hitting the /sso/custom-login style route that calls this handler) on a proxy running without a valid LITELLM_LICENSE, with an expired license, or before the license verification has run (premium_user still defaults to False at import time).","commonSituations":"Self-hosting LiteLLM with enterprise features copied from an enterprise config, license expired or not propagated into the container env, license key validated but the call happens in a worker/process that never loaded the premium check, or a typo'd LITELLM_LICENSE value.","solutions":["Set a valid LITELLM_LICENSE in the proxy environment and restart: export LITELLM_LICENSE=<key>","Verify premium status at runtime via the proxy's enterprise/premium endpoints or startup logs (look for 'Premium User' verification)","If you do not have a license, remove custom_ui_sso_sign_in_handler from general_settings and use the built-in SSO (Google/Azure AD/Okta) instead","Get a 7-day trial key from https://www.litellm.ai/enterprise#trial to evaluate before purchasing","If the license is valid but the error persists, check that all replicas/workers receive LITELLM_LICENSE (e.g. k8s secret mounted env)"],"exampleFix":"# before\n# general_settings.custom_ui_sso_sign_in_handler set, but no license\n# -> ValueError: not_premium_user\n\n# after (docker-compose)\nenvironment:\n  LITELLM_LICENSE: \"${LITELLM_LICENSE}\"","handlingStrategy":"validation","validationCode":"# Before enabling custom UI SSO, assert premium status\nimport litellm.proxy.proxy_server as ps\nif getattr(ps, \"premium_user\", False) is not True:\n    raise SystemExit(\"LITELLM_LICENSE missing/invalid - custom UI SSO disabled\")","typeGuard":null,"tryCatchPattern":"try:\n    await custom_sso_login(request)\nexcept ValueError as e:\n    if \"not_premium_user\" in str(e) or \"Enterprise user\" in str(e):\n        return RedirectResponse(\"/sso/keycloak\")  # fall back to built-in SSO\n    raise","preventionTips":["Gate enterprise features behind a startup check on premium_user","Keep LITELLM_LICENSE in a managed secret mounted into every replica","Run a canary request against the custom SSO route after deploys"],"tags":["litellm","enterprise","license","premium","sso","valueerror"],"backgroundTag":"license-required","analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}