{"record":{"id":"f111e2f609cfc8a5","repo":"BerriAI/litellm","slug":"you-must-be-a-litellm-enterprise-user-to-use-this","errorCode":null,"errorMessage":"You must be a LiteLLM Enterprise user to use this feature. If you have a license please set `LITELLM_LICENSE` in your env. Get a 7 day trial key here: https://www.litellm.ai/enterprise#trial. \nPricing: https://www.litellm.ai/#pricing","messagePattern":"You must be a LiteLLM Enterprise user to use this feature\\. If you have a license please set `LITELLM_LICENSE` in your env\\. Get a 7 day trial key here: https://www\\.litellm\\.ai/enterprise#trial\\. \nPricing: https://www\\.litellm\\.ai/#pricing","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"enterprise/litellm_enterprise/proxy/auth/custom_sso_handler.py","lineNumber":65,"sourceCode":"            This method is typically called when a user has already been authenticated by an\n            external OAuth proxy and the proxy has added custom headers containing user information.\n            The custom handler extracts this information and converts it to an OpenID object.\n        \"\"\"\n        from fastapi_sso.sso.base import OpenID\n\n        from litellm.integrations.custom_sso_handler import CustomSSOLoginHandler\n        from litellm.proxy.proxy_server import (\n            CommonProxyErrors,\n            general_settings,\n            premium_user,\n            user_custom_ui_sso_sign_in_handler,\n        )\n        from litellm.proxy.auth.trusted_proxy_utils import (\n            require_trusted_proxy_request,\n        )\n\n        if premium_user is not True:\n            raise ValueError(CommonProxyErrors.not_premium_user.value)\n\n        if user_custom_ui_sso_sign_in_handler is None:\n            raise ValueError(\n                \"custom_ui_sso_sign_in_handler is not configured. Please set it in general_settings.\"\n            )\n\n        require_trusted_proxy_request(\n            request=request,\n            general_settings=general_settings,\n            feature_name=\"Custom UI SSO\",\n        )\n\n        custom_sso_login_handler = cast(\n            CustomSSOLoginHandler, user_custom_ui_sso_sign_in_handler\n        )\n        openid_response: OpenID = (\n            await custom_sso_login_handler.handle_custom_ui_sso_sign_in(\n                request=request,","sourceCodeStart":47,"sourceCodeEnd":83,"githubUrl":"https://github.com/BerriAI/litellm/blob/6c2dcb801bf2b75c18f1bb24140e7cf57465cc4d/enterprise/litellm_enterprise/proxy/auth/custom_sso_handler.py#L47-L83","documentation":"ValueError from the enterprise custom SSO sign-in flow: it requires premium_user is True. When the proxy does not have a valid enterprise license, invoking the custom UI SSO sign-in handler raises CommonProxyErrors.not_premium_user before any SSO logic runs.","triggerScenarios":"Enabling custom_ui_sso_sign_in_handler in general_settings and hitting the SSO sign-in route on a proxy without a valid LITELLM_LICENSE. The premium check is the first gate in the handler.","commonSituations":"Building a custom SSO integration during evaluation without a trial key; license expired mid-development; LITELLM_LICENSE present in the shell but not in the systemd unit/Docker env so the proxy never saw it.","solutions":["Set LITELLM_LICENSE to a valid enterprise key in the proxy's environment and restart (trial keys available at litellm.ai/enterprise#trial)","Without a license, remove custom_ui_sso_sign_in_handler from general_settings and use built-in SSO (Google/Azure/Okta/OIDC) instead","Confirm premium_user resolves True by checking startup logs for license validation"],"exampleFix":"# before\ngeneral_settings:\n  custom_ui_sso_sign_in_handler: my_module.handler\n# no license -> ValueError on sign-in\n\n# after\nexport LITELLM_LICENSE=<valid-key>\n# keep general_settings as-is, restart proxy","handlingStrategy":"validation","validationCode":"def can_use_custom_sso() -> bool:\n    return os.environ.get('LITELLM_LICENSE') is not None\n# plus a post-deploy canary hit of the SSO endpoint","typeGuard":null,"tryCatchPattern":"try:\n    resp = httpx.get(f'{PROXY_URL}/sso/ui/sign-in', params=p)\nexcept ValueError as e:\n    if 'not_premium_user' in str(e):\n        raise ConfigError('custom UI SSO needs an enterprise license') from e\n    raise","preventionTips":["Deploy LITELLM_LICENSE alongside any config referencing custom SSO","Gate custom-SSO config behind a feature flag that checks license presence in CI"],"tags":["licensing","sso","auth","litellm-enterprise","configuration"],"backgroundTag":null,"analyzedSha":"6c2dcb801bf2b75c18f1bb24140e7cf57465cc4d","analyzedAt":"2026-08-15T07:12:03.035Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}