unable to serve the request due to an internal error. Contac

Error message

unable to serve the request due to an internal error. Contact your Teleport administrator

What it means

ErrInternal is a sentinel in lib/srv/app/llm/errors representing an internal Teleport processing failure while proxying an LLM request — the problem is inside Teleport, not with the inference provider or the user. Like the other LLM sentinels it hides details from the client and asks the user to contact the administrator. Note: the fido2_test.go usages reference a different, unrelated libfido2.ErrInternal.

Source

Thrown at lib/srv/app/llm/errors/errors.go:47

var (
	// ErrTimeout returned when the request times out.
	ErrTimeout = errors.New("the request timed out. Try again or use streaming for long responses")
	// ErrBadRequest returned when the request has bad format or invalid fields.
	ErrBadRequest = errors.New("the inference provider rejected the request as invalid. Check the request body for unsupported or invalid fields")
	// ErrCanceled returned when the request is canceled.
	ErrCanceled = errors.New("the request was canceled")
	// ErrUnauthorized returned when the request is unauthorized.
	ErrUnauthorized = errors.New("the inference provider rejected the request due to authentication or authorization configuration. Contact your Teleport administrator")
	// ErrRejected returned when the provider rejects the request.
	ErrRejected = errors.New("the inference provider rejected the request due to usage limits. Contact your Teleport administrator")
	// ErrUnsupported returned when the requested endpoint is not supported.
	ErrUnsupported = errors.New("teleport doesn't support the requested endpoint, please check the list of supported endpoints in the documentation")
	// ErrBadResponse returned when the provider replied the request with an unsupported message or format.
	ErrBadResponse = errors.New("the inference provider returned an unexpected response. Contact your Teleport administrator")
	// ErrConfig returned when the app or app service are misconfigured, requiring admin intervention.
	ErrConfig = errors.New("unable to serve request due to an app configuration error. Contact your Teleport administrator")
	// ErrInternal returned when there is a Teleport processing error (nothing to do with the inference provider).
	ErrInternal = errors.New("unable to serve the request due to an internal error. Contact your Teleport administrator")
	// ErrLimitExceeded returned when Teleport rejects the request due to limit exceeded.
	ErrLimitExceeded = errors.New("tokens quota exceeded. Contact your Teleport administrator")
	// ErrUnknown returned when the handler could not identify the error.
	ErrUnknown = errors.New("the inference provider returned an unexpected error. Contact your Teleport administrator")
)

// ProviderError is an error in the provider format.
type ProviderError struct {
	err    error
	detail string
}

// NewProviderError creates a new provider error with details.
func NewProviderError(err error, detail string, args ...any) *ProviderError {
	if len(args) > 0 {
		detail = fmt.Sprintf(detail, args...)
	}
	return &ProviderError{err, detail}

View on GitHub (pinned to 1283425b60)

Solutions

Inspect the app service logs for the underlying wrapped error to find the real internal cause
Retry the request — transient internal failures often resolve
Verify the app service's connectivity and resource limits (memory, file descriptors)
If persistent, report with logs/trace to the Teleport administrators or maintainers

Defensive patterns

Strategy: retry

Validate before calling

// ensure app service can reach the provider endpoint before dispatching
conn, err := net.DialTimeout("tcp", providerHostPort, 5*time.Second)
if err != nil { return fmt.Errorf("provider unreachable: %w", err) }
conn.Close()

Type guard

func isInternalError(err error) bool {
  return errors.Is(err, llmerrors.ErrInternal)
}

Try / catch

err := doLLMRequest(ctx, req)
if errors.Is(err, llmerrors.ErrInternal) {
  return retry.WithBackoff(ctx, 3, func() error { return doLLMRequest(ctx, req) })
}

Prevention

Monitor app service health and provider connectivity
Retry idempotent LLM requests with exponential backoff
Keep app service resources (memory, fds) adequately provisioned

When it happens

Trigger: Errors returned by StatusCodeFromErr/HandleError that do not match any specific sentinel (ErrUnauthorized, ErrRejected, ErrUnsupported, ErrConfig, ErrLimitExceeded) but are not provider errors either, e.g. failures writing the request to the provider, streaming interruptions, or local resource errors during request handling.

Common situations: Network interruption between app service and provider proxy, failed request marshaling, or an unexpected panic/recovery in the LLM handler path.

Related errors

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/a9d0a73949a92c95. Report an issue: GitHub.