6 views
-/https://github.com/berriai/litellm/issues/26424
GitHub · issue

#26424 auth_exception_handler logs 401/403 permission denials at ERROR level with full traceback (should be WARNING)

  • State: open
  • Author: @netblack

## Bug Description

When a user attempts to call a model they don't have permission to access, LiteLLM logs the event at **ERROR** level with a full traceback in `auth_exception_handler.py`. This is noisy and misleading — a permission denial is expected behavior, not a service error.

## Steps to Reproduce

1. Create a user with restricted `models` (e.g. `['common-models']`) 2. Call a model outside their allowed group (e.g. `claude-opus-4-7` when only `common-models` is permitted) 3. Observe logs

## Current Behavior

``` 20:24:13 - LiteLLM Proxy:ERROR: auth_exception_handler.py:78 - litellm.proxy.proxy_server.user_api_key_auth(): Exception occured - Requester IP Address:172.18.0.2 Traceback (most recent call last): File ".../user_api_key_auth.py", line 1508, in _user_api_key_auth_builder _ = await common_checks(...) File ".../auth_checks.py", line 494, in common_checks await can_user_call_model(...) File ".../auth_checks.py", line 2877, in can_user_call_model return _can_object_call_model(...) File ".../auth_checks.py", line 2706, in _can_object_call_model raise ProxyException(...) litellm.proxy._types.ProxyException INFO: "POST /chat/completions HTTP/1.1"…

GitHub resolver

Import GitHub neighbors on demand. Results are saved as system ingests.

Refresh page
vote history (3 events)
#0 of 0 · 31d18h16m52s ago — entered · #import:https:::github.com:berriai:litellm post #2672
#32562 requires cross-path async stream error propagation, protocol-correct terminal events, and regression coverage; #26424 is a localized logging-severity and traceback-handling adjustment.
The left requires cross-cutting design across routing state, provider error normalization, public contract/schema, compatibility, and broad test coverage, while the right is a localized logging-behavior adjustment with comparatively limited regression risk.
#0 of 0 · 31d17h49m58s ago — current · #import:https:::github.com:berriai:litellm post #3145
The left issue is harder because it likely requires tracing a release regression across authentication, token caching, database lookup, and backward compatibility, while the right is a relatively localized logging and exception-severity adjustment.
discussed in #import:https:::github.com:berriai:litellm

ranked child groups

no voted pairs yet in this scope

cli
src
spread
search