### Check for existing issues

- [x] I have searched the existing issues and checked that my issue is not a duplicate.

### What happened?

> **Status (2026-05-21):** Verified unfixed in `v1.85.1` (latest stable) and `main` at `HEAD`. The relevant region of `auth_builder` is byte-identical across `v1.83.14-stable`, `v1.83.14-stable.patch.3`, `v1.85.1`, and `main`. No commit in the recent history of `litellm/proxy/auth/handle_jwt.py` touches `user_id` reconciliation. Issue/PR search for `byok_auth_required user_id`, `JWT user_id mismatch sso_user_id`, and `JWT user_id BYOK` returned no hits.

## Symptom

A user provisioned via SSO has a `LiteLLM_UserTable` row with a UUID `user_id` and an `sso_user_id`/`user_email` populated by the SSO callback. They save a BYOK PAT for an MCP server from the dashboard (sk-key auth — uses the canonical UUID). When the same user calls a tool on that MCP server through OpenWebUI (JWT bearer auth — `user_id_jwt_field: "email"`), the proxy returns:

```json { "error": "byok_auth_required", "server_id": "<server-uuid>", "server_name": "mcp_jedai_jira", "message": "No stored credential found for this BYOK server. Complete the OAuth authorization …