litellm - 💡(How to fix) Fix [Bug]: Credential/deployment tags leak into fallback routing, causing spurious 401 errors [1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
BerriAI/litellm#25276Fetched 2026-04-08 03:02:20
View on GitHub
Comments
0
Participants
1
Timeline
3
Reactions
0
Author
Participants
Timeline (top)
labeled ×3

Error Message

  1. The fallback fails with the tag routing error

Code Example

Not allowed to access model due to tags configuration. Passed model=gpt-image-1.5 and tags=['Credential: openai']

---
RAW_BUFFERClick to expand / collapse

Check for existing issues

  • I have searched the existing issues and checked that my issue is not a duplicate.

What happened?

When a request fails and triggers fallback routing, the fallback model receives a tags=['Credential: openai'] tag that was never sent by the client. This causes the fallback to fail with:

Not allowed to access model due to tags configuration. Passed model=gpt-image-1.5 and tags=['Credential: openai']

Expected behavior

Fallback routing should use only the original request tags (explicit + key/team/project metadata). Post-routing observability tags like Credential: ... should not influence subsequent routing decisions.

Steps to Reproduce

  1. Enable enable_tag_filtering on the router
  2. Configure two model groups with fallbacks, where at least one deployment uses a named credential (litellm_credential_name)
  3. Send a request that fails on the first model group and triggers a fallback
  4. The fallback fails with the tag routing error

Relevant log output

What part of LiteLLM is this about?

Proxy

What LiteLLM version are you on ?

v1.82.3-stable

Twitter / LinkedIn details

No response

extent analysis

TL;DR

Disable enable_tag_filtering on the router or modify the tags configuration to exclude the 'Credential: openai' tag from influencing fallback routing decisions.

Guidance

  • Verify that the enable_tag_filtering feature is the cause of the issue by temporarily disabling it and checking if the fallback routing works as expected.
  • Check the configuration of the model groups and their associated tags to ensure that the 'Credential: openai' tag is not being incorrectly applied to the fallback model.
  • Review the documentation for the enable_tag_filtering feature to understand how it interacts with the fallback routing mechanism and how to configure it to achieve the desired behavior.
  • Consider modifying the code that handles the fallback routing to explicitly exclude the 'Credential: openai' tag from the tags passed to the fallback model.

Notes

The exact solution may depend on the specific requirements and constraints of the LiteLLM deployment, and may require additional configuration changes or code modifications.

Recommendation

Apply workaround: Modify the tags configuration to exclude the 'Credential: openai' tag from influencing fallback routing decisions, as this is a more targeted and less disruptive change than disabling the enable_tag_filtering feature entirely.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

FAQ

Expected behavior

Fallback routing should use only the original request tags (explicit + key/team/project metadata). Post-routing observability tags like Credential: ... should not influence subsequent routing decisions.

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING