diff --git a/litellm/proxy/_types.py b/litellm/proxy/_types.py
index 45476900a26..68d0ed2bb7a 100644
--- a/litellm/proxy/_types.py
+++ b/litellm/proxy/_types.py
@@ -3776,7 +3776,7 @@ class LiteLLM_JWTAuth(LiteLLMPydanticObjectBase):
 
     def __init__(self, **kwargs: Any) -> None:
         # get the attribute names for this Pydantic model
-        allowed_keys = self.__annotations__.keys()
+        allowed_keys = LiteLLM_JWTAuth.__annotations__.keys()
 
         invalid_keys = set(kwargs.keys()) - allowed_keys
         user_roles_jwt_field = kwargs.get("user_roles_jwt_field")
diff --git a/litellm/proxy/auth/handle_jwt.py b/litellm/proxy/auth/handle_jwt.py
index 15056cf64e6..f5c39230285 100644
--- a/litellm/proxy/auth/handle_jwt.py
+++ b/litellm/proxy/auth/handle_jwt.py
@@ -1066,6 +1066,15 @@ class JWTAuthManager:
                     f"JWT Auth: Resolved org_alias='{org_alias}' to org_id='{org_object.organization_id}'"
                 )
 
+        # Check if email domain is allowed before attempting to get/create user
+        if valid_user_email is False:
+            raise ProxyException(
+                message=f"Email domain not allowed. User email: {user_email}. Allowed domain: {jwt_handler.litellm_jwtauth.user_allowed_email_domain}",
+                type=ProxyErrorTypes.auth_error,
+                param="user_email",
+                code=403,
+            )
+
         user_object: Optional[LiteLLM_UserTable] = None
         if user_id:
             user_object = (