fix(cli): tell whoami's expired PKCE key to sign in again instead of promising a renewal

litellm/proxy/client/cli/commands/auth.py

@@ -854,10 +854,10 @@ def whoami():
 
 def _key_expiry_line(expires_at: float, renews: bool) -> str:
     remaining_hours: Final = (expires_at - time.time()) / 3600
-    status: Final = f"Key expires in: {remaining_hours:.1f} hours" if remaining_hours > 0 else "Key expired"
-    if renews:
-        return f"{status}, renewed on next use"
-    return status if remaining_hours > 0 else f"{status}. Run 'lite login' again"
+    if remaining_hours <= 0:
+        return f"Key expired. Run '{'lite login --pkce' if renews else 'lite login'}' again"
+    status: Final = f"Key expires in: {remaining_hours:.1f} hours"
+    return f"{status}, renewed on next use" if renews else status
 
 
 @click.group(name="auth")

tests/test_litellm/proxy/client/cli/test_auth_commands.py

@@ -659,6 +659,22 @@ class TestWhoamiCommand:
         assert "Team ID" not in result.output
         assert "Key expired. Run 'lite login' again" in result.output
 
+    def test_whoami_expired_pkce_record_that_could_not_be_renewed_asks_for_a_new_pkce_login(self):
+        token_data = {
+            "user_id": "user-1",
+            "team_id": "team-alpha",
+            "timestamp": time.time() - 3600,
+            "expires_at": time.time() - 60,
+            "refresh_token": "llm_srefresh_spent",
+        }
+
+        with patch("litellm.proxy.client.cli.commands.auth.load_token", return_value=token_data):
+            result = self.runner.invoke(whoami)
+
+        assert result.exit_code == 0
+        assert "Key expired. Run 'lite login --pkce' again" in result.output
+        assert "renewed on next use" not in result.output
+
     def test_whoami_no_timestamp(self):
         """Test whoami with token missing timestamp"""
         token_data = {