From c011b4b56ffdadd2600549e387a5109eb79263da Mon Sep 17 00:00:00 2001
From: mateo-berri <277851410+mateo-berri@users.noreply.github.com>
Date: Thu, 20 Aug 2026 05:22:26 -0700
Subject: [PATCH] fix(cli): tell whoami's expired PKCE key to sign in again
 instead of promising a renewal

---
 litellm/proxy/client/cli/commands/auth.py        |  8 ++++----
 .../proxy/client/cli/test_auth_commands.py       | 16 ++++++++++++++++
 2 files changed, 20 insertions(+), 4 deletions(-)

diff --git a/litellm/proxy/client/cli/commands/auth.py b/litellm/proxy/client/cli/commands/auth.py
index bc7247055d8..b8266b7d6eb 100644
--- a/litellm/proxy/client/cli/commands/auth.py
+++ b/litellm/proxy/client/cli/commands/auth.py
@@ -854,10 +854,10 @@ def whoami():
 
 def _key_expiry_line(expires_at: float, renews: bool) -> str:
     remaining_hours: Final = (expires_at - time.time()) / 3600
-    status: Final = f"Key expires in: {remaining_hours:.1f} hours" if remaining_hours > 0 else "Key expired"
-    if renews:
-        return f"{status}, renewed on next use"
-    return status if remaining_hours > 0 else f"{status}. Run 'lite login' again"
+    if remaining_hours <= 0:
+        return f"Key expired. Run '{'lite login --pkce' if renews else 'lite login'}' again"
+    status: Final = f"Key expires in: {remaining_hours:.1f} hours"
+    return f"{status}, renewed on next use" if renews else status
 
 
 @click.group(name="auth")
diff --git a/tests/test_litellm/proxy/client/cli/test_auth_commands.py b/tests/test_litellm/proxy/client/cli/test_auth_commands.py
index 4e309bf1538..27568534bb6 100644
--- a/tests/test_litellm/proxy/client/cli/test_auth_commands.py
+++ b/tests/test_litellm/proxy/client/cli/test_auth_commands.py
@@ -659,6 +659,22 @@ class TestWhoamiCommand:
         assert "Team ID" not in result.output
         assert "Key expired. Run 'lite login' again" in result.output
 
+    def test_whoami_expired_pkce_record_that_could_not_be_renewed_asks_for_a_new_pkce_login(self):
+        token_data = {
+            "user_id": "user-1",
+            "team_id": "team-alpha",
+            "timestamp": time.time() - 3600,
+            "expires_at": time.time() - 60,
+            "refresh_token": "llm_srefresh_spent",
+        }
+
+        with patch("litellm.proxy.client.cli.commands.auth.load_token", return_value=token_data):
+            result = self.runner.invoke(whoami)
+
+        assert result.exit_code == 0
+        assert "Key expired. Run 'lite login --pkce' again" in result.output
+        assert "renewed on next use" not in result.output
+
     def test_whoami_no_timestamp(self):
         """Test whoami with token missing timestamp"""
         token_data = {