{"record":{"id":"084e4e01efb24c06","repo":"openai/openai-python","slug":"failed-to-fetch-azure-subject-token-from-imds-e","errorCode":null,"errorMessage":"Failed to fetch Azure subject token from IMDS: {e}","messagePattern":"Failed to fetch Azure subject token from IMDS: (.+?)","errorType":"exception","errorClass":"SubjectTokenProviderError","httpStatus":null,"severity":"critical","filePath":"src/openai/auth/_workload.py","lineNumber":158,"sourceCode":"                response = http_client.get(url, params=params, headers={\"Metadata\": \"true\"}, timeout=timeout)\n            else:\n                with httpx2.Client() as client:\n                    response = client.get(url, params=params, headers={\"Metadata\": \"true\"}, timeout=timeout)\n\n            if response.is_error:\n                raise SubjectTokenProviderError(\n                    f\"Failed to fetch Azure subject token from IMDS: HTTP {response.status_code}\",\n                    response=response,\n                )\n            data = response.json()\n            token = data.get(\"access_token\")\n            if not token:\n                raise SubjectTokenProviderError(\n                    \"Azure IMDS response did not include an access_token\", response=response\n                )\n            return cast(str, token)\n        except Exception as e:\n            raise SubjectTokenProviderError(f\"Failed to fetch Azure subject token from IMDS: {e}\") from e\n\n    return {\"token_type\": \"jwt\", \"get_token\": get_token}\n\n\ndef gcp_id_token_provider(\n    audience: str = \"https://api.openai.com/v1\",\n    *,\n    timeout: float = 10.0,\n    http_client: httpx2.Client | None = None,\n) -> SubjectTokenProvider:\n    \"\"\"\n    Get a subject token provider for GCP VM instances using the instance metadata server.\n\n    See: https://cloud.google.com/compute/docs/instances/verifying-instance-identity\n\n    Args:\n        audience: the unique URI agreed upon by both the instance and the system verifying\n            the instance's identity. Defaults to `https://api.openai.com/v1`.","sourceCodeStart":140,"sourceCodeEnd":176,"githubUrl":"https://github.com/openai/openai-python/blob/9917c6e28e66e90e1227b3d223c06a8c5441515a/src/openai/auth/_workload.py#L140-L176","documentation":"The catch-all wrapper for the Azure managed-identity flow: any exception during the IMDS request not already handled (connection refused/timeout to 169.254.169.254, DNS issues, TLS problems, JSON decode errors on the response) is re-raised as SubjectTokenProviderError with the original cause attached. The '{e}' text identifies the transport-level problem — most commonly the metadata endpoint is unreachable, meaning you're not on an Azure host or egress is blocked.","triggerScenarios":"Using azure_managed_identity_token_provider outside Azure (connection refused to IMDS), in environments blocking link-local traffic, with timeouts from network policies, or when the response body isn't valid JSON (json decode error before token extraction).","commonSituations":"Local development on a laptop with Azure credential configured by mistake; on-prem or other-cloud containers where IMDS doesn't exist; firewall/NetworkPolicy blocking 169.254.169.254; IMDS temporarily unresponsive during Azure maintenance.","solutions":["Read __cause__ to distinguish connection-refused (not on Azure) from timeout (blocked) from JSON errors (intercepted endpoint)","Only use the Azure provider on Azure compute; for local dev use OPENAI_API_KEY or Azure CLI credentials","Allow egress to 169.254.169.254 in firewall/NetworkPolicy rules","Add graceful degradation: catch SubjectTokenProviderError and fall back to another credential"],"exampleFix":"# before\ncredential = azure_managed_identity_token_provider()  # on laptop -> IMDS unreachable\n\n# after\nimport os\nif os.environ.get(\"AZURE_MANAGED_IDENTITY\"):\n    credential = azure_managed_identity_token_provider()\nelse:\n    credential = None  # fall back to OPENAI_API_KEY","handlingStrategy":"fallback","validationCode":"import socket\ntry:\n    socket.create_connection((\"169.254.169.254\", 80), timeout=2)\n    imds_reachable = True\nexcept OSError:\n    imds_reachable = False","typeGuard":null,"tryCatchPattern":"try:\n    client = OpenAI(credential=azure_provider())\nexcept SubjectTokenProviderError as e:\n    if isinstance(e.__cause__, ConnectionError): client = OpenAI()  # API key fallback","preventionTips":["Only use Azure identity on Azure compute","Allow egress to 169.254.169.254 in NetworkPolicy","Branch credential choice on environment detection"],"tags":["azure","imds","network","auth"],"backgroundTag":"metadata-server-unreachable","analyzedSha":"9917c6e28e66e90e1227b3d223c06a8c5441515a","analyzedAt":"2026-08-28T11:46:34.183Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}