{"record":{"id":"09d7fe28c0901cb0","repo":"microsoft/semantic-kernel","slug":"please-provide-either-an-api-key-ad-token-ad-tok","errorCode":null,"errorMessage":"Please provide either an api_key, ad_token, ad_token_provider or credential for authentication.","messagePattern":"Please provide either an api_key, ad_token, ad_token_provider or credential for authentication\\.","errorType":"exception","errorClass":"AgentInitializationException","httpStatus":null,"severity":"error","filePath":"python/semantic_kernel/agents/open_ai/azure_assistant_agent.py","lineNumber":112,"sourceCode":"                env_file_path=env_file_path,\n                env_file_encoding=env_file_encoding,\n                token_endpoint=token_scope,\n            )\n        except ValidationError as exc:\n            raise AgentInitializationException(f\"Failed to create Azure OpenAI settings: {exc}\") from exc\n\n        if (\n            azure_openai_settings.api_key is None\n            and ad_token_provider is None\n            and ad_token is None\n            and azure_openai_settings.token_endpoint\n            and credential\n        ):\n            ad_token = get_entra_auth_token(credential, azure_openai_settings.token_endpoint)\n\n        # If we still have no credentials, we can't proceed\n        if not azure_openai_settings.api_key and not ad_token and not ad_token_provider and not credential:\n            raise AgentInitializationException(\n                \"Please provide either an api_key, ad_token, ad_token_provider or credential for authentication.\"\n            )\n\n        merged_headers = dict(copy(default_headers)) if default_headers else {}\n        if default_headers:\n            merged_headers.update(default_headers)\n        if APP_INFO:\n            merged_headers.update(APP_INFO)\n            merged_headers = prepend_semantic_kernel_to_user_agent(merged_headers)\n\n        if not azure_openai_settings.endpoint:\n            raise AgentInitializationException(\"Please provide an Azure OpenAI endpoint\")\n\n        if not azure_openai_settings.chat_deployment_name:\n            raise AgentInitializationException(\"Please provide an Azure OpenAI deployment name\")\n\n        client = AsyncAzureOpenAI(\n            azure_endpoint=str(azure_openai_settings.endpoint),","sourceCodeStart":94,"sourceCodeEnd":130,"githubUrl":"https://github.com/microsoft/semantic-kernel/blob/c028a0c7dc4f0814cdcbaba9d998f187a41197bf/python/semantic_kernel/agents/open_ai/azure_assistant_agent.py#L94-L130","documentation":"After settings load, the factory needs at least one authentication source. If api_key is absent AND no ad_token, ad_token_provider, or credential is available (and the entra-token path could not produce one), AgentInitializationException is raised listing the accepted auth options.","triggerScenarios":"Instantiating the Azure assistant with none of: AZURE_OPENAI_API_KEY env/arg, an ad_token, an ad_token_provider callable, or a credential object — and no token_endpoint+credential combo to derive an Entra token.","commonSituations":"Forgetting to set AZURE_OPENAI_API_KEY in the environment; intending to use managed identity but not passing credential=DefaultAzureCredential(); env file missing the key; running in CI without secrets injected.","solutions":["Set AZURE_OPENAI_API_KEY (env or .env) or pass api_key= explicitly.","For token auth, pass credential=DefaultAzureCredential() (and ensure token_endpoint is configured) or an ad_token_provider.","Verify the .env file is loaded (correct env_file_path/encoding) and actually contains the key.","Confirm the chosen auth option is reachable from the execution environment (CI secrets, managed identity, etc.)."],"exampleFix":"// before\nAzureOpenAIAssistantAgent(..., deployment_name=dep)  # no key, no credential\n# -> Please provide either an api_key, ad_token, ...\n\n// after\nfrom azure.identity import DefaultAzureCredential\nAzureOpenAIAssistantAgent(..., deployment_name=dep, credential=DefaultAzureCredential())","handlingStrategy":"validation","validationCode":"def has_auth(settings, ad_token, ad_token_provider, credential) -> bool:\n    return bool(settings.api_key or ad_token or ad_token_provider or credential)","typeGuard":"def has_azure_auth(settings, ad_token, ad_token_provider, credential) -> bool:\n    return any([settings.api_key, ad_token, ad_token_provider, credential])","tryCatchPattern":null,"preventionTips":["Set AZURE_OPENAI_API_KEY or pass credential=DefaultAzureCredential().","Verify the .env file is loaded and contains the key.","Confirm the runtime can resolve the chosen credential."],"tags":["azure","auth","initialization","agentinit"],"backgroundTag":null,"analyzedSha":"c028a0c7dc4f0814cdcbaba9d998f187a41197bf","analyzedAt":"2026-08-13T13:48:05.040Z","schemaVersion":2},"datasetVersion":"2026-08-13T14:17:21.547Z"}