{"record":{"id":"15716d82090db2f2","repo":"openai/openai-python","slug":"missing-credentials-please-pass-one-of-api-key","errorCode":null,"errorMessage":"Missing credentials. Please pass one of `api_key`, `azure_ad_token`, `azure_ad_token_provider`, or the `AZURE_OPENAI_API_KEY` or `AZURE_OPENAI_AD_TOKEN` environment variables.","messagePattern":"Missing credentials\\. Please pass one of `api_key`, `azure_ad_token`, `azure_ad_token_provider`, or the `AZURE_OPENAI_API_KEY` or `AZURE_OPENAI_AD_TOKEN` environment variables\\.","errorType":"exception","errorClass":"OpenAIError","httpStatus":null,"severity":"critical","filePath":"src/openai/lib/azure.py","lineNumber":302,"sourceCode":"        Args:\n            azure_endpoint: Your Azure endpoint, including the resource, e.g. `https://example-resource.azure.openai.com/`\n\n            azure_ad_token: Your Azure Active Directory token, https://www.microsoft.com/en-us/security/business/identity-access/microsoft-entra-id\n\n            azure_ad_token_provider: A function that returns an Azure Active Directory token, will be invoked on every request.\n\n            azure_deployment: A model deployment, if given with `azure_endpoint`, sets the base client URL to include `/deployments/{azure_deployment}`.\n                Not supported with Assistants APIs.\n        \"\"\"\n        if is_x509_workload_identity(workload_identity):\n            raise OpenAIError(\"X.509 workload identity is not supported by Azure clients\")\n\n        api_key, azure_ad_token, azure_ad_token_provider = _resolve_azure_auth(\n            api_key, azure_ad_token, azure_ad_token_provider\n        )\n\n        if _enforce_credentials and api_key is None and azure_ad_token is None and azure_ad_token_provider is None:\n            raise OpenAIError(\n                \"Missing credentials. Please pass one of `api_key`, `azure_ad_token`, `azure_ad_token_provider`, or the `AZURE_OPENAI_API_KEY` or `AZURE_OPENAI_AD_TOKEN` environment variables.\"\n            )\n\n        if api_version is None:\n            api_version = os.environ.get(\"OPENAI_API_VERSION\")\n\n        if api_version is None:\n            raise ValueError(\n                \"Must provide either the `api_version` argument or the `OPENAI_API_VERSION` environment variable\"\n            )\n\n        if default_query is None:\n            default_query = {\"api-version\": api_version}\n        else:\n            default_query = {**default_query, \"api-version\": api_version}\n\n        if base_url is None:\n            if azure_endpoint is None:","sourceCodeStart":284,"sourceCodeEnd":320,"githubUrl":"https://github.com/openai/openai-python/blob/9917c6e28e66e90e1227b3d223c06a8c5441515a/src/openai/lib/azure.py#L284-L320","documentation":"AzureOpenAI requires exactly one credential source: api_key, azure_ad_token, azure_ad_token_provider, or env vars AZURE_OPENAI_API_KEY / AZURE_OPENAI_AD_TOKEN. If none is found (and credential enforcement is on) construction fails with OpenAIError.","triggerScenarios":"new AzureOpenAI() with no args and no AZURE_OPENAI_API_KEY/AZURE_OPENAI_AD_TOKEN in the environment (env var not exported to the process, or OPENAI_API_KEY set instead).","commonSituations":"Env var set in shell but not in the service/cron/container; using OPENAI_API_KEY for an Azure client; dotenv not loaded before client creation; CI secrets not exposed.","solutions":["Set AZURE_OPENAI_API_KEY (or pass api_key=...) in the environment where the process actually runs","Or configure azure_ad_token_provider with azure-identity for AAD/managed identity","Verify with a quick check: python -c \"import os; print(os.environ.get('AZURE_OPENAI_API_KEY'))\"","Load .env before constructing the client if using python-dotenv"],"exampleFix":"# before\nclient = AzureOpenAI()  # env var missing\n# after\nclient = AzureOpenAI(api_key=os.environ[\"AZURE_OPENAI_API_KEY\"])\n# or: export AZURE_OPENAI_API_KEY=... in the runtime environment","handlingStrategy":"validation","validationCode":"has_creds = bool(os.environ.get(\"AZURE_OPENAI_API_KEY\") or os.environ.get(\"AZURE_OPENAI_AD_TOKEN\"))\nclass MissingCreds(Exception): ...\nif enforce and not has_creds:\n    raise MissingCreds(\"set AZURE_OPENAI_API_KEY before starting\")","typeGuard":null,"tryCatchPattern":"try:\n    client = AzureOpenAI(...)\nexcept OpenAIError as e:\n    if \"Missing credentials\" in str(e):\n        raise SystemExit(\"Set AZURE_OPENAI_API_KEY\") from e\n    raise","preventionTips":["Fail fast at startup on missing env vars","Remember OPENAI_API_KEY does not authenticate AzureOpenAI","Load .env before client construction"],"tags":["azure","authentication","env-vars","credentials"],"backgroundTag":"missing-credentials","analyzedSha":"9917c6e28e66e90e1227b3d223c06a8c5441515a","analyzedAt":"2026-08-28T11:46:34.183Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}