{"record":{"id":"285f1139f6273d5f","repo":"openai/openai-python","slug":"failed-to-fetch-azure-subject-token-from-imds-htt","errorCode":null,"errorMessage":"Failed to fetch Azure subject token from IMDS: HTTP {response.status_code}","messagePattern":"Failed to fetch Azure subject token from IMDS: HTTP (.+?)","errorType":"http","errorClass":"SubjectTokenProviderError","httpStatus":null,"severity":"critical","filePath":"src/openai/auth/_workload.py","lineNumber":146,"sourceCode":"    def get_token() -> str:\n        try:\n            url = \"http://169.254.169.254/metadata/identity/oauth2/token\"\n            params: dict[str, str] = {\"api-version\": api_version, \"resource\": resource}\n            if object_id is not None:\n                params[\"object_id\"] = object_id\n            if client_id is not None:\n                params[\"client_id\"] = client_id\n            if msi_res_id is not None:\n                params[\"msi_res_id\"] = msi_res_id\n\n            if http_client is not None:\n                response = http_client.get(url, params=params, headers={\"Metadata\": \"true\"}, timeout=timeout)\n            else:\n                with httpx2.Client() as client:\n                    response = client.get(url, params=params, headers={\"Metadata\": \"true\"}, timeout=timeout)\n\n            if response.is_error:\n                raise SubjectTokenProviderError(\n                    f\"Failed to fetch Azure subject token from IMDS: HTTP {response.status_code}\",\n                    response=response,\n                )\n            data = response.json()\n            token = data.get(\"access_token\")\n            if not token:\n                raise SubjectTokenProviderError(\n                    \"Azure IMDS response did not include an access_token\", response=response\n                )\n            return cast(str, token)\n        except Exception as e:\n            raise SubjectTokenProviderError(f\"Failed to fetch Azure subject token from IMDS: {e}\") from e\n\n    return {\"token_type\": \"jwt\", \"get_token\": get_token}\n\n\ndef gcp_id_token_provider(\n    audience: str = \"https://api.openai.com/v1\",","sourceCodeStart":128,"sourceCodeEnd":164,"githubUrl":"https://github.com/openai/openai-python/blob/9917c6e28e66e90e1227b3d223c06a8c5441515a/src/openai/auth/_workload.py#L128-L164","documentation":"The Azure managed-identity provider queries the Instance Metadata Service (IMDS) at 169.254.169.254 for an access token. If IMDS returns any HTTP error status (response.is_error), the provider raises SubjectTokenProviderError including the status code and attaches the response. Common upstream codes are 404 (wrong resource/identity not available), 429 (IMDS throttling), or 400 (bad request/metadata config).","triggerScenarios":"Running with azure_managed_identity_token_provider on an Azure VM/App Service/Functions where IMDS responds with an error: identity not enabled on the resource, throttling (429/limits are ~5 calls/sec with token caching absent), or an unexpected resource URI.","commonSituations":"System-assigned managed identity not enabled on the VM; hitting IMDS rate limits by creating a new client per request instead of reusing one; wrong resource scope; IMDS temporarily unavailable during VM maintenance.","solutions":["Enable a managed identity (system or user-assigned) on the Azure resource and re-test with curl on the metadata endpoint","Reuse a single OpenAI client instance so IMDS responses (and their tokens) are cached instead of queried per call","Confirm the resource/audience parameter matches what the target API expects","If 429 persists, implement token caching or backoff around provider usage"],"exampleFix":"# before\nfor req in requests_list:\n    client = OpenAI(credential=azure_managed_identity_token_provider())  # new IMDS call each time\n\n# after\nclient = OpenAI(credential=azure_managed_identity_token_provider())  # create once, reuse\nfor req in requests_list:\n    client.chat.completions.create(...)","handlingStrategy":"retry","validationCode":"import httpx\nr = httpx.get(\"http://169.254.169.254/metadata/instance\", headers={\"Metadata\":\"true\"})\nassert not r.is_error, r.status_code","typeGuard":null,"tryCatchPattern":"for attempt in range(5):\n    try:\n        return provider_get_token()\n    except SubjectTokenProviderError as e:\n        if \"HTTP 429\" in str(e) or \"HTTP 50\" in str(e): backoff(); continue\n        raise","preventionTips":["Reuse one client instance to leverage IMDS caching","Enable managed identity on the resource","Match resource/audience parameter to the API"],"tags":["azure","managed-identity","imds","auth"],"backgroundTag":"metadata-server-auth-failed","analyzedSha":"9917c6e28e66e90e1227b3d223c06a8c5441515a","analyzedAt":"2026-08-28T11:46:34.183Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}