{"record":{"id":"2e50c69dd0c5663d","repo":"BerriAI/litellm","slug":"req-token-text","errorCode":null,"errorMessage":"{req_token.text}","messagePattern":"\\{req_token\\.text\\}","errorType":"http","errorClass":"AzureOpenAIError","httpStatus":null,"severity":"error","filePath":"litellm/llms/azure/common_utils.py","lineNumber":235,"sourceCode":"    azure_ad_token_access_token = azure_ad_cache.get_cache(azure_ad_token_cache_key)\n    if azure_ad_token_access_token is not None:\n        return azure_ad_token_access_token\n\n    client: Final = litellm.module_level_client\n\n    req_token: Final = client.post(\n        f\"{azure_authority_host}/{azure_tenant_id}/oauth2/v2.0/token\",\n        data={\n            \"client_id\": azure_client_id,\n            \"grant_type\": \"client_credentials\",\n            \"scope\": scope,\n            \"client_assertion_type\": \"urn:ietf:params:oauth:client-assertion-type:jwt-bearer\",\n            \"client_assertion\": oidc_token,\n        },\n    )\n\n    if req_token.status_code != 200:\n        raise AzureOpenAIError(\n            status_code=req_token.status_code,\n            message=req_token.text,\n        )\n\n    azure_ad_token_json: Final[_AzureAdTokenJson] = req_token.json()\n    azure_ad_token_access_token = azure_ad_token_json.get(\"access_token\", None)\n    azure_ad_token_expires_in: Final = azure_ad_token_json.get(\"expires_in\", None)\n\n    if azure_ad_token_access_token is None:\n        raise AzureOpenAIError(status_code=422, message=\"Azure AD Token access_token not returned\")\n\n    if azure_ad_token_expires_in is None:\n        raise AzureOpenAIError(status_code=422, message=\"Azure AD Token expires_in not returned\")\n\n    azure_ad_cache.set_cache(\n        key=azure_ad_token_cache_key,\n        value=azure_ad_token_access_token,\n        ttl=azure_ad_token_expires_in,","sourceCodeStart":217,"sourceCodeEnd":253,"githubUrl":"https://github.com/BerriAI/litellm/blob/6c2dcb801bf2b75c18f1bb24140e7cf57465cc4d/litellm/llms/azure/common_utils.py#L217-L253","documentation":"LiteLLM posts the client-credentials request (client_assertion = your OIDC token) to {AZURE_AUTHORITY_HOST}/{tenant}/oauth2/v2.0/token. If Azure AD replies with any non-200 status, LiteLLM re-raises AzureOpenAIError with the same status code and the raw response body (message=req_token.text). The body is Azure AD's own error JSON, e.g. invalid_client, invalid_scope, or AADSTS70021.","triggerScenarios":"Expired or malformed OIDC assertion (AADSTS7000215 invalid_client); wrong tenant ID (AADSTS70001 application not found); scope not consented (e.g. requesting a scope other than https://cognitiveservices.azure.com/.default without permission); custom AZURE_AUTHORITY_HOST that is wrong or unreachable via proxy returns 404/403.","commonSituations":"Federated workload identity where the pod's service-account token TTL expired between fetch and use; copying a tenant ID from a different directory; sovereign-cloud deployments (AzureUSGovernment/AzureChina) that still point at login.microsoftonline.com; expired client secret when client_secret flow is mistakenly used.","solutions":["Read the AADSTS code in the message body — it names the exact cause (e.g. AADSTS70021: no federated identity credentials found for the service account).","For AADSTS7000215/700213: fetch a fresh OIDC token immediately before the LiteLLM call; tokens are typically valid ~5-90 min.","Verify AZURE_TENANT_ID matches the directory the app registration/federated identity lives in.","For sovereign clouds set AZURE_AUTHORITY_HOST appropriately (e.g. https://login.microsoftonline.us) and keep scope under that cloud's resource.","Confirm a federated identity credential exists linking your OIDC issuer/subject to the app registration (AZURE_CLIENT_ID)."],"exampleFix":"# before\nos.environ[\"AZURE_AUTHORITY_HOST\"] = \"https://login.microsoftonline.com\"  # default, wrong cloud\n\n# after (Azure US Government)\nos.environ[\"AZURE_AUTHORITY_HOST\"] = \"https://login.microsoftonline.us\"","handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"try:\n    resp = litellm.completion(..., azure_ad_token=oidc)\nexcept AzureOpenAIError as e:\n    body = str(e)\n    if \"AADSTS7000215\" in body or \"AADSTS700213\" in body:  # expired/invalid assertion\n        oidc = fetch_fresh_oidc()\n        resp = litellm.completion(..., azure_ad_token=oidc)\n    elif e.status_code in (429, 500, 503):\n        backoff_and_retry()\n    else:\n        raise","preventionTips":["Refresh OIDC assertions at ~50% of their TTL; don't reuse across long-lived processes.","Log the AADSTS code from the message — it pinpoints tenant/client/scope issues.","Keep AZURE_AUTHORITY_HOST consistent with your cloud and the scope's resource."],"tags":["azure","authentication","oauth2","network","aadsts"],"backgroundTag":null,"analyzedSha":"6c2dcb801bf2b75c18f1bb24140e7cf57465cc4d","analyzedAt":"2026-08-15T07:12:03.035Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}