{"record":{"id":"3a26634b79ca6f17","repo":"microsoft/semantic-kernel","slug":"api-key-was-not-specified","errorCode":null,"errorMessage":"API key was not specified.","messagePattern":"API key was not specified\\.","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"dotnet/src/Agents/OpenAI/Extensions/ModelConnectionExtensions.cs","lineNumber":37,"sourceCode":"    internal static Uri? TryGetEndpoint(this ModelConnection connection)\n    {\n        Verify.NotNull(connection);\n\n        return connection.ExtensionData.TryGetValue(\"endpoint\", out var value) && value is not null && value is string endpoint\n            ? new Uri(endpoint)\n            : null;\n    }\n\n    /// <summary>\n    /// Gets the API key property as an <see cref=\"ApiKeyCredential\"/> from the specified <see cref=\"ModelConnection\"/>.\n    /// </summary>\n    /// <param name=\"connection\">Model connection</param>\n    internal static ApiKeyCredential GetApiKeyCredential(this ModelConnection connection)\n    {\n        Verify.NotNull(connection);\n\n        return !connection.ExtensionData.TryGetValue(\"api_key\", out var apiKey) || apiKey is null\n            ? throw new InvalidOperationException(\"API key was not specified.\")\n            : new ApiKeyCredential(apiKey.ToString()!);\n    }\n}\n","sourceCodeStart":19,"sourceCodeEnd":41,"githubUrl":"https://github.com/microsoft/semantic-kernel/blob/c028a0c7dc4f0814cdcbaba9d998f187a41197bf/dotnet/src/Agents/OpenAI/Extensions/ModelConnectionExtensions.cs#L19-L41","documentation":"ModelConnectionExtensions.GetApiKeyCredential reads the 'api_key' key from the connection's ExtensionData and wraps it in an ApiKeyCredential. If the key is absent or null it throws InvalidOperationException, because no credential can be produced.","triggerScenarios":"Calling GetApiKeyCredential on a ModelConnection whose ExtensionData has no 'api_key' entry, or the entry's value is null.","commonSituations":"Agent-definition YAML uses a different key name (e.g., 'apiKey', 'token'); api_key expected from an environment variable that was not injected; secret redaction stripped the value.","solutions":["Ensure the connection ExtensionData contains a non-null 'api_key' entry (exact lowercase key).","Load the key from configuration/environment and inject it into ExtensionData at startup.","Verify secret loading (e.g., dotnet user-secrets, env vars) actually populated the value."],"exampleFix":"// before\nconnection.ExtensionData[\"apiKey\"] = key;\n// after\nconnection.ExtensionData[\"api_key\"] = key;","handlingStrategy":"validation","validationCode":"if (!connection.ExtensionData.TryGetValue(\"api_key\", out var key) || key is null)\n    throw new InvalidOperationException(\"ModelConnection is missing a non-null 'api_key'.\");","typeGuard":"static bool HasApiKey(ModelConnection c) =>\n    c.ExtensionData.TryGetValue(\"api_key\", out var v) && v is not null;","tryCatchPattern":"try { var cred = connection.GetApiKeyCredential(); }\ncatch (InvalidOperationException ex) when (ex.Message.Contains(\"API key was not specified\")) {\n    connection.ExtensionData[\"api_key\"] = Environment.GetEnvironmentVariable(\"OPENAI_API_KEY\");\n}","preventionTips":["Use the exact lowercase 'api_key' key in ExtensionData.","Load keys from a secret manager and inject them at startup.","Add a configuration validator that checks for the api_key entry."],"tags":["configuration","api-key","openai","missing-secret"],"backgroundTag":null,"analyzedSha":"c028a0c7dc4f0814cdcbaba9d998f187a41197bf","analyzedAt":"2026-08-13T13:48:05.040Z","schemaVersion":2},"datasetVersion":"2026-08-13T14:17:21.547Z"}