{"record":{"id":"4901d95545f8a9c6","repo":"microsoft/semantic-kernel","slug":"please-provide-either-api-key-ad-token-ad-token","errorCode":null,"errorMessage":"Please provide either api_key, ad_token, ad_token_provider, credential or a client.","messagePattern":"Please provide either api_key, ad_token, ad_token_provider, credential or a client\\.","errorType":"exception","errorClass":"ServiceInitializationError","httpStatus":null,"severity":"critical","filePath":"python/semantic_kernel/connectors/ai/open_ai/services/azure_config_base.py","lineNumber":85,"sourceCode":"            credential: The credential to use for authentication. (Optional)\n            kwargs: Additional keyword arguments.\n\n        \"\"\"\n        # Merge APP_INFO into the headers if it exists\n        merged_headers = dict(copy(default_headers)) if default_headers else {}\n        if APP_INFO:\n            merged_headers.update(APP_INFO)\n            merged_headers = prepend_semantic_kernel_to_user_agent(merged_headers)\n\n        if not client:\n            # If the client is None, the api_key is none, the ad_token is none, and the ad_token_provider is none,\n            # then we will attempt to get the ad_token using the default endpoint specified in the Azure OpenAI\n            # settings.\n            if not api_key and not ad_token_provider and not ad_token and token_endpoint and credential:\n                ad_token = get_entra_auth_token(credential, token_endpoint)\n\n            if not api_key and not ad_token and not ad_token_provider and not credential:\n                raise ServiceInitializationError(\n                    \"Please provide either api_key, ad_token, ad_token_provider, credential or a client.\"\n                )\n\n            if not endpoint and not base_url:\n                raise ServiceInitializationError(\"Please provide an endpoint or a base_url\")\n\n            args: dict[str, Any] = {\n                \"default_headers\": merged_headers,\n            }\n            if api_version:\n                args[\"api_version\"] = api_version\n            if ad_token:\n                args[\"azure_ad_token\"] = ad_token\n            if ad_token_provider:\n                args[\"azure_ad_token_provider\"] = ad_token_provider\n            if api_key:\n                args[\"api_key\"] = api_key\n            if base_url:","sourceCodeStart":67,"sourceCodeEnd":103,"githubUrl":"https://github.com/microsoft/semantic-kernel/blob/c028a0c7dc4f0814cdcbaba9d998f187a41197bf/python/semantic_kernel/connectors/ai/open_ai/services/azure_config_base.py#L67-L103","documentation":"The base Azure config builder requires at least one authentication mechanism to construct the underlying AsyncAzureOpenAI client. It checks for api_key, ad_token, ad_token_provider, or credential (or a pre-built client). If none are provided AND no client is passed, it raises ServiceInitializationError. This is the first guard in the config chain — it fires before endpoint/base_url validation.","triggerScenarios":"Constructing any Azure OpenAI service (chat, text, embedding, audio, realtime) without providing api_key, ad_token, ad_token_provider, credential, or client — and without corresponding AZURE_OPENAI_API_KEY env var. Also fires if token_endpoint is set but no credential is provided to obtain a token.","commonSituations":"Fresh setup where AZURE_OPENAI_API_KEY env var hasn't been set; using managed identity (credential) but forgetting to pass the credential object; .env file not loaded; typo in the env var name; switching from api_key auth to managed identity but removing the key without adding credential.","solutions":["Set AZURE_OPENAI_API_KEY environment variable, or pass api_key='...' to the constructor.","For managed identity: pass credential=DefaultAzureCredential() (and set token_endpoint if needed).","For token-based auth: pass ad_token or ad_token_provider (a callable returning the token).","Pass a pre-built AsyncAzureOpenAI client if you manage auth externally."],"exampleFix":"// before\nservice = AzureChatCompletionService(\n    deployment_name='gpt-4o',\n    endpoint='https://my-resource.openai.azure.com/'\n)  # no auth\n// after\n# Option 1: API key\nservice = AzureChatCompletionService(\n    deployment_name='gpt-4o',\n    endpoint='https://my-resource.openai.azure.com/',\n    api_key=os.environ['AZURE_OPENAI_API_KEY']\n)\n# Option 2: Managed identity\nfrom azure.identity import DefaultAzureCredential\nservice = AzureChatCompletionService(\n    deployment_name='gpt-4o',\n    endpoint='https://my-resource.openai.azure.com/',\n    credential=DefaultAzureCredential()\n)","handlingStrategy":"validation","validationCode":"import os\n\ndef validate_azure_auth(api_key, ad_token, ad_token_provider, credential, client) -> None:\n    if client:\n        return  # pre-built client bypasses auth check\n    if not any([api_key, ad_token, ad_token_provider, credential]):\n        if not os.environ.get('AZURE_OPENAI_API_KEY'):\n            raise ValueError(\n                'No authentication provided. Pass api_key, ad_token, ad_token_provider, '\n                'credential, or client — or set AZURE_OPENAI_API_KEY.'\n            )","typeGuard":"def has_azure_auth(api_key, ad_token, ad_token_provider, credential, client) -> bool:\n    import os\n    return any([\n        client, api_key, ad_token, ad_token_provider, credential,\n        os.environ.get('AZURE_OPENAI_API_KEY')\n    ])","tryCatchPattern":"from semantic_kernel.exceptions import ServiceInitializationError\n\ntry:\n    service = AzureChatCompletionService(deployment_name=dep, endpoint=ep)\nexcept ServiceInitializationError as e:\n    if 'Please provide either' in str(e):\n        service = AzureChatCompletionService(\n            deployment_name=dep, endpoint=ep, api_key=os.environ['AZURE_OPENAI_API_KEY']\n        )","preventionTips":["Always provide at least one auth method: api_key, ad_token, ad_token_provider, credential, or client.","Set AZURE_OPENAI_API_KEY in your environment for key-based auth.","For managed identity, pass credential=DefaultAzureCredential().","Verify .env file is loaded before constructing services."],"tags":["azure-openai","authentication","api-key","initialization","semantic-kernel"],"backgroundTag":null,"analyzedSha":"c028a0c7dc4f0814cdcbaba9d998f187a41197bf","analyzedAt":"2026-08-13T13:48:05.040Z","schemaVersion":2},"datasetVersion":"2026-08-13T14:17:21.547Z"}