{"record":{"id":"5160354fd9a54261","repo":"openai/openai-python","slug":"failed-to-read-the-token-file-at-token-file-path","errorCode":null,"errorMessage":"Failed to read the token file at {token_file_path}: {e}","messagePattern":"Failed to read the token file at (.+?): (.+?)","errorType":"exception","errorClass":"SubjectTokenProviderError","httpStatus":null,"severity":"critical","filePath":"src/openai/auth/_workload.py","lineNumber":98,"sourceCode":") -> SubjectTokenProvider:\n    \"\"\"\n    Get a subject token provider for Kubernetes clusters with Workload Identity configured.\n\n    Cloud providers typically mount the subject token as a file in the container.\n\n    Args:\n        token_file_path: path to the mounted service account token file. Defaults to `/var/run/secrets/kubernetes.io/serviceaccount/token`.\n    \"\"\"\n\n    def get_token() -> str:\n        try:\n            with open(token_file_path, \"r\") as f:\n                token = f.read().strip()\n                if not token:\n                    raise SubjectTokenProviderError(f\"The token file at {token_file_path} is empty.\")\n                return token\n        except Exception as e:\n            raise SubjectTokenProviderError(f\"Failed to read the token file at {token_file_path}: {e}\") from e\n\n    return {\"token_type\": \"jwt\", \"get_token\": get_token}\n\n\ndef azure_managed_identity_token_provider(\n    resource: str = \"https://management.azure.com/\",\n    *,\n    object_id: str | None = None,\n    client_id: str | None = None,\n    msi_res_id: str | None = None,\n    api_version: str = \"2018-02-01\",\n    timeout: float = 10.0,\n    http_client: httpx2.Client | None = None,\n) -> SubjectTokenProvider:\n    \"\"\"\n    Get a subject token provider for Azure Managed Identities.\n\n    See: https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/how-to-use-vm-token#get-a-token-using-http","sourceCodeStart":80,"sourceCodeEnd":116,"githubUrl":"https://github.com/openai/openai-python/blob/9917c6e28e66e90e1227b3d223c06a8c5441515a/src/openai/auth/_workload.py#L80-L116","documentation":"The outer handler for the workload token file reader: any exception while opening/reading the token file (FileNotFoundError, PermissionError, IsADirectoryError, UnicodeDecodeError, or the empty-file SubjectTokenProviderError itself) is wrapped in SubjectTokenProviderError with the underlying cause chained. The message includes the original exception text, which tells you whether it is a path, permission, or emptiness problem.","triggerScenarios":"Token file path does not exist (FileNotFoundError), wrong permissions (PermissionError), path is a directory, binary/undecodable content, or empty file — any of these during get_token() for workload identity auth.","commonSituations":"Wrong token file path in provider config (common when the pod spec differs from local assumptions); read-only root filesystem permission quirks; env var pointing to nonexistent mount; local development without the cluster-mounted secret.","solutions":["Read the chained exception (__cause__) to identify FileNotFound vs Permission vs empty","Verify the exact path exists and is readable: ls -l and cat the file inside the pod","Fix the volume mount / path so it points at the projected token file","Fall back to OPENAI_API_KEY or another credential when not running in the cluster"],"exampleFix":"# before\nprovider = token_provider(\"/var/run/secrets/tokens/oidc-token\")  # wrong path\n\n# after\nprovider = token_provider(\"/var/run/secrets/kubernetes.io/serviceaccount/token\")  # actual mount","handlingStrategy":"validation","validationCode":"import os\nassert os.path.isfile(TOKEN_PATH) and os.access(TOKEN_PATH, os.R_OK), TOKEN_PATH","typeGuard":"def token_file_readable(path: str) -> bool:\n    import os\n    return os.path.isfile(path) and os.access(path, os.R_OK) and bool(open(path).read(1024).strip())","tryCatchPattern":"try:\n    token = provider[\"get_token\"]()\nexcept SubjectTokenProviderError as e:\n    diagnose(e.__cause__)  # FileNotFoundError vs PermissionError vs empty","preventionTips":["Verify mount paths inside the container","Set correct filesystem permissions","Fall back to API key outside the cluster"],"tags":["kubernetes","workload-identity","auth","file-io"],"backgroundTag":"token-file-read-failed","analyzedSha":"9917c6e28e66e90e1227b3d223c06a8c5441515a","analyzedAt":"2026-08-28T11:46:34.183Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}