{"record":{"id":"5c2a7aa2fdd46ead","repo":"mem0ai/mem0","slug":"azure-credential-authentication-failed-err","errorCode":null,"errorMessage":"Azure credential authentication failed: ${err}","messagePattern":"Azure credential authentication failed: (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"critical","filePath":"mem0-ts/src/oss/src/vector_stores/azure_mysql.ts","lineNumber":85,"sourceCode":"    if (!this._initPromise) {\n      this._initPromise = this._doInitialize();\n    }\n    return this._initPromise;\n  }\n\n  private async _doInitialize(): Promise<void> {\n    let password = this.config.password;\n\n    if (this.config.useAzureCredential) {\n      try {\n        const { DefaultAzureCredential } = await import(\"@azure/identity\");\n        const credential = new DefaultAzureCredential();\n        const token = await credential.getToken(\n          \"https://ossrdbms-aad.database.windows.net/.default\",\n        );\n        password = token.token;\n      } catch (err) {\n        throw new Error(`Azure credential authentication failed: ${err}`);\n      }\n    }\n\n    const ssl: Record<string, any> | undefined = this.config.sslDisabled\n      ? undefined\n      : {\n          rejectUnauthorized: true,\n          ...(this.config.sslCa ? { ca: this.config.sslCa } : {}),\n        };\n\n    // Loaded dynamically: mysql2 is an optional peer dependency, so a static value import\n    // would break `import { Memory } from \"mem0ai/oss\"` for everyone else.\n    const { createPool }: typeof import(\"mysql2/promise\") = await loadPeer(\n      \"mysql2\",\n      \"Azure MySQL vector store\",\n      () => import(\"mysql2/promise\"),\n    );\n","sourceCodeStart":67,"sourceCodeEnd":103,"githubUrl":"https://github.com/mem0ai/mem0/blob/001c235229be8795e3834520467bd0d661ed8f34/mem0-ts/src/oss/src/vector_stores/azure_mysql.ts#L67-L103","documentation":"When the Azure MySQL store is configured with useAzureCredential, initialization dynamically imports @azure/identity, creates a DefaultAzureCredential, and requests a token for the Azure Database for MySQL AAD scope (https://ossrdbms-aad.database.windows.net/.default) to use as the password. Any failure in that chain (package missing, credential unavailable, AAD/DNS/timeout errors) is wrapped in this error with the underlying cause.","triggerScenarios":"useAzureCredential: true without @azure/identity installed; no managed identity / AZURE_TENANT_ID+CLIENT_ID+CLIENT_SECRET in the environment; token request failing because the identity lacks reader/data access on the MySQL server; running locally with no az login.","commonSituations":"Deploying to Azure App Service where the identity was never assigned; local dev without az login or env service-principal vars; expired service principal secrets; National cloud or wrong scope.","solutions":["npm install @azure/identity (it is an optional peer).","Run az login locally, or set AZURE_TENANT_ID / AZURE_CLIENT_ID / AZURE_CLIENT_SECRET for the service principal, and ensure that identity has an AAD admin / user on the MySQL flexible server.","If you do not need AAD auth, drop useAzureCredential and supply config.password directly."],"exampleFix":"# before\nuseAzureCredential: true  # local dev, no az login\n# after\naz login  # or set AZURE_* env vars, or:\nuseAzureCredential: false, password: process.env.MYSQL_PWD","handlingStrategy":"try-catch","validationCode":"async function azureCredentialOk(): Promise<boolean> {\n  try {\n    const { DefaultAzureCredential } = await import('@azure/identity');\n    const t = await new DefaultAzureCredential().getToken('https://ossrdbms-aad.database.windows.net/.default');\n    return !!t.token;\n  } catch { return false; }\n}","typeGuard":null,"tryCatchPattern":"try { new Memory(cfg) }\ncatch (e) {\n  if (e instanceof Error && /Azure credential authentication failed/.test(e.message)) {\n    // surface 'check az login / AZURE_* env / managed identity assignment' and fail deployment\n  }\n  throw e;\n}","preventionTips":["Add a pre-deploy check that calls getToken for the ossrdbms AAD scope with the same identity.","Install @azure/identity explicitly in the deploying package.","For local dev prefer explicit password config over AAD unless az login is part of the workflow."],"tags":["azure","authentication","managed-identity","mysql","aad"],"backgroundTag":null,"analyzedSha":"001c235229be8795e3834520467bd0d661ed8f34","analyzedAt":"2026-08-15T01:55:42.685Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}