{"record":{"id":"67c2f1b1ba9cf4ac","repo":"vercel/ai","slug":"both-apikey-and-tokenprovider-were-provided-pleas","errorCode":null,"errorMessage":"Both apiKey and tokenProvider were provided. Please use only one authentication method.","messagePattern":"Both apiKey and tokenProvider were provided\\. Please use only one authentication method\\.","errorType":"validation","errorClass":"InvalidArgumentError","httpStatus":null,"severity":"error","filePath":"packages/azure/src/azure-openai-provider.ts","lineNumber":173,"sourceCode":"  useDeploymentBasedUrls?: boolean;\n}\n\nfunction isAzureOpenAIBaseURL(baseURL: string | undefined) {\n  return (\n    baseURL == null || new URL(baseURL).hostname.endsWith('.openai.azure.com')\n  );\n}\n\n/**\n * Create an Azure OpenAI provider instance.\n */\nexport function createAzure(\n  options: AzureOpenAIProviderSettings = {},\n): AzureOpenAIProvider {\n  const tokenProvider = options.tokenProvider;\n\n  if (options.apiKey && tokenProvider) {\n    throw new InvalidArgumentError({\n      argument: 'apiKey/tokenProvider',\n      message:\n        'Both apiKey and tokenProvider were provided. Please use only one authentication method.',\n    });\n  }\n\n  const getHeaders = () => {\n    const authHeaders = tokenProvider\n      ? {}\n      : {\n          'api-key': loadApiKey({\n            apiKey: options.apiKey,\n            environmentVariableName: 'AZURE_API_KEY',\n            description: 'Azure OpenAI',\n          }),\n        };\n\n    return withUserAgentSuffix(","sourceCodeStart":155,"sourceCodeEnd":191,"githubUrl":"https://github.com/vercel/ai/blob/69428b1f8b037e4d118fb4853428d5c4e620493c/packages/azure/src/azure-openai-provider.ts#L155-L191","documentation":"createAzure validates that exactly one auth mechanism is configured. Passing both options.apiKey and options.tokenProvider is ambiguous, so it throws InvalidArgumentError immediately at provider creation.","triggerScenarios":"Calling createAzure({ apiKey: '...', tokenProvider }) — or the equivalent createAzureOpenAI — with both an API key and a token provider callback.","commonSituations":"Migrating from API-key auth to Entra ID token auth but leaving the old AZURE_API_KEY env var wired in; merging default config objects where both fields are set.","solutions":["Remove options.apiKey and keep tokenProvider for Entra ID / AAD auth.","Or remove tokenProvider and keep apiKey for key-based auth.","Make the choice conditional in code so only one is ever passed."],"exampleFix":"// before\nconst azure = createAzure({ apiKey: process.env.AZURE_API_KEY, tokenProvider: getAccessToken });\n// after\nconst azure = createAzure({ tokenProvider: getAccessToken }); // or { apiKey: process.env.AZURE_API_KEY }","handlingStrategy":"validation","validationCode":"const settings = { apiKey: process.env.AZURE_API_KEY, tokenProvider };\nif (settings.apiKey && settings.tokenProvider) {\n  throw new Error('Configure either apiKey or tokenProvider for Azure, not both');\n}","typeGuard":null,"tryCatchPattern":"try {\n  const azure = createAzure(settings);\n} catch (e) {\n  if (e instanceof InvalidArgumentError && e.message.includes('tokenProvider')) {\n    // sanitize config and rebuild\n  }\n}","preventionTips":["Build auth settings from a single source and pick one mechanism explicitly.","Delete legacy API key env vars when switching to token-based auth.","Never spread two config objects that may both set credentials."],"tags":["authentication","configuration","azure"],"backgroundTag":"conflicting-auth-options","analyzedSha":"69428b1f8b037e4d118fb4853428d5c4e620493c","analyzedAt":"2026-08-30T12:32:21.016Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}