{"record":{"id":"6b1dcc93caf7bd73","repo":"microsoft/graphrag","slug":"api-key-should-not-be-set-when-using-azure-managed","errorCode":null,"errorMessage":"api_key should not be set when using Azure Managed Identity.","messagePattern":"api_key should not be set when using Azure Managed Identity\\.","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"packages/graphrag-llm/graphrag_llm/config/model_config.py","lineNumber":101,"sourceCode":"    mock_responses: list[str] | list[float] = Field(\n        default_factory=list,\n        description=\"List of mock responses for testing.\",\n    )\n\n    def _validate_lite_llm_config(self) -> None:\n        \"\"\"Validate LiteLLM specific configuration.\"\"\"\n        if self.model_provider == \"azure\" and not self.api_base:\n            msg = \"api_base must be specified with the 'azure' model provider.\"\n            raise ValueError(msg)\n\n        if self.model_provider != \"azure\" and self.azure_deployment_name is not None:\n            msg = \"azure_deployment_name should not be specified for non-Azure model providers.\"\n            raise ValueError(msg)\n\n        if self.auth_method == AuthMethod.AzureManagedIdentity:\n            if self.api_key is not None:\n                msg = \"api_key should not be set when using Azure Managed Identity.\"\n                raise ValueError(msg)\n        elif not self.api_key:\n            msg = \"api_key must be set when auth_method=api_key.\"\n            raise ValueError(msg)\n\n    @model_validator(mode=\"after\")\n    def _validate_model(self):\n        \"\"\"Validate model configuration after initialization.\"\"\"\n        if self.type == LLMProviderType.LiteLLM:\n            self._validate_lite_llm_config()\n        return self\n","sourceCodeStart":83,"sourceCodeEnd":112,"githubUrl":"https://github.com/microsoft/graphrag/blob/f40e9a26ce62ba0b3fef8837d24aafdcc6e6c704/packages/graphrag-llm/graphrag_llm/config/model_config.py#L83-L112","documentation":"ModelConfig validation forbids api_key when auth_method is AzureManagedIdentity. Managed Identity authenticates via the platform identity, so supplying a key is contradictory and usually means a stale key leaked into the config.","triggerScenarios":"ModelConfig(auth_method=AuthMethod.AzureManagedIdentity, api_key=\"sk-...\") or settings.yaml with both managed identity auth and an api_key entry/env var still set.","commonSituations":"Switching an Azure deployment from key auth to Managed Identity but leaving GRAPHRAG_API_KEY in the environment or settings file; the settings loader auto-populates api_key from env.","solutions":["Unset the api_key / GRAPHRAG_API_KEY environment variable or remove api_key from settings.yaml when using Managed Identity","If you actually want key auth, set auth_method to APIKey instead"],"exampleFix":"# before\nModelConfig(auth_method=AuthMethod.AzureManagedIdentity, api_key=os.environ[\"API_KEY\"])\n# after\nModelConfig(auth_method=AuthMethod.AzureManagedIdentity)  # key removed, env var unset","handlingStrategy":"validation","validationCode":"if auth_method == AuthMethod.AzureManagedIdentity:\n    assert not api_key, \"unset api_key before using Managed Identity\"","typeGuard":null,"tryCatchPattern":null,"preventionTips":["When switching to Managed Identity, unset GRAPHRAG_API_KEY/OPENAI_API_KEY in the environment and CI secrets","Add a startup assertion that api_key is None for managed-identity deployments"],"tags":["azure","managed-identity","auth","config-validation"],"backgroundTag":"invalid-config-combination","analyzedSha":"f40e9a26ce62ba0b3fef8837d24aafdcc6e6c704","analyzedAt":"2026-08-27T11:16:29.677Z","schemaVersion":2},"datasetVersion":"2026-08-27T13:17:12.746Z"}