{"record":{"id":"b8c0e7e44a360f24","repo":"mastra-ai/mastra","slug":"azure-entra-id-auth-not-configured","errorCode":"AZURE_ENTRA_ID_AUTH_NOT_CONFIGURED","errorMessage":"Entra ID authentication is not configured for Azure OpenAI gateway","messagePattern":"Entra ID authentication is not configured for Azure OpenAI gateway","errorType":"validation","errorClass":"MastraError","httpStatus":null,"severity":"error","filePath":"packages/core/src/llm/model/gateways/azure.ts","lineNumber":466,"sourceCode":"      url = data.nextLink;\n    }\n\n    const successfulDeployments = allDeployments.filter(d => d.properties.provisioningState === 'Succeeded');\n\n    return successfulDeployments;\n  }\n\n  buildUrl(_routerId: string, _envVars?: typeof process.env): undefined {\n    return undefined;\n  }\n\n  async getApiKey(_modelId: string): Promise<string> {\n    return this.config.authentication?.type === 'entraId' ? '' : (this.config.apiKey ?? '');\n  }\n\n  private async getEntraIdToken(): Promise<string> {\n    if (this.config.authentication?.type !== 'entraId') {\n      throw new MastraError({\n        id: 'AZURE_ENTRA_ID_AUTH_NOT_CONFIGURED',\n        domain: 'LLM',\n        category: 'UNKNOWN',\n        text: 'Entra ID authentication is not configured for Azure OpenAI gateway',\n      });\n    }\n\n    const scope = this.config.authentication.scope ?? 'https://cognitiveservices.azure.com/.default';\n    const cacheKey = `azure-openai-token:${scope}`;\n    const cached = (await this.tokenCache.get(cacheKey)) as CachedToken | undefined;\n    if (cached && cached.expiresAt > Date.now() / 1000 + 60) {\n      return cached.token;\n    }\n\n    let tokenRequest = this.entraIdTokenRequests.get(cacheKey);\n\n    if (!tokenRequest) {\n      tokenRequest = this.fetchEntraIdToken(scope, cacheKey);","sourceCodeStart":448,"sourceCodeEnd":484,"githubUrl":"https://github.com/mastra-ai/mastra/blob/75dd419e613fe9c39f846ffc500716141b74fda6/packages/core/src/llm/model/gateways/azure.ts#L448-L484","documentation":"getEntraIdToken was called but the gateway is not configured with Entra ID (Azure AD) authentication. This internal guard ensures token acquisition only runs when authentication.type is 'entraId' and a credential is present. It is a configuration-state error, not a network error.","triggerScenarios":"Calling getEntraIdToken() (exposed via token()) when config.authentication is missing, undefined, or its type is not exactly 'entraId'.","commonSituations":"Constructing the Azure gateway with an apiKey (default auth) but calling Entra-ID-specific code paths; typo in authentication type; forgetting to pass the authentication object entirely.","solutions":["Configure the gateway with authentication: { type: 'entraId', credential: <TokenCredential> } (e.g. DefaultAzureCredential from @azure/identity).","If you intend API-key auth, use getApiKey() instead of the Entra ID token path.","Fix typos in the authentication type value so it equals 'entraId'."],"exampleFix":"// before\nconst gw = new MastraAzureGateway({ resource: 'my-resource', apiKey: '...' });\nawait gw.token('https://cognitiveservices.azure.com/.default');\n// after\nimport { DefaultAzureCredential } from '@azure/identity';\nconst gw = new MastraAzureGateway({ resource: 'my-resource', authentication: { type: 'entraId', credential: new DefaultAzureCredential() } });\nawait gw.token('https://cognitiveservices.azure.com/.default');","handlingStrategy":"validation","validationCode":"function canUseEntraId(cfg) { return cfg?.authentication?.type === 'entraId' && typeof cfg.authentication.credential?.getToken === 'function'; }\nif (!canUseEntraId(gatewayConfig)) throw new Error('Configure authentication.type=entraId with a TokenCredential before requesting tokens');","typeGuard":"function hasEntraIdAuth(cfg) {\n  return !!cfg && cfg.authentication?.type === 'entraId' &&\n    typeof cfg.authentication.credential === 'object' &&\n    typeof cfg.authentication.credential.getToken === 'function';\n}","tryCatchPattern":null,"preventionTips":["Always pass { type: 'entraId', credential: new DefaultAzureCredential() } together when using Entra ID.","Use exact string 'entraId' — avoid typos via a constant or union type.","Decide auth mode at construction and stick to one code path (apiKey vs entraId).","Unit-test token acquisition with a fake TokenCredential."],"tags":["azure","authentication","configuration","entra-id"],"backgroundTag":"auth-not-configured","analyzedSha":"75dd419e613fe9c39f846ffc500716141b74fda6","analyzedAt":"2026-08-30T00:15:31.844Z","schemaVersion":2},"datasetVersion":"2026-08-30T03:17:51.788Z"}