{"record":{"id":"c0d3c449fdde5ef9","repo":"microsoft/semantic-kernel","slug":"please-provide-a-token-endpoint-to-retrieve-the-au","errorCode":null,"errorMessage":"Please provide a token endpoint to retrieve the authentication token.","messagePattern":"Please provide a token endpoint to retrieve the authentication token\\.","errorType":"exception","errorClass":"ServiceInitializationError","httpStatus":null,"severity":"error","filePath":"python/semantic_kernel/connectors/ai/open_ai/settings/azure_open_ai_settings.py","lineNumber":132,"sourceCode":"\n        The required role for the token is `Cognitive Services OpenAI Contributor`.\n        The token endpoint may be specified as an environment variable, via the .env\n        file or as an argument. If the token endpoint is not provided, the default is None.\n        The `token_endpoint` argument takes precedence over the `token_endpoint` attribute.\n\n        Args:\n            credential: The credential to use for authentication.\n            token_endpoint: The token endpoint to use. Defaults to `https://cognitiveservices.azure.com/.default`.\n\n        Returns:\n            The Azure token or None if the token could not be retrieved.\n\n        Raises:\n            ServiceInitializationError: If the token endpoint is not provided.\n        \"\"\"\n        endpoint_to_use = token_endpoint or self.token_endpoint\n        if endpoint_to_use is None:\n            raise ServiceInitializationError(\"Please provide a token endpoint to retrieve the authentication token.\")\n        if credential is None:\n            raise ServiceInitializationError(\"Please provide a credential to retrieve the authentication token.\")\n        return get_entra_auth_token(credential, endpoint_to_use)\n","sourceCodeStart":114,"sourceCodeEnd":136,"githubUrl":"https://github.com/microsoft/semantic-kernel/blob/c028a0c7dc4f0814cdcbaba9d998f187a41197bf/python/semantic_kernel/connectors/ai/open_ai/settings/azure_open_ai_settings.py#L114-L136","documentation":"Raised by AzureOpenAISettings.get_azure_openai_auth_token when no token endpoint can be resolved. It uses the token_endpoint argument if given, else falls back to self.token_endpoint; if both are None it throws ServiceInitializationError. Note self.token_endpoint defaults to 'https://cognitiveservices.azure.com/.default', so this only fires when that default has been explicitly cleared (e.g. AZURE_OPENAI_TOKEN_ENDPOINT set to empty) or the settings object was constructed with token_endpoint=None.","triggerScenarios":"Calling settings.get_azure_openai_auth_token(credential=cred) when self.token_endpoint is None and no token_endpoint argument is supplied. This typically requires AZURE_OPENAI_TOKEN_ENDPOINT to be set to an empty string in the environment, which overrides the pydantic default.","commonSituations":"AZURE_OPENAI_TOKEN_ENDPOINT was set to an empty value in a .env or CI config, overriding the class default; the settings object was built with an explicit token_endpoint=None; a custom Azure sovereign-cloud deployment that needs a different scope but the value was left blank.","solutions":["Pass the endpoint explicitly: settings.get_azure_openai_auth_token(credential=cred, token_endpoint='https://cognitiveservices.azure.com/.default')","Set AZURE_OPENAI_TOKEN_ENDPOINT to a non-empty scope in your environment/.env","For sovereign clouds, use the correct scope, e.g. 'https://cognitiveservices.azure.cn/.default'"],"exampleFix":"# before\nsettings.token_endpoint = None\nsettings.get_azure_openai_auth_token(credential=cred)\n\n# after\nsettings.get_azure_openai_auth_token(\n    credential=cred,\n    token_endpoint=\"https://cognitiveservices.azure.com/.default\",\n)","handlingStrategy":"validation","validationCode":"endpoint = token_endpoint or settings.token_endpoint\nif endpoint is None:\n    raise ValueError(\"A token_endpoint is required for Azure Entra auth\")\ntoken = settings.get_azure_openai_auth_token(credential=cred, token_endpoint=endpoint)","typeGuard":"def has_token_endpoint(settings: \"AzureOpenAISettings\", token_endpoint: str | None) -> bool:\n    return bool(token_endpoint or settings.token_endpoint)","tryCatchPattern":"from semantic_kernel.exceptions.service_exceptions import ServiceInitializationError\n\ntry:\n    token = settings.get_azure_openai_auth_token(credential=cred)\nexcept ServiceInitializationError as e:\n    if \"token endpoint\" in str(e):\n        token = settings.get_azure_openai_auth_token(\n            credential=cred,\n            token_endpoint=\"https://cognitiveservices.azure.com/.default\",\n        )\n    else:\n        raise","preventionTips":["Do not leave AZURE_OPENAI_TOKEN_ENDPOINT empty in .env","Pass token_endpoint explicitly for sovereign clouds","Default the scope to the cognitiveservices scope when unsure"],"tags":["azure","azure-openai","authentication","configuration","python"],"backgroundTag":null,"analyzedSha":"c028a0c7dc4f0814cdcbaba9d998f187a41197bf","analyzedAt":"2026-08-13T13:48:05.040Z","schemaVersion":2},"datasetVersion":"2026-08-13T14:17:21.547Z"}