{"record":{"id":"d29229fd817e7e77","repo":"openai/openai-python","slug":"x-509-workload-identity-is-not-supported-by-azure","errorCode":null,"errorMessage":"X.509 workload identity is not supported by Azure clients","messagePattern":"X\\.509 workload identity is not supported by Azure clients","errorType":"error_code","errorClass":"OpenAIError","httpStatus":null,"severity":"error","filePath":"src/openai/lib/azure.py","lineNumber":295,"sourceCode":"        - `api_version` from `OPENAI_API_VERSION`\n        - `azure_endpoint` from `AZURE_OPENAI_ENDPOINT`\n\n        Pass at most one of `api_key`, `azure_ad_token`, or `azure_ad_token_provider`.\n        An explicit credential takes precedence over Azure credential environment variables.\n        With no explicit credential, `AZURE_OPENAI_AD_TOKEN` takes precedence over `AZURE_OPENAI_API_KEY`.\n\n        Args:\n            azure_endpoint: Your Azure endpoint, including the resource, e.g. `https://example-resource.azure.openai.com/`\n\n            azure_ad_token: Your Azure Active Directory token, https://www.microsoft.com/en-us/security/business/identity-access/microsoft-entra-id\n\n            azure_ad_token_provider: A function that returns an Azure Active Directory token, will be invoked on every request.\n\n            azure_deployment: A model deployment, if given with `azure_endpoint`, sets the base client URL to include `/deployments/{azure_deployment}`.\n                Not supported with Assistants APIs.\n        \"\"\"\n        if is_x509_workload_identity(workload_identity):\n            raise OpenAIError(\"X.509 workload identity is not supported by Azure clients\")\n\n        api_key, azure_ad_token, azure_ad_token_provider = _resolve_azure_auth(\n            api_key, azure_ad_token, azure_ad_token_provider\n        )\n\n        if _enforce_credentials and api_key is None and azure_ad_token is None and azure_ad_token_provider is None:\n            raise OpenAIError(\n                \"Missing credentials. Please pass one of `api_key`, `azure_ad_token`, `azure_ad_token_provider`, or the `AZURE_OPENAI_API_KEY` or `AZURE_OPENAI_AD_TOKEN` environment variables.\"\n            )\n\n        if api_version is None:\n            api_version = os.environ.get(\"OPENAI_API_VERSION\")\n\n        if api_version is None:\n            raise ValueError(\n                \"Must provide either the `api_version` argument or the `OPENAI_API_VERSION` environment variable\"\n            )\n","sourceCodeStart":277,"sourceCodeEnd":313,"githubUrl":"https://github.com/openai/openai-python/blob/9917c6e28e66e90e1227b3d223c06a8c5441515a/src/openai/lib/azure.py#L277-L313","documentation":"The AzureOpenAI client explicitly rejects the X.509 workload-identity option (client-level x509 credentials) because Azure auth uses API keys, AAD tokens, or token providers instead. Passing workload_identity to AzureOpenAI raises OpenAIError at construction.","triggerScenarios":"Instantiating AzureOpenAI(workload_identity=...) with the cert-based workload identity intended for the base OpenAI client (Google Cloud style).","commonSituations":"Copy-pasting client setup between OpenAI and Azure flavors; migrating an app to Azure AD while keeping x509 config; config templates that set workload_identity unconditionally.","solutions":["Remove workload_identity and authenticate with api_key, azure_ad_token, or azure_ad_token_provider","For managed identity in Azure, use azure_identity.DefaultAzureCredential via azure_ad_token_provider","Keep x509 workload identity only for the plain OpenAI client where it is supported"],"exampleFix":"# before\nclient = AzureOpenAI(workload_identity=x509_opts)\n# after\nfrom azure.identity import DefaultAzureCredential\nclient = AzureOpenAI(azure_ad_token_provider=DefaultAzureCredential().get_token, ...)\n# or AzureOpenAI(api_key=...)","handlingStrategy":"validation","validationCode":"if workload_identity is not None and using_azure:\n    raise ValueError(\"configure azure_ad_token_provider instead of workload_identity\")","typeGuard":"def azure_auth_ok(kwargs: dict) -> bool:\n    return \"workload_identity\" not in kwargs and any(\n        k in kwargs for k in (\"api_key\", \"azure_ad_token\", \"azure_ad_token_provider\")\n    ) or bool(os.environ.get(\"AZURE_OPENAI_API_KEY\"))","tryCatchPattern":"try:\n    client = AzureOpenAI(**opts)\nexcept OpenAIError as e:\n    raise SystemExit(f\"Azure client config error: {e}\") from e","preventionTips":["Keep separate client-construction code paths for OpenAI vs AzureOpenAI","Use azure-identity DefaultAzureCredential for Azure managed identity"],"tags":["azure","authentication","x509","config"],"backgroundTag":"auth-method-not-supported","analyzedSha":"9917c6e28e66e90e1227b3d223c06a8c5441515a","analyzedAt":"2026-08-28T11:46:34.183Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}