{"record":{"id":"dc9dc9a7d4150639","repo":"openai/openai-python","slug":"could-not-resolve-authentication-method-expected-dc9dc9","errorCode":null,"errorMessage":"\"Could not resolve authentication method. Expected either api_key, azure_ad_token or azure_ad_token_provider to be set. Or for one of the `Authorization` or `api-key` headers to be explicitly supplied or omitted\"","messagePattern":"\"Could not resolve authentication method\\. Expected either api_key, azure_ad_token or azure_ad_token_provider to be set\\. Or for one of the `Authorization` or `api-key` headers to be explicitly supplied or omitted\"","errorType":"validation","errorClass":"TypeError","httpStatus":null,"severity":"critical","filePath":"src/openai/lib/azure.py","lineNumber":471,"sourceCode":"\n        return None\n\n    @override\n    def _auth_headers(self, security: SecurityOptions) -> dict[str, str]:  # noqa: ARG002\n        if self._azure_ad_token is not None:\n            return {\"Authorization\": f\"Bearer {self._azure_ad_token}\"}\n\n        if self.api_key and self.api_key != API_KEY_SENTINEL:\n            return {\"api-key\": self.api_key}\n\n        return {}\n\n    @override\n    def _validate_headers(self, headers: Headers, custom_headers: Headers) -> None:\n        if _has_auth_header(headers) or _has_auth_header(custom_headers):\n            return\n\n        raise TypeError(\n            '\"Could not resolve authentication method. Expected either api_key, azure_ad_token or azure_ad_token_provider to be set. Or for one of the `Authorization` or `api-key` headers to be explicitly supplied or omitted\"'\n        )\n\n    @override\n    def _prepare_options(self, options: FinalRequestOptions) -> FinalRequestOptions:\n        if self._api_key_provider is not None:\n            self._refresh_api_key()\n\n        headers: dict[str, str | Omit] = {**options.headers} if is_given(options.headers) else {}\n\n        options = model_copy(options)\n        options.headers = headers\n\n        azure_ad_token = self._get_azure_ad_token()\n        if azure_ad_token is not None:\n            if not _has_header(headers, \"Authorization\"):\n                headers[\"Authorization\"] = f\"Bearer {azure_ad_token}\"\n        elif self.api_key and self.api_key != API_KEY_SENTINEL:","sourceCodeStart":453,"sourceCodeEnd":489,"githubUrl":"https://github.com/openai/openai-python/blob/9917c6e28e66e90e1227b3d223c06a8c5441515a/src/openai/lib/azure.py#L453-L489","documentation":"The sync Azure client found no usable credential: no API key, no Azure AD token/provider, and no explicit Authorization or api-key header. _validate_headers raises TypeError at that point because the request cannot be authenticated.","triggerScenarios":"Constructing AzureOpenAI with none of api_key/azure_ad_token/azure_ad_token_provider, no AZURE_OPENAI_API_KEY env var, and no default Authorization or api-key header, then making any request.","commonSituations":"Env vars missing in CI/containers, credential code commented out, or assuming the client auto-discovers Azure credentials (only your explicit provider does that).","solutions":["Pass api_key or azure_ad_token_provider (e.g. from azure.identity DefaultAzureCredential)","Set AZURE_OPENAI_API_KEY env var","Or supply an explicit Authorization/api-key header in default_headers if you handle auth at a proxy"],"exampleFix":"# before\nclient = AzureOpenAI(azure_endpoint=..., api_version=...)\n# after\nfrom azure.identity import DefaultAzureCredential, get_bearer_token_provider\nclient = AzureOpenAI(azure_endpoint=..., api_version=..., azure_ad_token_provider=get_bearer_token_provider(DefaultAzureCredential(), \"https://cognitiveservices.azure.com/.default\"))","handlingStrategy":"try-catch","validationCode":"has_creds = bool(os.environ.get(\"AZURE_OPENAI_API_KEY\") or azure_ad_token or azure_ad_token_provider or auth_header_in_defaults)\nif not has_creds: raise RuntimeError(\"no Azure credential configured\")","typeGuard":null,"tryCatchPattern":"try:\n    client.chat.completions.create(...)\nexcept TypeError as e:\n    if \"Could not resolve authentication method\" in str(e):\n        raise AuthConfigError(str(e)) from e\n    raise","preventionTips":["Set AZURE_OPENAI_API_KEY in deployment env","Prefer azure_ad_token_provider for AAD setups","Add a startup credential smoke test"],"tags":["azure","authentication","credentials","headers"],"backgroundTag":"missing-credentials","analyzedSha":"9917c6e28e66e90e1227b3d223c06a8c5441515a","analyzedAt":"2026-08-28T11:46:34.183Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}