{"record":{"id":"dfedf98860b47226","repo":"microsoft/graphrag","slug":"api-key-must-be-set-when-auth-method-api-key","errorCode":null,"errorMessage":"api_key must be set when auth_method=api_key.","messagePattern":"api_key must be set when auth_method=api_key\\.","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"packages/graphrag-llm/graphrag_llm/config/model_config.py","lineNumber":104,"sourceCode":"    )\n\n    def _validate_lite_llm_config(self) -> None:\n        \"\"\"Validate LiteLLM specific configuration.\"\"\"\n        if self.model_provider == \"azure\" and not self.api_base:\n            msg = \"api_base must be specified with the 'azure' model provider.\"\n            raise ValueError(msg)\n\n        if self.model_provider != \"azure\" and self.azure_deployment_name is not None:\n            msg = \"azure_deployment_name should not be specified for non-Azure model providers.\"\n            raise ValueError(msg)\n\n        if self.auth_method == AuthMethod.AzureManagedIdentity:\n            if self.api_key is not None:\n                msg = \"api_key should not be set when using Azure Managed Identity.\"\n                raise ValueError(msg)\n        elif not self.api_key:\n            msg = \"api_key must be set when auth_method=api_key.\"\n            raise ValueError(msg)\n\n    @model_validator(mode=\"after\")\n    def _validate_model(self):\n        \"\"\"Validate model configuration after initialization.\"\"\"\n        if self.type == LLMProviderType.LiteLLM:\n            self._validate_lite_llm_config()\n        return self\n","sourceCodeStart":86,"sourceCodeEnd":112,"githubUrl":"https://github.com/microsoft/graphrag/blob/f40e9a26ce62ba0b3fef8837d24aafdcc6e6c704/packages/graphrag-llm/graphrag_llm/config/model_config.py#L86-L112","documentation":"ModelConfig validation requires an api_key when auth_method defaults to (or is set to) APIKey. Without a key the LLM client cannot authenticate, so construction fails fast.","triggerScenarios":"ModelConfig(model_provider=\"openai\", model=\"gpt-4o\") with no api_key and auth_method=api_key (the default), typically because the API key env var is unset.","commonSituations":"Missing OPENAI_API_KEY / GRAPHRAG_API_KEY in the shell, CI, or container; typo'd env var name in .env; key present at deploy time but not in the local run environment.","solutions":["Set the api_key directly or export the expected env var (e.g. GRAPHRAG_API_KEY / OPENAI_API_KEY) before constructing the config","For Azure Managed Identity or other keyless auth, set auth_method=AuthMethod.AzureManagedIdentity explicitly"],"exampleFix":"# before\nModelConfig(model_provider=\"openai\", model=\"gpt-4o\")  # ValueError: no key\n# after\nModelConfig(model_provider=\"openai\", model=\"gpt-4o\", api_key=os.environ[\"OPENAI_API_KEY\"])","handlingStrategy":"validation","validationCode":"if auth_method == AuthMethod.APIKey and not os.environ.get(\"GRAPHRAG_API_KEY\"):\n    raise SystemExit(\"GRAPHRAG_API_KEY is not set; export it before running\")","typeGuard":null,"tryCatchPattern":"try:\n    ModelConfig(**cfg)\nexcept ValueError as e:\n    if \"api_key must be set\" in str(e):\n        cfg[\"api_key\"] = os.environ[\"OPENAI_API_KEY\"]\n        model = ModelConfig(**cfg)\n    else:\n        raise","preventionTips":["Load .env early (python-dotenv) and fail fast on missing key vars","Name env vars consistently and document them in the project README","Add a smoke-test that constructs ModelConfig in CI to catch missing keys"],"tags":["auth","api-key","missing-env-var","config-validation"],"backgroundTag":"missing-api-key","analyzedSha":"f40e9a26ce62ba0b3fef8837d24aafdcc6e6c704","analyzedAt":"2026-08-27T11:16:29.677Z","schemaVersion":2},"datasetVersion":"2026-08-27T13:17:12.746Z"}