{"record":{"id":"ec6a8201c2e6df72","repo":"microsoft/graphrag","slug":"specify-either-connection-string-or-account-url","errorCode":null,"errorMessage":"Specify either 'connection_string' or 'account_url', not both.","messagePattern":"Specify either 'connection_string' or 'account_url', not both\\.","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"packages/graphrag-storage/graphrag_storage/azure_cosmos_storage.py","lineNumber":71,"sourceCode":"    def __init__(\n        self,\n        database_name: str,\n        container_name: str,\n        connection_string: str | None = None,\n        account_url: str | None = None,\n        encoding: str = \"utf-8\",\n        namespace: str = \"\",\n        **kwargs: Any,\n    ) -> None:\n        \"\"\"Create a CosmosDB key-value storage instance.\"\"\"\n        logger.info(\"Creating CosmosDB key-value storage\")\n        if not database_name:\n            msg = \"CosmosDB Storage requires 'database_name'.\"\n            raise ValueError(msg)\n\n        if connection_string is not None and account_url is not None:\n            msg = \"Specify either 'connection_string' or 'account_url', not both.\"\n            raise ValueError(msg)\n\n        if connection_string:\n            self._cosmos_client = CosmosClient.from_connection_string(connection_string)\n        elif account_url:\n            self._cosmos_client = CosmosClient(\n                url=account_url,\n                credential=DefaultAzureCredential(),\n            )\n        else:\n            msg = \"CosmosDB Storage requires 'connection_string' or 'account_url'.\"\n            raise ValueError(msg)\n\n        self._encoding = encoding\n        self._database_name = database_name\n        self._connection_string = connection_string\n        self._cosmosdb_account_url = account_url\n        self._container_name = container_name\n        self._namespace = namespace","sourceCodeStart":53,"sourceCodeEnd":89,"githubUrl":"https://github.com/microsoft/graphrag/blob/f40e9a26ce62ba0b3fef8837d24aafdcc6e6c704/packages/graphrag-storage/graphrag_storage/azure_cosmos_storage.py#L53-L89","documentation":"AzureCosmosStorage accepts two mutually exclusive ways to reach CosmosDB: a full connection string or an account URL paired with DefaultAzureCredential. Supplying both is ambiguous (which auth wins?), so the constructor rejects it immediately. This is a guard against conflicting authentication configuration.","triggerScenarios":"Passing both connection_string and account_url to AzureCosmosStorage.__init__, e.g. having GRAPHRAG_COSMOSDB_CONNECTION_STRING set while also setting account_url in config.","commonSituations":"Env-var connection string leaks into a config that also specifies account_url for managed-identity auth; merging example configs that each use a different auth style.","solutions":["Pick one auth method: keep connection_string and remove account_url, or vice versa","If the connection string comes from an env var, unset it when using account_url + DefaultAzureCredential","Prefer account_url with managed identity for production deployments"],"exampleFix":"# before\nAzureCosmosStorage(connection_string=conn, account_url=\"https://myacct.documents.azure.com\")\n# after\nAzureCosmosStorage(account_url=\"https://myacct.documents.azure.com\")  # uses DefaultAzureCredential","handlingStrategy":"validation","validationCode":"assert not (cfg.get(\"connection_string\") and cfg.get(\"account_url\")), \"pick one cosmos auth method\"","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Standardize on one auth style per environment","Audit env vars before runs to catch stray connection strings"],"tags":["cosmosdb","auth","config-conflict"],"backgroundTag":"conflicting-auth-config","analyzedSha":"f40e9a26ce62ba0b3fef8837d24aafdcc6e6c704","analyzedAt":"2026-08-27T11:16:29.677Z","schemaVersion":2},"datasetVersion":"2026-08-27T13:17:12.746Z"}