{"record":{"id":"fa2aa93e55c75f0f","repo":"openai/openai-python","slug":"azure-imds-response-did-not-include-an-access-toke","errorCode":null,"errorMessage":"Azure IMDS response did not include an access_token","messagePattern":"Azure IMDS response did not include an access_token","errorType":"exception","errorClass":"SubjectTokenProviderError","httpStatus":null,"severity":"critical","filePath":"src/openai/auth/_workload.py","lineNumber":153,"sourceCode":"                params[\"client_id\"] = client_id\n            if msi_res_id is not None:\n                params[\"msi_res_id\"] = msi_res_id\n\n            if http_client is not None:\n                response = http_client.get(url, params=params, headers={\"Metadata\": \"true\"}, timeout=timeout)\n            else:\n                with httpx2.Client() as client:\n                    response = client.get(url, params=params, headers={\"Metadata\": \"true\"}, timeout=timeout)\n\n            if response.is_error:\n                raise SubjectTokenProviderError(\n                    f\"Failed to fetch Azure subject token from IMDS: HTTP {response.status_code}\",\n                    response=response,\n                )\n            data = response.json()\n            token = data.get(\"access_token\")\n            if not token:\n                raise SubjectTokenProviderError(\n                    \"Azure IMDS response did not include an access_token\", response=response\n                )\n            return cast(str, token)\n        except Exception as e:\n            raise SubjectTokenProviderError(f\"Failed to fetch Azure subject token from IMDS: {e}\") from e\n\n    return {\"token_type\": \"jwt\", \"get_token\": get_token}\n\n\ndef gcp_id_token_provider(\n    audience: str = \"https://api.openai.com/v1\",\n    *,\n    timeout: float = 10.0,\n    http_client: httpx2.Client | None = None,\n) -> SubjectTokenProvider:\n    \"\"\"\n    Get a subject token provider for GCP VM instances using the instance metadata server.\n","sourceCodeStart":135,"sourceCodeEnd":171,"githubUrl":"https://github.com/openai/openai-python/blob/9917c6e28e66e90e1227b3d223c06a8c5441515a/src/openai/auth/_workload.py#L135-L171","documentation":"IMDS returned HTTP success but the JSON body either lacked an access_token key or contained a falsy value. This means the metadata endpoint is reachable (often a proxy or a misrouted 169.254.169.254 answering) but is not returning a genuine Azure IMDS token payload — the provider treats it as an authentication failure rather than sending an invalid token upstream.","triggerScenarios":"Success-status responses from something impersonating IMDS: cloud-proxied metadata endpoints, container network setups that intercept link-local addresses, or environments (e.g. non-Azure clouds/VMs with fake IMDS) returning JSON without access_token; also Azure environments in an unusual state returning error JSON with 200.","commonSituations":"Running in Docker/K8s where 169.254.169.254 is NAT'd to another service; localhost proxies answering all routes with 200; middleware appliances; misconfigured Azure Stack/sovereign cloud endpoints.","solutions":["Verify what actually answers: curl http://169.254.169.254/metadata/identity/oauth2/token?... from the same network namespace","Disable/adjust proxies and network policies so link-local metadata traffic reaches real Azure IMDS (NO_PROXY=169.254.169.254)","If not on Azure, use the correct provider for your platform (GCP metadata, k8s workload identity, or API key)","Attach and inspect the response on the error object to see the unexpected payload"],"exampleFix":"# before\nexport HTTP_PROXY=http://proxy:3128  # proxy intercepts 169.254.169.254\n\n# after\nexport NO_PROXY=169.254.169.254\nexport HTTP_PROXY=http://proxy:3128","handlingStrategy":"fallback","validationCode":"import httpx, json\nr = httpx.get(IMDS_URL, headers={\"Metadata\":\"true\"})\nassert \"access_token\" in r.json(), r.text[:200]","typeGuard":null,"tryCatchPattern":"try:\n    token = get_token()\nexcept SubjectTokenProviderError as e:\n    token = fallback_credential()  # e.g. env API key / Azure CLI","preventionTips":["Exclude 169.254.169.254 from proxies (NO_PROXY)","Verify what answers on the metadata IP","Use platform-appropriate credential providers"],"tags":["azure","imds","managed-identity","auth"],"backgroundTag":"metadata-server-auth-failed","analyzedSha":"9917c6e28e66e90e1227b3d223c06a8c5441515a","analyzedAt":"2026-08-28T11:46:34.183Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}