{"record":{"id":"fe67e7a0f6c08b31","repo":"microsoft/semantic-kernel","slug":"please-provide-either-an-api-key-ad-token-ad-tok-fe67e7","errorCode":null,"errorMessage":"Please provide either an api_key, ad_token, ad_token_provider or credential for authentication.","messagePattern":"Please provide either an api_key, ad_token, ad_token_provider or credential for authentication\\.","errorType":"exception","errorClass":"AgentInitializationException","httpStatus":null,"severity":"critical","filePath":"python/semantic_kernel/agents/open_ai/azure_responses_agent.py","lineNumber":119,"sourceCode":"                env_file_path=env_file_path,\n                env_file_encoding=env_file_encoding,\n                token_endpoint=token_scope,\n            )\n        except ValidationError as exc:\n            raise AgentInitializationException(f\"Failed to create Azure OpenAI settings: {exc}\") from exc\n\n        if (\n            azure_openai_settings.api_key is None\n            and ad_token_provider is None\n            and ad_token is None\n            and azure_openai_settings.token_endpoint\n            and credential\n        ):\n            ad_token = get_entra_auth_token(credential, azure_openai_settings.token_endpoint)\n\n        # If we still have no credentials, we can't proceed\n        if not azure_openai_settings.api_key and not ad_token and not ad_token_provider and not credential:\n            raise AgentInitializationException(\n                \"Please provide either an api_key, ad_token, ad_token_provider or credential for authentication.\"\n            )\n\n        merged_headers = dict(copy(default_headers)) if default_headers else {}\n        if default_headers:\n            merged_headers.update(default_headers)\n        if APP_INFO:\n            merged_headers.update(APP_INFO)\n            merged_headers = prepend_semantic_kernel_to_user_agent(merged_headers)\n\n        if not azure_openai_settings.endpoint:\n            raise AgentInitializationException(\"Please provide an Azure OpenAI endpoint\")\n\n        if not azure_openai_settings.responses_deployment_name:\n            raise AgentInitializationException(\"Please provide an Azure OpenAI Responses deployment name\")\n\n        client = AsyncAzureOpenAI(\n            azure_endpoint=str(azure_openai_settings.endpoint),","sourceCodeStart":101,"sourceCodeEnd":137,"githubUrl":"https://github.com/microsoft/semantic-kernel/blob/c028a0c7dc4f0814cdcbaba9d998f187a41197bf/python/semantic_kernel/agents/open_ai/azure_responses_agent.py#L101-L137","documentation":"Raised by AzureResponsesAgent's client builder after settings are created when no authentication credential is available. The builder first tries to mint an Entra token from a supplied credential+token_endpoint; if that yields nothing and api_key, ad_token, and ad_token_provider are all absent, it cannot authenticate and aborts.","triggerScenarios":"Constructing AzureResponsesAgent without AZURE_OPENAI_API_KEY and without passing api_key, ad_token, ad_token_provider, or a credential object. Also when a credential is passed but token_endpoint retrieval returns None (credential not authorized for the scope).","commonSituations":"Running locally without logging into Azure CLI (az login) while relying on DefaultAzureCredential; forgetting AZURE_OPENAI_API_KEY in CI; using a managed identity that lacks the Cognitive Services OpenAI Contributor role on the resource.","solutions":["Set AZURE_OPENAI_API_KEY, or pass api_key= to the constructor.","Pass a credential (e.g. DefaultAzureCredential()) and ensure you are logged in (az login) and granted the resource access.","Provide ad_token or ad_token_provider for token-based auth.","If using DefaultAzureCredential, confirm the token_endpoint/scope is correct (default https://cognitiveservices.azure.com/.default)."],"exampleFix":"# before\nAzureResponsesAgent(endpoint=..., deployment_name=...)  # no auth\n# after\nAzureResponsesAgent(endpoint=..., deployment_name=..., api_key=os.environ[\"AZURE_OPENAI_API_KEY\"])\n# or token-based\nAzureResponsesAgent(endpoint=..., deployment_name=..., credential=DefaultAzureCredential())","handlingStrategy":"validation","validationCode":"from semantic_kernel.connectors.ai.open_ai.settings import AzureOpenAISettings\n\nsettings = AzureOpenAISettings()\nhas_auth = bool(\n    settings.api_key or ad_token or ad_token_provider or credential\n)\nif not has_auth:\n    raise SystemExit(\n        \"No Azure OpenAI auth: set AZURE_OPENAI_API_KEY or pass a credential/token.\"\n    )","typeGuard":null,"tryCatchPattern":"from semantic_kernel.exceptions.agent_exceptions import AgentInitializationException\n\ntry:\n    agent = AzureResponsesAgent(endpoint=ep, deployment_name=name, credential=cred)\nexcept AgentInitializationException as e:\n    if \"api_key, ad_token\" in str(e):\n        # fall back to explicit key from secret store\n        agent = AzureResponsesAgent(endpoint=ep, deployment_name=name, api_key=get_secret(\"AOAI_KEY\"))\n    else:\n        raise","preventionTips":["Decide on one auth strategy (key vs Entra credential) and enforce it in a shared factory.","For DefaultAzureCredential, ensure az login locally and managed identity + RBAC in deployment.","Fail fast at startup if no credential source is configured."],"tags":["azure-openai","authentication","configuration","semantic-kernel","agents","initialization","entra-id"],"backgroundTag":null,"analyzedSha":"c028a0c7dc4f0814cdcbaba9d998f187a41197bf","analyzedAt":"2026-08-13T13:48:05.040Z","schemaVersion":2},"datasetVersion":"2026-08-13T14:17:21.547Z"}