can1357/oh-my-pi · error · AIError.MissingApiKeyError

Azure OpenAI API key is required. Set AZURE_OPENAI_API_KEY e

Error message

Azure OpenAI API key is required. Set AZURE_OPENAI_API_KEY environment variable or pass it as an argument.

What it means

buildAzureResponsesRequest requires an API key for Azure OpenAI authentication. When the apiKey argument is empty/undefined it falls back to the AZURE_OPENAI_API_KEY environment variable; if that is also missing it throws MissingApiKeyError. Azure OpenAI uses api-key header auth, so no request can be signed without it.

Source

Thrown at packages/ai/src/providers/azure-openai-responses.ts:345

/**
 * Replicates the `AzureOpenAI` SDK client's request shape for `/responses`:
 * a string api key becomes a single `api-key` header (azure.mjs `authHeaders`;
 * never `Authorization: Bearer`), `api-version` rides as a query parameter
 * (azure.mjs constructor `defaultQuery`), and `/responses` is not a
 * deployment-scoped path, so no `/deployments/{model}` URL rewriting applies.
 * Custom model/options headers may override the auth header, matching the SDK's
 * `buildHeaders` precedence.
 */
function buildAzureResponsesRequest(
	model: Model<"azure-openai-responses">,
	apiKey: string,
	options?: AzureOpenAIResponsesOptions,
): { url: string; headers: Record<string, string>; baseUrl: string } {
	if (!apiKey) {
		const envKey = $env.AZURE_OPENAI_API_KEY;
		if (!envKey) {
			throw new AIError.MissingApiKeyError(
				undefined,
				"Azure OpenAI API key is required. Set AZURE_OPENAI_API_KEY environment variable or pass it as an argument.",
			);
		}
		apiKey = envKey;
	}

	const headers: Record<string, string> = { "api-key": apiKey, ...(model.headers ?? {}) };
	if (options?.headers) {
		Object.assign(headers, options.headers);
	}

	const { baseUrl, apiVersion } = resolveAzureConfig(model, options);

	return {
		url: `${baseUrl}/responses?api-version=${encodeURIComponent(apiVersion)}`,
		headers,
		baseUrl,

View on GitHub (pinned to 9690622007)

Solutions

1. Set the AZURE_OPENAI_API_KEY environment variable to a valid key from your Azure OpenAI resource (Keys and Endpoint blade).
2. Pass the key explicitly: options.apiKey = "<your-key>" at the call site.
3. If you authenticate via Microsoft Entra ID instead of keys, use a provider path/token provider that supplies the credential rather than relying on the env var.
4. Check CI/CD secret configuration so AZURE_OPENAI_API_KEY is exported into the process environment.

Example fix

// before
await streamAzureOpenAIResponses(model, context); // no key
// after
await streamAzureOpenAIResponses(model, context, {
  apiKey: process.env.AZURE_OPENAI_API_KEY,
});

const apiKey = options?.apiKey ?? process.env.AZURE_OPENAI_API_KEY;
if (!apiKey) throw new Error("AZURE_OPENAI_API_KEY must be set or an apiKey option provided before calling Azure OpenAI.");

null

try {
  await streamAzureOpenAIResponses(model, ctx, options);
} catch (err) {
  if (err instanceof AIError.MissingApiKeyError) {
    // prompt user / fail fast with credential setup instructions
  } else throw err;
}

When it happens

Trigger: Streaming from an azure-openai-responses model without passing options.apiKey and with AZURE_OPENAI_API_KEY unset in the environment; passing an empty-string apiKey which is falsy and still triggers the env fallback.

Common situations: New developer onboarding without the shared .env; CI secrets not injected; switching from OAuth/Entra ID setups where no static key exists; key defined under a different env name (e.g. AZURE_API_KEY).

Understand the failure class

Background: "API key is required" / "API key not found" / "No API key was set": the missing-api-key error family across 16 libraries — this error's family across 16 libraries.

Related errors

• No Gemini credentials found. Set GEMINI_API_KEY, configure a
• Azure OpenAI base URL is required. Set AZURE_OPENAI_BASE_URL
• Cursor API key (access token) is required
• CoreWeave Serverless Inference requires OpenAI-Project. Set
• DeepSeek API key is empty after stripping Bearer prefix

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/1a8d79330c727eb1. Report an issue: GitHub.