mastra-ai/mastra · error · MastraError

AZURE_ENTRA_ID_AUTH_NOT_CONFIGURED

AZURE_ENTRA_ID_AUTH_NOT_CONFIGURED

Error message

Entra ID authentication is not configured for Azure OpenAI gateway

What it means

getEntraIdToken was called but the gateway is not configured with Entra ID (Azure AD) authentication. This internal guard ensures token acquisition only runs when authentication.type is 'entraId' and a credential is present. It is a configuration-state error, not a network error.

Source

Thrown at packages/core/src/llm/model/gateways/azure.ts:466

      url = data.nextLink;
    }

    const successfulDeployments = allDeployments.filter(d => d.properties.provisioningState === 'Succeeded');

    return successfulDeployments;
  }

  buildUrl(_routerId: string, _envVars?: typeof process.env): undefined {
    return undefined;
  }

  async getApiKey(_modelId: string): Promise<string> {
    return this.config.authentication?.type === 'entraId' ? '' : (this.config.apiKey ?? '');
  }

  private async getEntraIdToken(): Promise<string> {
    if (this.config.authentication?.type !== 'entraId') {
      throw new MastraError({
        id: 'AZURE_ENTRA_ID_AUTH_NOT_CONFIGURED',
        domain: 'LLM',
        category: 'UNKNOWN',
        text: 'Entra ID authentication is not configured for Azure OpenAI gateway',
      });
    }

    const scope = this.config.authentication.scope ?? 'https://cognitiveservices.azure.com/.default';
    const cacheKey = `azure-openai-token:${scope}`;
    const cached = (await this.tokenCache.get(cacheKey)) as CachedToken | undefined;
    if (cached && cached.expiresAt > Date.now() / 1000 + 60) {
      return cached.token;
    }

    let tokenRequest = this.entraIdTokenRequests.get(cacheKey);

    if (!tokenRequest) {
      tokenRequest = this.fetchEntraIdToken(scope, cacheKey);

View on GitHub (pinned to 75dd419e61)

Solutions

1. Configure the gateway with authentication: { type: 'entraId', credential: <TokenCredential> } (e.g. DefaultAzureCredential from @azure/identity).
2. If you intend API-key auth, use getApiKey() instead of the Entra ID token path.
3. Fix typos in the authentication type value so it equals 'entraId'.

Example fix

// before
const gw = new MastraAzureGateway({ resource: 'my-resource', apiKey: '...' });
await gw.token('https://cognitiveservices.azure.com/.default');
// after
import { DefaultAzureCredential } from '@azure/identity';
const gw = new MastraAzureGateway({ resource: 'my-resource', authentication: { type: 'entraId', credential: new DefaultAzureCredential() } });
await gw.token('https://cognitiveservices.azure.com/.default');

function canUseEntraId(cfg) { return cfg?.authentication?.type === 'entraId' && typeof cfg.authentication.credential?.getToken === 'function'; }
if (!canUseEntraId(gatewayConfig)) throw new Error('Configure authentication.type=entraId with a TokenCredential before requesting tokens');

function hasEntraIdAuth(cfg) {
  return !!cfg && cfg.authentication?.type === 'entraId' &&
    typeof cfg.authentication.credential === 'object' &&
    typeof cfg.authentication.credential.getToken === 'function';
}

When it happens

Trigger: Calling getEntraIdToken() (exposed via token()) when config.authentication is missing, undefined, or its type is not exactly 'entraId'.

Common situations: Constructing the Azure gateway with an apiKey (default auth) but calling Entra-ID-specific code paths; typo in authentication type; forgetting to pass the authentication object entirely.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• AZURE_MANAGEMENT_CREDENTIALS_MISSING
• AZURE_AD_TOKEN_ERROR
• AZURE_ENTRA_ID_TOKEN_ERROR
• Google Workspace Directory authentication is not configured.
• Telegram getMe returned a non-bot user; expected a BotFather

AI-assisted analysis of mastra-ai/mastra@75dd419e61 (2026-08-30). Data as JSON: /api/errors/b8c0e7e44a360f24. Report an issue: GitHub.