mem0ai/mem0 · critical · Error

Azure credential authentication failed: ${err}

Error message

Azure credential authentication failed: ${err}

What it means

When the Azure MySQL store is configured with useAzureCredential, initialization dynamically imports @azure/identity, creates a DefaultAzureCredential, and requests a token for the Azure Database for MySQL AAD scope (https://ossrdbms-aad.database.windows.net/.default) to use as the password. Any failure in that chain (package missing, credential unavailable, AAD/DNS/timeout errors) is wrapped in this error with the underlying cause.

Source

Thrown at mem0-ts/src/oss/src/vector_stores/azure_mysql.ts:85

    if (!this._initPromise) {
      this._initPromise = this._doInitialize();
    }
    return this._initPromise;
  }

  private async _doInitialize(): Promise<void> {
    let password = this.config.password;

    if (this.config.useAzureCredential) {
      try {
        const { DefaultAzureCredential } = await import("@azure/identity");
        const credential = new DefaultAzureCredential();
        const token = await credential.getToken(
          "https://ossrdbms-aad.database.windows.net/.default",
        );
        password = token.token;
      } catch (err) {
        throw new Error(`Azure credential authentication failed: ${err}`);
      }
    }

    const ssl: Record<string, any> | undefined = this.config.sslDisabled
      ? undefined
      : {
          rejectUnauthorized: true,
          ...(this.config.sslCa ? { ca: this.config.sslCa } : {}),
        };

    // Loaded dynamically: mysql2 is an optional peer dependency, so a static value import
    // would break `import { Memory } from "mem0ai/oss"` for everyone else.
    const { createPool }: typeof import("mysql2/promise") = await loadPeer(
      "mysql2",
      "Azure MySQL vector store",
      () => import("mysql2/promise"),
    );

View on GitHub (pinned to 001c235229)

Solutions

1. npm install @azure/identity (it is an optional peer).
2. Run az login locally, or set AZURE_TENANT_ID / AZURE_CLIENT_ID / AZURE_CLIENT_SECRET for the service principal, and ensure that identity has an AAD admin / user on the MySQL flexible server.
3. If you do not need AAD auth, drop useAzureCredential and supply config.password directly.

Example fix

# before
useAzureCredential: true  # local dev, no az login
# after
az login  # or set AZURE_* env vars, or:
useAzureCredential: false, password: process.env.MYSQL_PWD

async function azureCredentialOk(): Promise<boolean> {
  try {
    const { DefaultAzureCredential } = await import('@azure/identity');
    const t = await new DefaultAzureCredential().getToken('https://ossrdbms-aad.database.windows.net/.default');
    return !!t.token;
  } catch { return false; }
}

try { new Memory(cfg) }
catch (e) {
  if (e instanceof Error && /Azure credential authentication failed/.test(e.message)) {
    // surface 'check az login / AZURE_* env / managed identity assignment' and fail deployment
  }
  throw e;
}

When it happens

Trigger: useAzureCredential: true without @azure/identity installed; no managed identity / AZURE_TENANT_ID+CLIENT_ID+CLIENT_SECRET in the environment; token request failing because the identity lacks reader/data access on the MySQL server; running locally with no az login.

Common situations: Deploying to Azure App Service where the identity was never assigned; local dev without az login or env service-principal vars; expired service principal secrets; National cloud or wrong scope.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Either 'password' must be provided or 'use_azure_credential'
• Invalid ${label} '${name}': only letters, digits, and unders
• Missing required fields: {', '.join(missing_fields)}. These
• Extra fields not allowed: {', '.join(extra_fields)}. Please
• Azure MySQL vector store requires PyMySQL and DBUtils. Pleas

AI-assisted analysis of mem0ai/mem0@001c235229 (2026-08-15). Data as JSON: /api/errors/5c2a7aa2fdd46ead. Report an issue: GitHub.