What causes "Failed to sync gallery from ${url}" in microsoft/autogen?

Wrap the key: credential={"api_key": KEY} or AzureKeyCredential(KEY).

microsoft/autogen · error · Error

Failed to sync gallery from ${url}

Error message

Failed to sync gallery from ${url}

What it means

TypeError raised by _format_credential when the credential is neither a dict, AzureKeyCredential, nor an AsyncTokenCredential — e.g. a plain string. The Search SDK requires a credential object; this tool deliberately refuses to guess whether a bare string is a key (use the dict form or AzureKeyCredential).

Source

Thrown at python/packages/autogen-studio/frontend/src/components/views/gallery/api.ts:93

  }

  async deleteGallery(galleryId: number, userId: string): Promise<void> {
    const response = await fetch(
      `${this.getBaseUrl()}/gallery/${galleryId}?user_id=${userId}`,
      {
        method: "DELETE",
        headers: this.getHeaders(),
      }
    );
    const data = await response.json();
    if (!data.status)
      throw new Error(data.message || "Failed to delete gallery");
  }

  async syncGallery(url: string): Promise<Gallery> {
    const response = await fetch(url);
    if (!response.ok) {
      throw new Error(`Failed to sync gallery from ${url}`);
    }
    return await response.json();
  }
}

export const galleryAPI = new GalleryAPI();

View on GitHub (pinned to 027ecf0a37)

Solutions

Wrap the key: credential={"api_key": KEY} or AzureKeyCredential(KEY).
For AAD auth, pass an async-capable credential such as DefaultAzureCredential() (it implements get_token asynchronously and satisfies the protocol).
Never pass the raw string; the tool intentionally rejects it.

Example fix

# before
config = AzureAISearchConfig(endpoint=E, index_name=I, credential=KEY_STRING)

# after
from azure.core.credentials import AzureKeyCredential
config = AzureAISearchConfig(endpoint=E, index_name=I, credential=AzureKeyCredential(KEY_STRING))
# or credential={"api_key": KEY_STRING}

Defensive patterns

Strategy: type-guard

Validate before calling

def normalize_credential(cred):
    if isinstance(cred, str):
        return {"api_key": cred}  # or AzureKeyCredential(cred)
    return cred

Type guard

def is_supported_credential(cred) -> bool:
    if isinstance(cred, dict):
        return "api_key" in cred
    try:
        from azure.core.credentials import AzureKeyCredential
        from azure.core.credentials_async import AsyncTokenCredential
        return isinstance(cred, (AzureKeyCredential, AsyncTokenCredential))
    except ImportError:
        return False

Try / catch

try:
    tool = AzureAISearchTool(name="search", config=config)
except TypeError as e:
    if "Credential must be" in str(e):
        raise TypeError("Wrap the key: {'api_key': ...} or AzureKeyCredential(...)") from e
    raise

Prevention

Never pass a raw string credential; wrap at the boundary where you read secrets.
Use DefaultAzureCredential() for AAD flows — it satisfies the async protocol.

When it happens

Trigger: Passing credential="my-api-key-string" or credential=some_unrelated_object to the tool/config; also passing a sync-only TokenCredential (not AsyncTokenCredential) can land here.

Common situations: Reusing code from other SDKs where a raw string key is accepted; wrapping keys in custom credential classes; using azure.core.credentials.TokenCredential (sync) where AsyncTokenCredential is expected.

Related errors

AI-assisted analysis of microsoft/autogen@027ecf0a37 (2026-08-15). Data as JSON: /api/errors/eeef90586619a7b4. Report an issue: GitHub.