microsoft/semantic-kernel · error · ServiceInitializationError

Please provide a credential to retrieve the authentication t

Error message

Please provide a credential to retrieve the authentication token.

What it means

Raised by AzureOpenAISettings.get_azure_openai_auth_token when credential is None. The method requires an azure.core.credentials TokenCredential to call get_entra_auth_token; if none is passed it throws ServiceInitializationError before attempting the token request.

Source

Thrown at python/semantic_kernel/connectors/ai/open_ai/settings/azure_open_ai_settings.py:134

        The token endpoint may be specified as an environment variable, via the .env
        file or as an argument. If the token endpoint is not provided, the default is None.
        The `token_endpoint` argument takes precedence over the `token_endpoint` attribute.

        Args:
            credential: The credential to use for authentication.
            token_endpoint: The token endpoint to use. Defaults to `https://cognitiveservices.azure.com/.default`.

        Returns:
            The Azure token or None if the token could not be retrieved.

        Raises:
            ServiceInitializationError: If the token endpoint is not provided.
        """
        endpoint_to_use = token_endpoint or self.token_endpoint
        if endpoint_to_use is None:
            raise ServiceInitializationError("Please provide a token endpoint to retrieve the authentication token.")
        if credential is None:
            raise ServiceInitializationError("Please provide a credential to retrieve the authentication token.")
        return get_entra_auth_token(credential, endpoint_to_use)

View on GitHub (pinned to c028a0c7dc)

Solutions

1. Pass a TokenCredential, e.g. from azure.identity: from azure.identity import DefaultAzureCredential; settings.get_azure_openai_auth_token(credential=DefaultAzureCredential())
2. Ensure your runtime has a valid identity (managed identity, az login, or environment vars for AzureIdentity)
3. Construct and validate the credential object once at startup and reuse it

Example fix

# before
settings.get_azure_openai_auth_token(token_endpoint="https://cognitiveservices.azure.com/.default")

# after
from azure.identity import DefaultAzureCredential
settings.get_azure_openai_auth_token(credential=DefaultAzureCredential())

if credential is None:
    raise ValueError("A TokenCredential is required for Azure Entra auth")
token = settings.get_azure_openai_auth_token(credential=credential)

from azure.core.credentials import TokenCredential


def is_token_credential(c: object | None) -> bool:
    return isinstance(c, TokenCredential)

from semantic_kernel.exceptions.service_exceptions import ServiceInitializationError

try:
    token = settings.get_azure_openai_auth_token(credential=cred)
except ServiceInitializationError as e:
    if "credential" in str(e):
        raise SystemExit("Pass an azure.core.credentials TokenCredential") from e
    raise

When it happens

Trigger: Calling settings.get_azure_openai_auth_token() with no credential argument and no default credential available (the parameter has no fallback — it must be supplied by the caller).

Common situations: The caller forgot to pass a credential; DefaultAzureCredential construction failed silently upstream and passed None; running in an environment without a managed identity and the credential object was never built.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Please provide a token endpoint to retrieve the authenticati
• Missing required configuration. APP_ID, APP_PASSWORD, and AP
• Please provide either an api_key, ad_token, ad_token_provide
• Collection name is required to create a search client.
• Failed to create Azure Cognitive Search client for collectio

AI-assisted analysis of microsoft/semantic-kernel@c028a0c7dc (2026-08-13). Data as JSON: /api/errors/e424f7e3d4101b10. Report an issue: GitHub.