microsoft/semantic-kernel · critical · AgentInitializationException

Please provide either an api_key, ad_token, ad_token_provide

Error message

Please provide either an api_key, ad_token, ad_token_provider or credential for authentication.

What it means

Raised by AzureResponsesAgent's client builder after settings are created when no authentication credential is available. The builder first tries to mint an Entra token from a supplied credential+token_endpoint; if that yields nothing and api_key, ad_token, and ad_token_provider are all absent, it cannot authenticate and aborts.

Source

Thrown at python/semantic_kernel/agents/open_ai/azure_responses_agent.py:119

                env_file_path=env_file_path,
                env_file_encoding=env_file_encoding,
                token_endpoint=token_scope,
            )
        except ValidationError as exc:
            raise AgentInitializationException(f"Failed to create Azure OpenAI settings: {exc}") from exc

        if (
            azure_openai_settings.api_key is None
            and ad_token_provider is None
            and ad_token is None
            and azure_openai_settings.token_endpoint
            and credential
        ):
            ad_token = get_entra_auth_token(credential, azure_openai_settings.token_endpoint)

        # If we still have no credentials, we can't proceed
        if not azure_openai_settings.api_key and not ad_token and not ad_token_provider and not credential:
            raise AgentInitializationException(
                "Please provide either an api_key, ad_token, ad_token_provider or credential for authentication."
            )

        merged_headers = dict(copy(default_headers)) if default_headers else {}
        if default_headers:
            merged_headers.update(default_headers)
        if APP_INFO:
            merged_headers.update(APP_INFO)
            merged_headers = prepend_semantic_kernel_to_user_agent(merged_headers)

        if not azure_openai_settings.endpoint:
            raise AgentInitializationException("Please provide an Azure OpenAI endpoint")

        if not azure_openai_settings.responses_deployment_name:
            raise AgentInitializationException("Please provide an Azure OpenAI Responses deployment name")

        client = AsyncAzureOpenAI(
            azure_endpoint=str(azure_openai_settings.endpoint),

View on GitHub (pinned to c028a0c7dc)

Solutions

1. Set AZURE_OPENAI_API_KEY, or pass api_key= to the constructor.
2. Pass a credential (e.g. DefaultAzureCredential()) and ensure you are logged in (az login) and granted the resource access.
3. Provide ad_token or ad_token_provider for token-based auth.
4. If using DefaultAzureCredential, confirm the token_endpoint/scope is correct (default https://cognitiveservices.azure.com/.default).

Example fix

# before
AzureResponsesAgent(endpoint=..., deployment_name=...)  # no auth
# after
AzureResponsesAgent(endpoint=..., deployment_name=..., api_key=os.environ["AZURE_OPENAI_API_KEY"])
# or token-based
AzureResponsesAgent(endpoint=..., deployment_name=..., credential=DefaultAzureCredential())

from semantic_kernel.connectors.ai.open_ai.settings import AzureOpenAISettings

settings = AzureOpenAISettings()
has_auth = bool(
    settings.api_key or ad_token or ad_token_provider or credential
)
if not has_auth:
    raise SystemExit(
        "No Azure OpenAI auth: set AZURE_OPENAI_API_KEY or pass a credential/token."
    )

from semantic_kernel.exceptions.agent_exceptions import AgentInitializationException

try:
    agent = AzureResponsesAgent(endpoint=ep, deployment_name=name, credential=cred)
except AgentInitializationException as e:
    if "api_key, ad_token" in str(e):
        # fall back to explicit key from secret store
        agent = AzureResponsesAgent(endpoint=ep, deployment_name=name, api_key=get_secret("AOAI_KEY"))
    else:
        raise

When it happens

Trigger: Constructing AzureResponsesAgent without AZURE_OPENAI_API_KEY and without passing api_key, ad_token, ad_token_provider, or a credential object. Also when a credential is passed but token_endpoint retrieval returns None (credential not authorized for the scope).

Common situations: Running locally without logging into Azure CLI (az login) while relying on DefaultAzureCredential; forgetting AZURE_OPENAI_API_KEY in CI; using a managed identity that lacks the Cognitive Services OpenAI Contributor role on the resource.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Failed to create Azure OpenAI settings: {exc}
• Please provide an Azure OpenAI endpoint
• Please provide an Azure OpenAI Responses deployment name
• Expected AzureOpenAISettings, got {type(settings).__name__}
• Expected AzureOpenAISettings, got {type(settings).__name__}

AI-assisted analysis of microsoft/semantic-kernel@c028a0c7dc (2026-08-13). Data as JSON: /api/errors/fe67e7a0f6c08b31. Report an issue: GitHub.