microsoft/semantic-kernel · error · AgentInitializationException

Please provide either an api_key, ad_token, ad_token_provide

Error message

Please provide either an api_key, ad_token, ad_token_provider or credential for authentication.

What it means

After settings load, the factory needs at least one authentication source. If api_key is absent AND no ad_token, ad_token_provider, or credential is available (and the entra-token path could not produce one), AgentInitializationException is raised listing the accepted auth options.

Source

Thrown at python/semantic_kernel/agents/open_ai/azure_assistant_agent.py:112

                env_file_path=env_file_path,
                env_file_encoding=env_file_encoding,
                token_endpoint=token_scope,
            )
        except ValidationError as exc:
            raise AgentInitializationException(f"Failed to create Azure OpenAI settings: {exc}") from exc

        if (
            azure_openai_settings.api_key is None
            and ad_token_provider is None
            and ad_token is None
            and azure_openai_settings.token_endpoint
            and credential
        ):
            ad_token = get_entra_auth_token(credential, azure_openai_settings.token_endpoint)

        # If we still have no credentials, we can't proceed
        if not azure_openai_settings.api_key and not ad_token and not ad_token_provider and not credential:
            raise AgentInitializationException(
                "Please provide either an api_key, ad_token, ad_token_provider or credential for authentication."
            )

        merged_headers = dict(copy(default_headers)) if default_headers else {}
        if default_headers:
            merged_headers.update(default_headers)
        if APP_INFO:
            merged_headers.update(APP_INFO)
            merged_headers = prepend_semantic_kernel_to_user_agent(merged_headers)

        if not azure_openai_settings.endpoint:
            raise AgentInitializationException("Please provide an Azure OpenAI endpoint")

        if not azure_openai_settings.chat_deployment_name:
            raise AgentInitializationException("Please provide an Azure OpenAI deployment name")

        client = AsyncAzureOpenAI(
            azure_endpoint=str(azure_openai_settings.endpoint),

View on GitHub (pinned to c028a0c7dc)

Solutions

1. Set AZURE_OPENAI_API_KEY (env or .env) or pass api_key= explicitly.
2. For token auth, pass credential=DefaultAzureCredential() (and ensure token_endpoint is configured) or an ad_token_provider.
3. Verify the .env file is loaded (correct env_file_path/encoding) and actually contains the key.
4. Confirm the chosen auth option is reachable from the execution environment (CI secrets, managed identity, etc.).

Example fix

// before
AzureOpenAIAssistantAgent(..., deployment_name=dep)  # no key, no credential
# -> Please provide either an api_key, ad_token, ...

// after
from azure.identity import DefaultAzureCredential
AzureOpenAIAssistantAgent(..., deployment_name=dep, credential=DefaultAzureCredential())

def has_auth(settings, ad_token, ad_token_provider, credential) -> bool:
    return bool(settings.api_key or ad_token or ad_token_provider or credential)

def has_azure_auth(settings, ad_token, ad_token_provider, credential) -> bool:
    return any([settings.api_key, ad_token, ad_token_provider, credential])

When it happens

Trigger: Instantiating the Azure assistant with none of: AZURE_OPENAI_API_KEY env/arg, an ad_token, an ad_token_provider callable, or a credential object — and no token_endpoint+credential combo to derive an Entra token.

Common situations: Forgetting to set AZURE_OPENAI_API_KEY in the environment; intending to use managed identity but not passing credential=DefaultAzureCredential(); env file missing the key; running in CI without secrets injected.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Failed to create Azure OpenAI settings: {exc}
• Please provide an Azure OpenAI endpoint
• Please provide an Azure OpenAI deployment name
• The client does not support sampling.
• Configuration section '{section}' not found

AI-assisted analysis of microsoft/semantic-kernel@c028a0c7dc (2026-08-13). Data as JSON: /api/errors/09d7fe28c0901cb0. Report an issue: GitHub.