microsoft/semantic-kernel · error · ServiceInitializationError

The 'credential' parameter is required for authentication.

Error message

The 'credential' parameter is required for authentication.

What it means

Raised during Azure AI Inference service construction when no api_key is available (settings.api_key is None) and the caller also did not pass a 'credential' object. The connector supports two auth paths: API key (from settings) or an Azure SDK TokenCredential (e.g. DefaultAzureCredential). If neither is supplied, authentication is impossible and initialization fails.

Source

Thrown at python/semantic_kernel/connectors/ai/azure_ai_inference/services/azure_ai_inference_base.py:104

                    endpoint=endpoint,
                    api_version=api_version,
                    env_file_path=env_file_path,
                    env_file_encoding=env_file_encoding,
                )
            except ValidationError as e:
                raise ServiceInitializationError(f"Failed to validate Azure AI Inference settings: {e}") from e

            endpoint = str(azure_ai_inference_settings.endpoint)
            if azure_ai_inference_settings.api_key is not None:
                client = AzureAIInferenceClientType.get_client_class(client_type)(
                    endpoint=endpoint,
                    credential=AzureKeyCredential(azure_ai_inference_settings.api_key.get_secret_value()),
                    user_agent=SEMANTIC_KERNEL_USER_AGENT,
                    api_version=azure_ai_inference_settings.api_version,
                )
            else:
                if credential is None:
                    raise ServiceInitializationError("The 'credential' parameter is required for authentication.")

                client = AzureAIInferenceClientType.get_client_class(client_type)(
                    endpoint=endpoint,
                    credential=credential,
                    user_agent=SEMANTIC_KERNEL_USER_AGENT,
                    api_version=azure_ai_inference_settings.api_version,
                )

        args: dict[str, Any] = {
            "client": client,
            "managed_client": managed_client,
            **kwargs,
        }

        if instruction_role:
            args["instruction_role"] = instruction_role

        super().__init__(**args)

View on GitHub (pinned to c028a0c7dc)

Solutions

1. Pass an Azure credential, e.g. credential=DefaultAzureCredential() (or ManagedIdentityCredential, AzureCliCredential, etc.).
2. Or provide AZURE_AI_INFERENCE_API_KEY (or api_key= arg) to use key auth.
3. Ensure the chosen credential's identity has been granted access to the Azure AI / model deployment.

Example fix

# before
service = AzureAIInferenceChatCompletion(model_id="gpt-4o")  # no key, no credential

# after
from azure.identity import DefaultAzureCredential
service = AzureAIInferenceChatCompletion(model_id="gpt-4o", credential=DefaultAzureCredential())

import os
from azure.identity import DefaultAzureCredential

api_key = os.getenv("AZURE_AI_INFERENCE_API_KEY")
credential = DefaultAzureCredential() if not api_key else None
service = AzureAIInferenceChatCompletion(
    model_id=model_id,
    api_key=api_key,
    credential=credential,
)

def has_auth(api_key, credential) -> bool:
    return api_key is not None or credential is not None

from semantic_kernel.exceptions import ServiceInitializationError
try:
    service = AzureAIInferenceChatCompletion(model_id=model_id)
except ServiceInitializationError as e:
    if "credential" in str(e):
        from azure.identity import DefaultAzureCredential
        service = AzureAIInferenceChatCompletion(model_id=model_id, credential=DefaultAzureCredential())

When it happens

Trigger: Intending to use managed identity / AAD auth (no api_key in env) but forgetting to pass credential=... to the service constructor. Or clearing AZURE_AI_INFERENCE_API_KEY while relying on a credential that was never provided.

Common situations: Switching from key-based to AAD auth in production and omitting credential; local dev where DefaultAzureCredential was assumed to be default but must be passed explicitly; misconfigured deployment that strips the key but adds no identity.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Failed to validate Azure AI Inference settings: {e}
• The DeepSeek API key is required.
• Invalid credentials
• If response_format has type 'json_schema', 'json_schema' mus
• response_format must be a dictionary, a subclass of BaseMode

AI-assisted analysis of microsoft/semantic-kernel@c028a0c7dc (2026-08-13). Data as JSON: /api/errors/0210384830f370c8. Report an issue: GitHub.