openai/openai-python · critical · OpenAIError

Missing credentials. Please pass one of `api_key`, `azure_ad

Error message

Missing credentials. Please pass one of `api_key`, `azure_ad_token`, `azure_ad_token_provider`, or the `AZURE_OPENAI_API_KEY` or `AZURE_OPENAI_AD_TOKEN` environment variables.

What it means

AzureOpenAI requires exactly one credential source: api_key, azure_ad_token, azure_ad_token_provider, or env vars AZURE_OPENAI_API_KEY / AZURE_OPENAI_AD_TOKEN. If none is found (and credential enforcement is on) construction fails with OpenAIError.

Source

Thrown at src/openai/lib/azure.py:302

        Args:
            azure_endpoint: Your Azure endpoint, including the resource, e.g. `https://example-resource.azure.openai.com/`

            azure_ad_token: Your Azure Active Directory token, https://www.microsoft.com/en-us/security/business/identity-access/microsoft-entra-id

            azure_ad_token_provider: A function that returns an Azure Active Directory token, will be invoked on every request.

            azure_deployment: A model deployment, if given with `azure_endpoint`, sets the base client URL to include `/deployments/{azure_deployment}`.
                Not supported with Assistants APIs.
        """
        if is_x509_workload_identity(workload_identity):
            raise OpenAIError("X.509 workload identity is not supported by Azure clients")

        api_key, azure_ad_token, azure_ad_token_provider = _resolve_azure_auth(
            api_key, azure_ad_token, azure_ad_token_provider
        )

        if _enforce_credentials and api_key is None and azure_ad_token is None and azure_ad_token_provider is None:
            raise OpenAIError(
                "Missing credentials. Please pass one of `api_key`, `azure_ad_token`, `azure_ad_token_provider`, or the `AZURE_OPENAI_API_KEY` or `AZURE_OPENAI_AD_TOKEN` environment variables."
            )

        if api_version is None:
            api_version = os.environ.get("OPENAI_API_VERSION")

        if api_version is None:
            raise ValueError(
                "Must provide either the `api_version` argument or the `OPENAI_API_VERSION` environment variable"
            )

        if default_query is None:
            default_query = {"api-version": api_version}
        else:
            default_query = {**default_query, "api-version": api_version}

        if base_url is None:
            if azure_endpoint is None:

View on GitHub (pinned to 9917c6e28e)

Solutions

1. Set AZURE_OPENAI_API_KEY (or pass api_key=...) in the environment where the process actually runs
2. Or configure azure_ad_token_provider with azure-identity for AAD/managed identity
3. Verify with a quick check: python -c "import os; print(os.environ.get('AZURE_OPENAI_API_KEY'))"
4. Load .env before constructing the client if using python-dotenv

Example fix

# before
client = AzureOpenAI()  # env var missing
# after
client = AzureOpenAI(api_key=os.environ["AZURE_OPENAI_API_KEY"])
# or: export AZURE_OPENAI_API_KEY=... in the runtime environment

has_creds = bool(os.environ.get("AZURE_OPENAI_API_KEY") or os.environ.get("AZURE_OPENAI_AD_TOKEN"))
class MissingCreds(Exception): ...
if enforce and not has_creds:
    raise MissingCreds("set AZURE_OPENAI_API_KEY before starting")

try:
    client = AzureOpenAI(...)
except OpenAIError as e:
    if "Missing credentials" in str(e):
        raise SystemExit("Set AZURE_OPENAI_API_KEY") from e
    raise

When it happens

Trigger: new AzureOpenAI() with no args and no AZURE_OPENAI_API_KEY/AZURE_OPENAI_AD_TOKEN in the environment (env var not exported to the process, or OPENAI_API_KEY set instead).

Common situations: Env var set in shell but not in the service/cron/container; using OPENAI_API_KEY for an Azure client; dotenv not loaded before client creation; CI secrets not exposed.

Related errors

• "Could not resolve authentication method. Expected either ap
• X.509 workload identity is not supported by Azure clients
• Must provide either the `api_version` argument or the `OPENA
• Expected `azure_ad_token_provider` argument to return a non-
• Could not find credentials for Bedrock. Set `AWS_BEARER_TOKE

AI-assisted analysis of openai/openai-python@9917c6e28e (2026-08-28). Data as JSON: /api/errors/15716d82090db2f2. Report an issue: GitHub.