What causes Error code: 401 - {'statusCode': 401, 'message': 'Unauthorized. Access token is missing, invalid, audience is incorrect (https://cognitiveservices.azure.com), or have expired.'}?

Question

What causes Error code: 401 - {'statusCode': 401, 'message': 'Unauthorized. Access token is missing, invalid, audience is incorrect (https://cognitiveservices.azure.com), or have expired.'}?

Geena Kim 0

Can someone give an example? I matched the api version the same as the model deployment endpoint's target uri- for example, (Note that the real address is masked with [azureopenai-resourcename] since everyone's case will be different) https://[azureopenai-resourcename].openai.azure.com/openai/deployments/gpt-4o/chat/completions?api-version=2024-08-01-preview

Then I set the required environment variables like

export AZURE_OPENAI_API_KEY="<replaced with my key>"

export AZURE_OPENAI_ENDPOINT="https://[azureopenai-resourcename].openai.azure.com/"

export OPENAI_API_TYPE="azure"

export OPENAI_API_VERSION="2024-08-01-preview" ## This is to match the api version that shows up in the target uri. But it still gives the error messages like:

INFO:httpx:HTTP Request: POST https://[azureopenai-resourcename].openai.azure.com//openai/deployments/gpt-4o/chat/completions?api-version=2024-08-01-preview "HTTP/1.1 401 Unauthorized"

Error code: 401 - {'statusCode': 401, 'message': 'Unauthorized. Access token is missing, invalid, audience is incorrect (https://cognitiveservices.azure.com), or have expired.'}

When I use LangChain to load embedding model, it works ok, but while using reranker using gpt model(s) it makes a problem. I tested with export OPENAI_API_TYPE="openai" and used my personal account (in this case it didn't need any other auth other than OPENAI_API_KEY. So it seems the langchain's rerank works and somehow it breaks when azure credentials are passed. So other than those envs (AZURE_OPENAI_API_KEY, AZURE_OPENAI_ENDPOINT, OPENAI_API_TYPE, OPENAI_API_VERSION), what "Access token" is required?? And what is https://cognitiveservices.azure.com?? Do we need to set up another endpoint other than the model deployment (as above uri shows)?

romungi-MSFT 48,911 Reputation points Microsoft Employee Moderator

2024-11-18T09:36:56.66+00:00

@Geena Kim I think in this case you need the bearer token. I think some part of your code that generates the bearer token is not called or not used when you actually send the client request to the openai endpoint, instead it might be passing your openai API key and it causes the error token is invalid or missing. Could you please add complete code or documentation which you are following to check and suggest what needs to be added to make a successful call? Thanks!!

You can also review the MI method to call the client with a bearer token, see this documentation which details adding the required role and then querying using the client.

Daniel Fang 1,060 MVP

HI @Geena Kim Please try out below python snippet. you should be able to run directly after setting your instance name and apikey.

pip install langchain-openai

import os

os.environ["AZURE_OPENAI_API_KEY"] = "xxxxx"
os.environ["AZURE_OPENAI_ENDPOINT"] = "https://xxxx.openai.azure.com/"

from langchain_openai import AzureChatOpenAI

llm = AzureChatOpenAI(
    azure_deployment="gpt-4o",  # or your deployment
    api_version="2024-08-01-preview",  # or your api version
    temperature=0,
    max_tokens=None,
    timeout=None,
    max_retries=2,
    # other params...
)

messages = [
    (
        "system",
        "You are a helpful assistant that translates English to French. Translate the user sentence.",
    ),
    ("human", "I love programming."),
]
ai_msg = llm.invoke(messages)
ai_msg

print(ai_msg.content)

https://cognitiveservices.azure.com you saw in the error message is the scope of the oauth token (you dont need to worry about it, it is used when oauth is used). The error message seems like that your code is trying to use Azure EntraID rather than apikey to call the OpenAI Service.

please test out above code and see. if still no luck, worth posting your python code and package versions.

romungi-MSFT 48,911 Reputation points Microsoft Employee Moderator

2024-11-20T07:19:13.35+00:00

@Geena Kim Did you get a chance to check the above comments and confirm if you are creating a bearer token in the request?

Your answer

romungi-MSFT 48,911 Reputation points Microsoft Employee Moderator

2024-11-18T09:36:56.66+00:00

@Geena Kim I think in this case you need the bearer token. I think some part of your code that generates the bearer token is not called or not used when you actually send the client request to the openai endpoint, instead it might be passing your openai API key and it causes the error token is invalid or missing. Could you please add complete code or documentation which you are following to check and suggest what needs to be added to make a successful call? Thanks!!

You can also review the MI method to call the client with a bearer token, see this documentation which details adding the required role and then querying using the client.
Daniel Fang 1,060 Reputation points MVP

2024-11-18T10:03:35.08+00:00

HI @Geena Kim Please try out below python snippet. you should be able to run directly after setting your instance name and apikey.

pip install langchain-openai

import os os.environ["AZURE_OPENAI_API_KEY"] = "xxxxx" os.environ["AZURE_OPENAI_ENDPOINT"] = "https://xxxx.openai.azure.com/" from langchain_openai import AzureChatOpenAI llm = AzureChatOpenAI( azure_deployment="gpt-4o", # or your deployment api_version="2024-08-01-preview", # or your api version temperature=0, max_tokens=None, timeout=None, max_retries=2, # other params... ) messages = [ ( "system", "You are a helpful assistant that translates English to French. Translate the user sentence.", ), ("human", "I love programming."), ] ai_msg = llm.invoke(messages) ai_msg print(ai_msg.content)

https://cognitiveservices.azure.com you saw in the error message is the scope of the oauth token (you dont need to worry about it, it is used when oauth is used). The error message seems like that your code is trying to use Azure EntraID rather than apikey to call the OpenAI Service.

please test out above code and see. if still no luck, worth posting your python code and package versions.
romungi-MSFT 48,911 Reputation points Microsoft Employee Moderator

2024-11-20T07:19:13.35+00:00

@Geena Kim Did you get a chance to check the above comments and confirm if you are creating a bearer token in the request?

Share via

What causes Error code: 401 - {'statusCode': 401, 'message': 'Unauthorized. Access token is missing, invalid, audience is incorrect (https://cognitiveservices.azure.com), or have expired.'}?

Your answer