How to fix : Unauthorized to access Form Recognizer resource, Access denied due to invalid subscription key or wrong API endpoint. Make sure to provide a valid key for an active subscription and use a correct regional API endpoint for your resource.

Tamilarasu Saravanakangeyan 0

on-Prem hosted Azure Document intelligence studio Run Analysis request failing with 401 Unauthorized access.

Unauthorized to access Form Recognizer resource

Access denied due to invalid subscription key or wrong API endpoint. Make sure to provide a valid key for an active subscription and use a correct regional API endpoint for your resource.Click Switch Resource to use another Form Recognizer resource.

Identification: Ocp-Apim-Subscription-Key, Edit: XHR request and append ApiKey -> getting 204. So Ocp-Apim-Subscription-Key configuration is missing. No documentation available in terms of configuring Ocp-Apim-Subscription-Key in .env or nginx proxy

User's image

need inputs to resolve the same.

santoshkc 9,240 Reputation points Microsoft Vendor

2024-06-06T09:35:20.5833333+00:00

Hi @Tamilarasu Saravanakangeyan,

I wanted to follow up on the issue you reported regarding unauthorized access to the Form Recognizer resource in Azure. I have investigated the issue and found that it was an intermittent issue that has now been resolved.

I would like to confirm that you should now be able to access the Form Recognizer resource without any issues. Please see below working image and let me know, how it is working.

If you encounter any further issues, please do not hesitate to reach out to us.

Thank you for bringing this to our attention, and we apologize for any inconvenience caused.
Tamilarasu Saravanakangeyan 0 Reputation points

2024-06-06T10:12:29.27+00:00

Hi @santoshkc ,

Thank you for sharing working screenshot. Good know working reference, Can you please little deep dive into the issue that i am facing.

I have made the container up and running to utilize Custom Template On-Prime hosting model. Reference: https://learn.microsoft.com/en-us/azure/ai-services/document-intelligence/containers/install-run?view=doc-intel-3.1.0&preserve-view=true&tabs=custom

while accessing : Applied AI | Form Recognizer Studio (http://localhost:5001/studio/layout) Getting : Unauthorized to access Form Recognizer resource

when i inspected the browser https request header, i can observe that Ocp-Apim-Subscription-Key header is empty.

To confirm that Ocp-Apim-Subscription-Key is causing this issue, i have edited the http requested and appended apikey manually, getting 204 success.
santoshkc 9,240 Reputation points Microsoft Vendor

2024-06-06T10:56:06.4333333+00:00

Hi @Tamilarasu Saravanakangeyan,

Thank you for your follow-up query. The Ocp-Apim-Subscription-Key header is a required header that contains the subscription key for the Form Recognizer resource. If this header is missing or empty, you will not be able to access the resource.

To resolve this issue, you need to ensure that the Ocp-Apim-Subscription-Key header is included in the HTTP request when accessing the Form Recognizer resource. You can obtain the subscription key for your resource from the Azure portal and include it in the header.

If you are still facing issues after including the Ocp-Apim-Subscription-Key header, please let me know and I will be happy to assist you further.
Tamilarasu Saravanakangeyan 0 Reputation points

2024-06-06T15:51:00.74+00:00

Hi @santoshkc ,

Thank you for understanding in detail and response. I agree with Ocp-Apim-Subscription-Key header mandate to secure the traffic.

HTTP request functionality is inbuilt with mcr.microsoft.com/azure-cognitive-services/form-recognizer/studio:3.0 image. I have no option to intercept and append APIkey.

I attempted to use nginx feature(add_header Ocp-Apim-Subscription-Key '<APIKey>') to update Ocp-Apim-Subscription-Key header vaule, but nginx failing to update header.

As far as this header is must to have, it should be available using .evn with image inbuilt to append APIKey in header. I am suspecting, that i am missing something in .env file (which is not available in Microsoft document as well) or in docker-compose.yaml -> studio : container : container_name: form-recognizer-studio: ....

It would be great, if you could give one more deep dive and advise.

Thank you for continuous response
Eric Shen 5 Reputation points

2024-06-06T16:16:27.4166667+00:00

I run into the same issue. I tried both free tier and paid resources, got the same error. Appreciate if you can provide more details steps for trouble shooting
Sheng Han 5 Reputation points

2024-06-06T18:20:11.3866667+00:00

I have been having the same problem. I created the new document intelligence resource and storage resource as required. Everything is active. Opened DI Studio and selected custom extraction model, entered the key and endpoint and left the API version at the default and I received the same error your getting. I deleted the project and created a new one and selected to general release API shown in the attached screenshot. No other changes and it's working now.
Eric Shen 5 Reputation points

2024-06-06T18:41:52.0233333+00:00

Thanks, Followed your suggestion, it works for me now.

2 answers

Tamilarasu Saravanakangeyan 0 Reputation points

2024-06-07T05:27:52.8533333+00:00

Sheng & Eric, thanks for inputs. I found the exact route cause, technically the request should not be routed(Configure service resource-> Form Recognizer Service endpoint) to cloud endpoint, rather it should be point to custom-template-3 image port(highlighted in yellow)
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
santoshkc 9,240 Reputation points Microsoft Vendor

2024-06-07T11:10:10.55+00:00

Hi @Tamilarasu Saravanakangeyan,

I'm glad to hear that your issue has been resolved. And thanks for sharing the solution, which might be beneficial to other community members reading this thread as solution. Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others ", I'll repost your solution in case you'd like to accept the answer.

Question title: How to fix : Unauthorized to access Form Recognizer resource, Access denied due to invalid subscription key or wrong API endpoint. Make sure to provide a valid key for an active subscription and use a correct regional API endpoint for your resource.

Solution: Technically the request should not be routed (Configure service resource-> Form Recognizer Service endpoint) to cloud endpoint, rather it should be point to custom-template-3 image port (highlighted in yellow)

If you encounter any issues in the future, don't hesitate to reach out to the community forum for assistance. Thank you.

Do not forget to click Accept Answer and Yes.
Please sign in to rate this answer.
santoshkc 9,240 Reputation points Microsoft Vendor

2024-06-10T05:01:44.1533333+00:00

Hi @Tamilarasu Saravanakangeyan,

Did you got any chance to check the above response?
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

How to fix : Unauthorized to access Form Recognizer resource, Access denied due to invalid subscription key or wrong API endpoint. Make sure to provide a valid key for an active subscription and use a correct regional API endpoint for your resource.

2 answers

Your answer