AzureKeyCredential rejected by ChatCompletionsClient

Never expose the full inference key; leave the endpoint’s domain and path visible, redact the resource-name portion consistently, and omit the tenant ID because it is not used with AzureKeyCredential.

Safe information to include

Share these fields:

• Exact exception text and stack trace, after removing local paths or identifiers.
• SDK/package name and version.
• Client initialization code.
• Endpoint shape, including the hostname suffix and /models path, for example:

    https://<resource>.services.ai.azure.com/models
  

• Environment-variable names, plus whether each value is present and its length—not its value.
• Deployment name, redacted if organizationally sensitive.
• Whether the value came from the same Foundry resource as the endpoint.

Do not share:

• KEY1, KEY2, or any portion of the inference key.
• Tenant ID, subscription ID, or resource ID unless troubleshooting Entra ID/RBAC rather than key authentication.
• Screenshots containing access keys, connection strings, Bearer [Token], or unredacted command output.

Microsoft explicitly advises never posting an API key publicly.^1^

A safe environment diagnostic would be:

string? endpoint = Environment.GetEnvironmentVariable("AZURE_INFERENCE_ENDPOINT");
string? key = Environment.GetEnvironmentVariable("AZURE_INFERENCE_CREDENTIAL");

Console.WriteLine($"Endpoint host/path: {RedactResource(endpoint)}");
Console.WriteLine($"Key present: {!string.IsNullOrWhiteSpace(key)}");
Console.WriteLine($"Key length: {key?.Length ?? 0}");
Console.WriteLine($"Key has whitespace: {key != key?.Trim()}");

Replace RedactResource output manually if necessary; do not print the key itself.

Verify the supported pairing

For the retired Azure AI Inference SDK, ChatCompletionsClient accepts either AzureKeyCredential or TokenCredential.^2^ The documented .NET key-authentication pairing is:

using Azure;
using Azure.AI.Inference;

var endpoint = Environment.GetEnvironmentVariable("AZURE_INFERENCE_ENDPOINT");
var key = Environment.GetEnvironmentVariable("AZURE_INFERENCE_CREDENTIAL");

var client = new ChatCompletionsClient(
    new Uri(endpoint!),
    new AzureKeyCredential(key!)
);

The endpoint must be the model inference endpoint, shaped like:

https://<resource>.services.ai.azure.com/models

The key must belong to that same Foundry resource.^3^

Do not mix:

• A project or agent-management endpoint with AzureKeyCredential.
• An Azure OpenAI endpoint such as https://<resource>.openai.azure.com with the inference SDK’s /models configuration.
• A key copied from one resource with another resource’s endpoint.

Current supported direction

The Azure AI Inference SDK was retired on August 26, 2026; Microsoft recommends migrating to the stable OpenAI SDK and OpenAI v1 endpoint.^3^ For .NET key authentication, the corresponding configuration is:

using OpenAI;
using OpenAI.Chat;
using System.ClientModel;

var client = new ChatClient(
    model: "<deployment-name>",
    credential: new ApiKeyCredential(
        Environment.GetEnvironmentVariable("AZURE_OPENAI_API_KEY")),
    options: new OpenAIClientOptions {
        Endpoint = new Uri(
            "https://<resource>.openai.azure.com/openai/v1/")
    });

The deployment name is required, and the v1 endpoint must end in /openai/v1/.^4^

If the key has already appeared in an attachment, terminal dump, repository, or public post, regenerate it immediately. Regeneration invalidates the old value, so rotate to the other key first if the application is in production.^5^

References

1. Quickstart: Get started using chat completions with Azure OpenAI in Azure AI Foundry Models (rest-api)
2. ChatCompletionsClient Class-Constructor
3. Migrate from Azure AI Inference SDK to OpenAI SDK (programming-language-python)
4. Endpoints for Microsoft Foundry Models
5. Rotate API keys