AzureKeyCredential rejected by ChatCompletionsClient

Question

AzureKeyCredential rejected by ChatCompletionsClient

Roakey Tornheim 0

I used the inference endpoint and API key from Foundry, but receive Unsupported credential. I can attach the Keys and Endpoint screen and my environment-variable output. Which fields need to remain visible to identify the issue? the full inference key, endpoint, resource name, or tenant ID?

Roakey Tornheim 0 Reputation points

2026-11-05T19:26:45.58+00:00

The UI masks the key. Should I click reveal before taking the screenshot?

2 answers

Your answer

Roakey Tornheim 0 Reputation points

2026-11-05T19:26:45.58+00:00

The UI masks the key. Should I click reveal before taking the screenshot?

Answer 1

Hi Roakey,

Please don't post your key, endpoint or tenant ID. You don't need them here. Unsupported credential is raised on your machine while the client is created, before any call to Azure, and it depends only on the type of the object you pass as credential.

The client accepts an AzureKeyCredential instance (or a token credential such as DefaultAzureCredential). Passing a plain string, or the class itself without (...), gives exactly this error:

from azure.core.credentials import AzureKeyCredential

from azure.ai.inference import ChatCompletionsClient

client = ChatCompletionsClient(

    endpoint="https://<resource>.services.ai.azure.com/models",

    credential=AzureKeyCredential("<your-key>"),  # an instance wrapping the key string

)

I checked this locally with azure-ai-inference 1.0.0b9: a plain string or the bare class raises TypeError: Unsupported credential, and AzureKeyCredential("<key>") works. Note that the error message prints whatever you passed in. If you passed the key as a string, redact it from any logs you share.

Could you share the line where you create the client (with the key replaced by ***)? Then I can confirm whether this is the cause.

Reference: _configuration.py in azure-ai-inference: https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/ai/azure-ai-inference/azure/ai/inference

I used Claude (Anthropic) to help draft this answer. I reviewed it and reproduced the error myself.

Answer 2

Never expose the full inference key; leave the endpoint’s domain and path visible, redact the resource-name portion consistently, and omit the tenant ID because it is not used with AzureKeyCredential.

Safe information to include

Share these fields:

Exact exception text and stack trace, after removing local paths or identifiers.
SDK/package name and version.
Client initialization code.
Endpoint shape, including the hostname suffix and /models path, for example:
```
  https://<resource>.services.ai.azure.com/models
```
Environment-variable names, plus whether each value is present and its length—not its value.
Deployment name, redacted if organizationally sensitive.
Whether the value came from the same Foundry resource as the endpoint.

Do not share:

KEY1, KEY2, or any portion of the inference key.
Tenant ID, subscription ID, or resource ID unless troubleshooting Entra ID/RBAC rather than key authentication.
Screenshots containing access keys, connection strings, Bearer [Token], or unredacted command output.

Microsoft explicitly advises never posting an API key publicly.^1^

A safe environment diagnostic would be:

string? endpoint = Environment.GetEnvironmentVariable("AZURE_INFERENCE_ENDPOINT");
string? key = Environment.GetEnvironmentVariable("AZURE_INFERENCE_CREDENTIAL");

Console.WriteLine($"Endpoint host/path: {RedactResource(endpoint)}");
Console.WriteLine($"Key present: {!string.IsNullOrWhiteSpace(key)}");
Console.WriteLine($"Key length: {key?.Length ?? 0}");
Console.WriteLine($"Key has whitespace: {key != key?.Trim()}");

Replace RedactResource output manually if necessary; do not print the key itself.

Verify the supported pairing

For the retired Azure AI Inference SDK, ChatCompletionsClient accepts either AzureKeyCredential or TokenCredential.^2^ The documented .NET key-authentication pairing is:

using Azure;
using Azure.AI.Inference;

var endpoint = Environment.GetEnvironmentVariable("AZURE_INFERENCE_ENDPOINT");
var key = Environment.GetEnvironmentVariable("AZURE_INFERENCE_CREDENTIAL");

var client = new ChatCompletionsClient(
    new Uri(endpoint!),
    new AzureKeyCredential(key!)
);

The endpoint must be the model inference endpoint, shaped like:

https://<resource>.services.ai.azure.com/models

The key must belong to that same Foundry resource.^3^

Do not mix:

A project or agent-management endpoint with AzureKeyCredential.
An Azure OpenAI endpoint such as https://<resource>.openai.azure.com with the inference SDK’s /models configuration.
A key copied from one resource with another resource’s endpoint.

Current supported direction

The Azure AI Inference SDK was retired on August 26, 2026; Microsoft recommends migrating to the stable OpenAI SDK and OpenAI v1 endpoint.^3^ For .NET key authentication, the corresponding configuration is:

using OpenAI;
using OpenAI.Chat;
using System.ClientModel;

var client = new ChatClient(
    model: "<deployment-name>",
    credential: new ApiKeyCredential(
        Environment.GetEnvironmentVariable("AZURE_OPENAI_API_KEY")),
    options: new OpenAIClientOptions {
        Endpoint = new Uri(
            "https://<resource>.openai.azure.com/openai/v1/")
    });

The deployment name is required, and the v1 endpoint must end in /openai/v1/.^4^

If the key has already appeared in an attachment, terminal dump, repository, or public post, regenerate it immediately. Regeneration invalidates the old value, so rotate to the other key first if the application is in production.^5^

References