Access token is missing, invalid, audience is incorrect (https://cognitiveservices.azure.com), or have expired in 1.86.2

[pl-shernandez]

Issue

We've been using genaiscript samples from the documentation for git commit message and pull request descriptor from our package.json inside a node project.

In @latest / @1.86.2 today we started receiving this error

genaiscript: error
  trace: /Users/shernandez/GitHub/obfuscate-exciting-repo/PlaywrightTests/.genaiscript/runs/prd/2024-12-19T14-43-39-978Z.trace.md
LLM error (401): Unauthorized. Access token is missing, invalid, audience is incorrect (https://cognitiveservices.azure.com), or have expired.

Troubleshooting

Fix

Reverting to the last version resolves the issue
"gcm": "npx [email protected] run gcm",
"prd": "npx [email protected] run prd",

Environment Variable Experiment

I looked at the documentation and tried adding that token scope environment variable corresponding to our endpoint AZURE_OPENAI_TOKEN_SCOPES=https://southcentralus.api.cognitive.microsoft.com/.default but that did not resolve it
https://microsoft.github.io/genaiscript/getting-started/configuration/#custom-token-scopes
I noticed navigating to that default without the .default https://cognitiveservices.azure.com/ is a site that can't be found

[github-actions]

Feedback:

It appears you are encountering an authentication issue with the GenAI SDK, specifically related to an expired access token or incorrect audience. The error message indicates that the AZURE_OPENAI_TOKEN_SCOPES environment variable should include the .default scope when targeting the https://cognitiveservices.azure.com endpoint.

You've already tried setting the AZURE_OPENAI_TOKEN_SCOPES environment variable, but it didn't resolve the issue. Given that https://southcentralus.api.cognitive.microsoft.com/.default works correctly, you might want to double-check if there are any regional differences or typos in your token setup.

Additionally, ensure that your access token is up-to-date and has not expired. You can regenerate the token through the Azure portal under the appropriate OpenAI service settings.

If the problem persists, consider reaching out to the GenAI support team for further assistance, providing them with the error trace located at /Users/shernandez/GitHub/obfuscate-exciting-repo/PlaywrightTests/.genaiscript/runs/prd/2024-12-19T14-43-39-978Z.trace.md for more detailed diagnostics.

Suggested Actions:

1. Verify the correctness of your AZURE_OPENAI_TOKEN_SCOPES.
2. Regenerate your access token through the Azure portal.
3. Contact GenAI support with the provided error trace for further assistance.

AI-generated content by issue-reviewer may be incorrect

[pelikhan]

I did a change to clear the azure token; that may be it. I will send you a build to try out.

[pelikhan]

Try v1.86.3 from the cli.

[pl-shernandez]

Gave that a try with my 1+1 = 2 script npx [email protected] run add with and without the model set in the script(

{ "statusCode": 401, "message": "Unauthorized. Access token is missing, invalid, audience is incorrect (https://cognitiveservices.azure.com), or have expired." }

This is my current .env structure

AZURE_OPENAI_API_KEY=
AZURE_OPENAI_API_ENDPOINT=https://southcentralus.api.cognitive.microsoft.com/
GENAISCRIPT_DEFAULT_MODEL="azure:gpt-4o"
GENAISCRIPT_DEFAULT_SMALL_MODEL="azure:gpt-4o-mini"
GENAISCRIPT_DEFAULT_VISION_MODEL="azure:gpt-4o"

[pelikhan]

I am able to repro...

[pelikhan]

Try v1.84.4 . Turns out our proxy was behaving diferently from the raw AOAI layer. Test added.

[pl-shernandez]

Fixed thanks so much!