Delen via

ChainedTokenCredential Class

A sequence of credentials that is itself a credential.

Its get_token method calls get_token on each credential in the sequence, in order, returning the first valid token received. For more information, see ChainedTokenCredential overview.

Constructor

ChainedTokenCredential(*credentials: TokenCredential | SupportsTokenInfo)

Parameters

Name Description
credentials
Required
<xref:azure.core.credentials.TokenProvider>

credential instances to form the chain

Examples

Create a ChainedTokenCredential.


   from azure.identity import ChainedTokenCredential, EnvironmentCredential, AzureCliCredential

   credential_chain = (
       # Try EnvironmentCredential first
       EnvironmentCredential(),
       # Fallback to Azure CLI if EnvironmentCredential fails
       AzureCliCredential(),
   )
   credential = ChainedTokenCredential(*credential_chain)

Methods

close

Close the transport session of each credential in the chain.
get_token

Request a token from each chained credential, in order, returning the first token received.

If no credential provides a token, raises ClientAuthenticationError with an error message from each credential.

This method is called automatically by Azure SDK clients.
get_token_info

Request a token from each chained credential, in order, returning the first token received.

If no credential provides a token, raises ClientAuthenticationError with an error message from each credential.

This is an alternative to get_token to enable certain scenarios that require additional properties on the token. This method is called automatically by Azure SDK clients.

close

Close the transport session of each credential in the chain.

close() -> None

get_token

Request a token from each chained credential, in order, returning the first token received.

If no credential provides a token, raises ClientAuthenticationError with an error message from each credential.

This method is called automatically by Azure SDK clients.

get_token(*scopes: str, claims: str | None = None, tenant_id: str | None = None, enable_cae: bool = False, **kwargs: Any) -> AccessToken

Parameters

Name Description
scopes
Required
str

desired scopes for the access token. This method requires at least one scope. For more information about scopes, see https://free.blessedness.top/entra/identity-platform/scopes-oidc.

Keyword-Only Parameters

Name Description
claims
str

additional claims required in the token, such as those returned in a resource provider's claims challenge following an authorization failure.

Default value: None
tenant_id
str

optional tenant to include in the token request.

Default value: None
enable_cae
bool

indicates whether to enable Continuous Access Evaluation (CAE) for the requested token. Defaults to False.

Default value: False

Returns

Type Description
AccessToken

An access token with the desired scopes.

Exceptions

Type Description
ClientAuthenticationError

no credential in the chain provided a token

get_token_info

Request a token from each chained credential, in order, returning the first token received.

If no credential provides a token, raises ClientAuthenticationError with an error message from each credential.

This is an alternative to get_token to enable certain scenarios that require additional properties on the token. This method is called automatically by Azure SDK clients.

get_token_info(*scopes: str, options: TokenRequestOptions | None = None) -> AccessTokenInfo

Parameters

Name Description
scopes
Required
str

desired scopes for the access token. This method requires at least one scope. For more information about scopes, see https://free.blessedness.top/entra/identity-platform/scopes-oidc.

Keyword-Only Parameters

Name Description
options
TokenRequestOptions

A dictionary of options for the token request. Unknown options will be ignored. Optional.

Default value: None

Returns

Type Description
AccessTokenInfo

An AccessTokenInfo instance containing information about the token.

Exceptions

Type Description
ClientAuthenticationError

no credential in the chain provided a token.