Azure OpenAI credentials

You can use these credentials to authenticate the following nodes:

• Chat Azure OpenAI
• Embeddings Azure OpenAI

Prerequisites

• Create an Azure (opens in a new tab) subscription.
• Access to Azure OpenAI within that subscription. You may need to request access (opens in a new tab) if your organization doesn't yet have it.

Supported authentication methods

• API key
• Azure Entra ID (OAuth2)

Related resources

Refer to Azure OpenAI's API documentation (opens in a new tab) for more information about the service.

Using API key

To configure this credential, you'll need:

• A Resource Name: the Name you give the resource
• An API key: Key 1 works well. This can be accessed before deployment in Keys and Endpoint.
• The API Version the credentials should use. See the Azure OpenAI API preview lifecycle documentation (opens in a new tab) for more information about API versioning in Azure OpenAI.

To get the information above, create and deploy an Azure OpenAI Service resource (opens in a new tab).

Using Azure Entra ID (OAuth2)

For self-hosted users, there are two main steps to configure OAuth2 from scratch:

1. Register an application with the Microsoft Identity Platform.
2. Generate a client secret for that application.

Follow the detailed instructions for each step below. For more detail on the Microsoft OAuth2 web flow, refer to Microsoft authentication and authorization basics (opens in a new tab).

Register an application

Register an application with the Microsoft Identity Platform:

1. Open the Microsoft Application Registration Portal (opens in a new tab).
2. Select Register an application.
3. Enter a Name for your app.
4. In Supported account types, select Accounts in any organizational directory (Any Azure AD directory - Multi-tenant) and personal Microsoft accounts (for example, Skype, Xbox).
5. In Register an application:
   1. Copy the OAuth Callback URL from your n8n credential.
   2. Paste it into the Redirect URI (optional) field.
   3. Select Select a platform > Web.
6. Select Register to finish creating your application.
7. Copy the Application (client) ID and paste it into n8n as the Client ID.

Refer to Register an application with the Microsoft Identity Platform (opens in a new tab) for more information.

Generate a client secret

With your application created, generate a client secret for it:

1. On your Microsoft application page, select Certificates & secrets in the left navigation.
2. In Client secrets, select + New client secret.
3. Enter a Description for your client secret, such as n8n credential.
4. Select Add.
5. Copy the Secret in the Value column.
6. Paste it into n8n as the Client Secret.
7. Select Connect my account in n8n to finish setting up the connection.
8. Log in to your Microsoft account and allow the app to access your info.

Refer to Microsoft's Add credentials (opens in a new tab) for more information on adding a client secret.

Setting custom scopes

Azure Entra ID credentials use the following scopes by default:

• openid (opens in a new tab)
• offline_access (opens in a new tab)
• AccessReview.ReadWrite.All (opens in a new tab)
• Directory.ReadWrite.All (opens in a new tab)
• NetworkAccessPolicy.ReadWrite.All (opens in a new tab)
• DelegatedAdminRelationship.ReadWrite.All (opens in a new tab)
• EntitlementManagement.ReadWrite.All (opens in a new tab)
• User.ReadWrite.All (opens in a new tab)
• Directory.AccessAsUser.All (opens in a new tab)
• Sites.FullControl.All (opens in a new tab)
• GroupMember.ReadWrite.All (opens in a new tab)

To select different scopes for your credentials, enable the Custom Scopes slider and edit the Enabled Scopes list. Keep in mind that some features may not work as expected with more restrictive scopes.