Speech API rejects requests with 401 whether using key or token

Marcus Bointon 21

I'm trying to call the speech API. The docs say I can use either a Ocp-Apim-Subscription-Key header containing my subscription key directly, or I can request an access token with a call to https://<REGION_IDENTIFIER>.api.cognitive.microsoft.com/sts/v1.0/issueToken, to obtain a JWT that I can then include in subsequent requests in an Authorization: Bearer <token> header. However, neither works. I can successfully obtain an access token (which I assume means that my key is correct), but then calls to the API endpoint using either authentication mechanism are rejected with a 401 error and no other info (content length of the response is 0). I am using the same region identifier for both calls. Is there something else I have to do?

romungi-MSFT 44,581 Reputation points Microsoft Employee

2021-04-20T11:44:05.037+00:00
@Marcus Bointon Could you post the actual API call to the service where the 401 error response is received? Depending on which API you would call the URI should be something like below:

https://<REGION_IDENTIFIER>.stt.speech.microsoft.com/speech/recognition/conversation/cognitiveservices/v1
Marcus Bointon 21 Reputation points

2021-04-20T15:48:44.557+00:00
I'm getting the token from:

https://westeurope.api.cognitive.microsoft.com/sts/v1.0/issueToken

and calling the API at

https://westeurope.stt.speech.microsoft.com/speech/recognition/conversation/cognitiveservices/v1?language=en-CA

The only obvious difference is the language param.
Marcus Bointon 21 Reputation points

2021-04-20T21:00:18.643+00:00

I tried posting my other note as a comment but this site wouldn't accept it - the only thing that worked was posting it as a answer

Accepted answer

romungi-MSFT 44,581 Reputation points Microsoft Employee

2021-04-22T12:42:52.337+00:00
@Marcus Bointon Could you please clarify the public API you are referring to? I am referring to API similar to this:

https://<region>.stt.speech.microsoft.com/speech/recognition/conversation/cognitiveservices/v1

To simplify our conversation and demonstrate its usage I am using the API in the following way to use the service.

Use the keys of the speech resource created in Azure to get the bearer token. API used https://<REGION_IDENTIFIER>.api.cognitive.microsoft.com/sts/v1.0/issueToken

Used the bearer token along with a wav file as input to get the detailed response of the text. API used https://<region>.stt.speech.microsoft.com/speech/recognition/conversation/cognitiveservices/v1

If I use the same API with the key rather than the token, I get the same result.
Please sign in to rate this answer.
Marcus Bointon 21 Reputation points

2021-04-23T18:05:13.17+00:00

Thanks. I had got to this point after finding that I did need to use separate keys for each service, and it is now working. What is also confusing is why for the vision API I get a URI that points at my vision resource, but the URI for my speech resource points at the public service. The keys for my own resource work for the public API, even though I was required to create a unique URI for my resource. Does the public URI get mapped to my resource through the key? Why isn't it consistent across services/resources?

I've not tried the reverse combination - is the token-based auth mechanism supported by the vision API?
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

1 additional answer

Marcus Bointon 21 Reputation points

2021-04-20T20:57:46.197+00:00
I think the problem is with my subscription key. When I set things up I just wanted to be able to auth and call a vision API, but I had to create a resource group and a resource of my own before I could do that. This was very confusing, and not something I expected to have to do, but I got it running. The subscription key I'm trying to use for speech is the one I use for that. I tried using it for another service and it didn't work:

curl -X GET 'https://westeurope.api.cognitive.microsoft.com/bing/v7.0/search?q=Welsch%20Pembroke%20Corgis' -H 'Ocp-Apim-Subscription-Key:<my key>'

Unlike the speech API's bare 401, this gives me an understandable error:

{"error":{"code":"401","message": "The Search Operation under Web Search API - v7 is not supported with the current subscription key and pricing tier ComputerVision.F0."}}

I don't have any other keys. If this is the wrong key, why does the issueToken endpoint work? Do I have to register a new account to get a different key?
Please sign in to rate this answer.
romungi-MSFT 44,581 Reputation points Microsoft Employee

2021-04-21T07:13:20.393+00:00

@Marcus Bointon Did you create a common cognitive services resource instead of the speech resource?
Some of the cognitive services support common resource so users create a common resource and use it for different services under cognitive services. But as the services evolved this functionality became limited and the general thumb rule is to create the required cognitive service resource and use respective keys instead.

Marcus Bointon 21 Reputation points

2021-04-21T09:00:52.267+00:00

The resource I have was made according to the guide you pointed at, and is labelled both "Cognitive services", and also "Computer vision". I have no idea whether this includes speech services or not. However, I wouldn't expect it to need to because the speech API endpoint I'm using is not one that points at my resource. How can I get a key that works with the public speech API, which doesn't appear to have anything to do with my resources? Why does the token endpoint work with what seems to be the wrong key? Isn't that a bug? If I try to add a new resource for speech, there are no Microsoft services available, only third parties from a marketplace. It's all such a mess.

romungi-MSFT 44,581 Reputation points Microsoft Employee

2021-04-21T09:44:07.14+00:00

The speech resource in marketplace is as shown below:

These steps should help you create the correct resource and use the keys of this resource.

The token endpoint is a common cognitive services endpoint which provides a valid bearer token for a cognitive services resource key. This token is validated for an API call to the actual service.

Marcus Bointon 21 Reputation points

2021-04-21T12:06:33.847+00:00

I had searched for speech to text, and the results look quite different in my Azure portal, however, I have now found that, thanks. I still don't understand why I need to create a resource for this at all. Isn't the whole point of the public APIs that I don't need to that? How can I just get a key for the public API without having to make my own resource? If that's not possible, what are the public URLs for?

romungi-MSFT 44,581 Reputation points Microsoft Employee

2021-04-22T07:58:23.873+00:00

The APIs are generally available through the public URLs which would need the user's resource keys for authentication and billing. These are sent in your request as a header to the service and the body of the request contains details of your request. If the authentication is successful the body will be validated and the appropriate response is returned.

You cannot use the service if you do not have valid keys that are generated when you create a resource. Even for a free azure subscription a resource needs to be created which is then billed to the 200$ free credit.

Marcus Bointon 21 Reputation points

2021-04-22T08:36:33.977+00:00

Yes I know this – that's exactly what this question is about! I have a valid key for my resource, and it works fine for that, but the same key does not work for the public APIs.

romungi-MSFT 44,581 Reputation points Microsoft Employee

2021-04-22T12:43:51.107+00:00

Posted the steps I used with the REST API as an answer due to character limitation for reference.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Speech API rejects requests with 401 whether using key or token

1 additional answer

Your answer