Assistance Required for Azure Bing Spell Check API Integration

Question

Hi All,

We are developing an application that utilizes the Azure Bing Spell Check API for text correction. The Bing API is accessed using an access token, which is generated using a Kubernetes service token. Below are the steps we have followed:

Federated Identity Credential: A new app registration was created, and the federated identity credential was configured with the necessary issuer and subject values to establish a trust relationship between the Kubernetes service account and Azure AD.

Bing Search Service: An Azure Bing Search service was created, and IAM was configured with the reader role for the app ID created in the previous step.

Kubernetes Token: The service account token is read from the cluster path: /var/run/secrets/eks.amazonaws.com/serviceaccount.

Access Token: The access token is generated using the service account token with the following details:

• URL: https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/token
  • Method: POST
    • Body Parameters: grant_type=client_credentials&client_id={client-id}&client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer&scope=https://api.bing.microsoft.com/.default&client_assertion={service-account-token}
      • The access token is generated with the audience set to https://api.bing.microsoft.com/.
      Bing API Call: The API is called by passing the access token as a bearer token in the authentication header:

      - **Spell Check URL**: `https://api.bing.microsoft.com/v7.0/spellcheck?text=sample%20check&mode=spell&mkt=en-US`
      
         - **Method Type**: GET
      

Exception: When calling the Bing API, we encounter the following error:

Unauthorized. Access token is missing, invalid, audience is incorrect (https://bing.azure.com), or has expired.

If we attempt to add the scope or audience as https://bing.azure.com, we receive a different error: AADSTS500011: The resource principal named https://bing.azure.com was not found in the tenant named XXX Group. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You might have sent your authentication request to the wrong tenant.

We need assistance in understanding what is missing in our configuration. Please provide the correct steps and configuration to implement this functionality.

Thanks in advance.

Answer 1

Hi @Shivaji Shitole,

The Azure Bing Spell Check API requires the Ocp-Apim-Subscription-Key for authentication, and Azure AD authentication is not supported for this API.

Microsoft’s Bing Search APIs, including Spell Check, primarily use API key-based authentication (Ocp-Apim-Subscription-Key). While some Azure services support Azure AD authentication (OAuth tokens), Bing APIs, including Spell Check, do not currently support Azure AD-based access tokens.

If you need to call the Bing Spell Check API, you must retrieve the subscription key from your Azure Bing Search resource and pass it in the request header as Ocp-Apim-Subscription-Key: {your-subscription-key}.

Your current approach using OAuth tokens (Azure AD authentication) is not applicable for the Bing Spell Check API. Instead, you should switch to subscription key authentication.

Thank you.