A section that sets no apiKey of its own uses its vendor's shared key, llm4s.credentials.<providerId>.apiKey. That is the convenient default - set OPENAI_API_KEY and every OpenAI section works - and also the way a section meant for a second account, missing its key, silently bills the first. Llm4sConfig.apiKeySources reports which sections do which, so a policy can insist on explicit keys in production.
The section authenticates with workload identity - an auth block, or a keyless authentication its provider declares (ProviderConfigSpec.keylessWhen, such as Azure OpenAI's authentication = "entra-id") - so it uses no API key, its own or shared.
The section authenticates with workload identity - an auth block, or a keyless authentication its provider declares (ProviderConfigSpec.keylessWhen, such as Azure OpenAI's authentication = "entra-id") - so it uses no API key, its own or shared.
Value parameters
path
the block's or the setting's path, e.g. llm4s.providers.databricks-main.auth or llm4s.providers.azure-prod.authentication