ApiKeyProvider

Supplies the API key a client sends, asked once per request, so a key rotated by a secret manager is used without rebuilding the client (#2313).

A config carries one as ProviderConfig.apiKeyProvider: a section's apiKeyFile sets ApiKeyProvider.file, and code sets any implementation with withApiKeyProvider - one backed by Vault, AWS Secrets Manager or another secret store, which llm4s does not depend on. current() is called on the request path, so an implementation caches and fetches again only when the key may have changed. It returns a failure as a Left rather than throwing; a client turns a thrown exception into a failed request all the same.

The key is an ApiKey, so creating one registers it for redaction: an error that echoes a rotated key is scrubbed of it too.

Stable, as AccessTokenProvider is: the Stable configs that support it (OpenAIConfig, AnthropicConfig, OpenAICompatibleConfig) carry one.