org.llm4s.llmconnect.auth.azure

Microsoft Entra ID tokens for Azure OpenAI, keyless (#2274): an AccessTokenProvider over any Azure TokenCredential, for AzureConfig.withTokenProvider and OpenAIEmbeddingProvider.fromConfig(config, tokenProvider).

A token is fetched for CognitiveServicesScope, cached, and fetched again RefreshMargin before it expires (or half-way through its life, if it is shorter), so a request never carries an expired one. Concurrent callers share one fetch, and a token the service rejects with a 401 is dropped, so the next request fetches a new one.

// DefaultAzureCredential: environment, workload identity, managed identity, the Azure CLI's login, ...
val config = AzureConfig.keyless(endpoint, "my-gpt-4o-deployment", AzureEntraId.defaultCredential())

// Any other TokenCredential, such as a user-assigned managed identity's
val tokens = AzureEntraId.tokenProvider(new ManagedIdentityCredentialBuilder().clientId(id).build())

A section of application.conf does the same with authentication = "entra-id" (and, for a user-assigned managed identity, clientId) once this module is on the classpath.