Microsoft Entra ID tokens for Azure OpenAI, keyless (#2274): an AccessTokenProvider over any Azure TokenCredential, for AzureConfig.withTokenProvider and OpenAIEmbeddingProvider.fromConfig(config, tokenProvider).
A token is fetched for CognitiveServicesScope, cached, and fetched again RefreshMargin before it expires (or half-way through its life, if it is shorter), so a request never carries an expired one. Concurrent callers share one fetch, and a token the service rejects with a 401 is dropped, so the next request fetches a new one.
// DefaultAzureCredential: environment, workload identity, managed identity, the Azure CLI's login, ...
val config = AzureConfig.keyless(endpoint, "my-gpt-4o-deployment", AzureEntraId.defaultCredential())
// Any other TokenCredential, such as a user-assigned managed identity's
val tokens = AzureEntraId.tokenProvider(new ManagedIdentityCredentialBuilder().clientId(id).build())
A section of application.conf does the same with authentication = "entra-id" (and, for a user-assigned managed identity, clientId) once this module is on the classpath.
Tokens from Azure's DefaultAzureCredential, which tries, in turn, the environment (AZURE_CLIENT_ID with a secret or certificate), workload identity (AKS), managed identity, and the developer's Azure CLI, PowerShell or azd login. A system-assigned managed identity needs nothing more.
Tokens from Azure's DefaultAzureCredential, which tries, in turn, the environment (AZURE_CLIENT_ID with a secret or certificate), workload identity (AKS), managed identity, and the developer's Azure CLI, PowerShell or azd login. A system-assigned managed identity needs nothing more.
How long before a token expires it is fetched again. Azure's own clients refresh five minutes ahead; a token that lives shorter than twice this is refreshed half-way through its life.
How long before a token expires it is fetched again. Azure's own clients refresh five minutes ahead; a token that lives shorter than twice this is refreshed half-way through its life.