Prefer AzureConfig.fromValues, which validates the values and resolves contextWindow and reserveCompletion from the bundled model catalogue. The constructor is private: build one with the companion apply and adjust it with the with* setters. Java and Kotlin, which cannot see Scala default arguments, use AzureConfig.apply(endpoint, apiKey, model) and the setters, so adding a field never breaks them.
Value parameters
apiKey
Azure API key; redacted in toString.
apiKeyProvider
asked for the key on every request instead of sending apiKey, so a rotated key is used without rebuilding the client (#2477): a section's apiKeyFile sets one. Never set together with tokenProvider.
apiVersion
Azure OpenAI API version string, e.g. "2025-01-01-preview".
contextWindow
Model's total token capacity (prompt + completion combined).
endpoint
Azure OpenAI deployment endpoint URL, e.g. "https://my-resource.openai.azure.com/openai/deployments/my-deploy".
model
Deployment name used as the model identifier.
reserveCompletion
Tokens held back from prompt history for the completion.
timeouts
how long a request and a stream may take: the section's timeouts block. An absent value keeps the client's own default (ProviderTimeouts)
tokenProvider
keyless Microsoft Entra ID authentication (#2274): when set, each request carries Authorization: Bearer <token> from it instead of the api-key header, and apiKey is unused (empty). A section with authentication = "entra-id" gets one from llm4s-azure-identity; in code, build one with that module's AzureEntraId, or implement org.llm4s.llmconnect.auth.AccessTokenProvider directly. Use AzureConfig.keyless or withTokenProvider.
The endpoint this config will contact, when it is known statically.
The endpoint this config will contact, when it is known statically.
Used by policy checks and diagnostics that need to know where traffic will go without knowing which provider it belongs to. None means the config carries no single URL — not that it makes no network calls.
Sends the key provider holds at each request in the api-key header, instead of apiKey, so a rotated key is used without rebuilding the client (#2477). A config authenticates one way: this clears tokenProvider.
Sends the key provider holds at each request in the api-key header, instead of apiKey, so a rotated key is used without rebuilding the client (#2477). A config authenticates one way: this clears tokenProvider.
The same config with the given proxy and TLS settings.
The same config with the given proxy and TLS settings.
The loader calls this on every config a descriptor builds, as it does withTimeouts, so a descriptor does not read the http block itself. The default returns this: a config that does not carry the setting ignores it. A config that does overrides this with its own return type.
The loader calls this on every config a descriptor builds, passing the section's timeouts block, so a descriptor does not read the block itself. The default returns this: a config that does not carry timeouts, such as one supplied by another module, ignores them. A config that does overrides this with its own return type.