A resource that forbids keys authenticates with Microsoft Entra ID instead (#2274): authentication = "entra-id" takes tokens from Azure's DefaultAzureCredential - a managed identity, workload identity, the Azure CLI's login - through llm4s-azure-identity, which must then be on the classpath. Such a section takes no apiKey, its own or the shared AZURE_OPENAI_API_KEY; clientId picks a user-assigned managed identity:
Constructs the client for a ProviderConfig this provider produced.
Constructs the client for a ProviderConfig this provider produced.
config is whatever the caller passed, so implementations must check the type rather than cast — ProviderDescriptor.expectConfig does that and produces the standard mismatch error.
Turns a validated config section into the runtime ProviderConfig for this provider.
Turns a validated config section into the runtime ProviderConfig for this provider.
The section has already been checked against configSpec, so required fields are present and section.extras holds exactly the declared provider-specific keys that have a value (defaults applied, deprecated aliases resolved). A Left here means something configSpec cannot express (a malformed value, say).
Value parameters
providerName
the user's instance name (llm4s.providers.<name>), for error messages.