From 705dc36d7d25fb4357a891e210d86ae0dc295419 Mon Sep 17 00:00:00 2001 From: Oxygen <1391083091@qq.com> Date: Sat, 6 Jun 2026 02:24:59 +0800 Subject: [PATCH] fix: restore Azure AD bearer token support in api_key auth When bearer_auth is set in security options (the default for all requests), the Azure client's _auth_headers now returns Authorization: Bearer using the api_key value, restoring the v2.33.0 behavior where AAD bearer tokens passed via api_key worked correctly. In v2.34.0, an _auth_headers override was added that unconditionally sent api_key as an api-key header, breaking setups where an Azure AD token was passed through the api_key parameter (e.g., with Azure API Management proxies). Fixes #3282 Co-Authored-By: Claude Opus 4.8 --- src/openai/lib/azure.py | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/openai/lib/azure.py b/src/openai/lib/azure.py index 4fcae24788..ea4d6f6f17 100644 --- a/src/openai/lib/azure.py +++ b/src/openai/lib/azure.py @@ -347,11 +347,13 @@ def _get_azure_ad_token(self) -> str | None: return None @override - def _auth_headers(self, security: SecurityOptions) -> dict[str, str]: # noqa: ARG002 + def _auth_headers(self, security: SecurityOptions) -> dict[str, str]: if self._azure_ad_token is not None: return {"Authorization": f"Bearer {self._azure_ad_token}"} if self.api_key and self.api_key != API_KEY_SENTINEL: + if security.get("bearer_auth", False): + return {"Authorization": f"Bearer {self.api_key}"} return {"api-key": self.api_key} return {} @@ -669,11 +671,13 @@ async def _get_azure_ad_token(self) -> str | None: return None @override - def _auth_headers(self, security: SecurityOptions) -> dict[str, str]: # noqa: ARG002 + def _auth_headers(self, security: SecurityOptions) -> dict[str, str]: if self._azure_ad_token is not None: return {"Authorization": f"Bearer {self._azure_ad_token}"} if self.api_key and self.api_key != API_KEY_SENTINEL: + if security.get("bearer_auth", False): + return {"Authorization": f"Bearer {self.api_key}"} return {"api-key": self.api_key} return {}