Skip to content

fix: restore Azure AD bearer token support in api_key auth #3374

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Oxygen56 wants to merge 1 commit into
base: main
Choose a base branch
from
+6 −2
Open

fix: restore Azure AD bearer token support in api_key auth #3374

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 6 additions & 2 deletions src/openai/lib/azure.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -347,11 +347,13 @@ def _get_azure_ad_token(self) -> str | None:
return None

@override
def _auth_headers(self, security: SecurityOptions) -> dict[str, str]: # noqa: ARG002
def _auth_headers(self, security: SecurityOptions) -> dict[str, str]:
if self._azure_ad_token is not None:
return {"Authorization": f"Bearer {self._azure_ad_token}"}

if self.api_key and self.api_key != API_KEY_SENTINEL:
if security.get("bearer_auth", False):
return {"Authorization": f"Bearer {self.api_key}"}
Comment on lines +355 to +356
Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot Jun 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Avoid adding bearer auth without suppressing api-key

When an AzureOpenAI client is configured with api_key and calls any operation generated with security={"bearer_auth": True}, _prepare_options() still injects the api-key header into options.headers before _build_headers() merges these auth headers. Returning Authorization here therefore sends both Authorization: Bearer ... and api-key: ..., so the endpoint-level switch to bearer auth is not actually exclusive and can be rejected by Azure services that require a single auth scheme; the async override has the same issue.

Useful? React with 👍 / 👎.

return {"api-key": self.api_key}

return {}
Expand Down Expand Up @@ -669,11 +671,13 @@ async def _get_azure_ad_token(self) -> str | None:
return None

@override
def _auth_headers(self, security: SecurityOptions) -> dict[str, str]: # noqa: ARG002
def _auth_headers(self, security: SecurityOptions) -> dict[str, str]:
if self._azure_ad_token is not None:
return {"Authorization": f"Bearer {self._azure_ad_token}"}

if self.api_key and self.api_key != API_KEY_SENTINEL:
if security.get("bearer_auth", False):
return {"Authorization": f"Bearer {self.api_key}"}
return {"api-key": self.api_key}

return {}
Expand Down