fix(azure_ai): remove openai_key fallback from Azure AI get_api_key

AzureFoundryModelInfo.get_api_key() falls back to litellm.openai_key
when no explicit api_key is provided. This causes 401 Unauthorized
errors when using Azure AI Foundry Agents (azure_ai/agents/*) in
environments where OPENAI_API_KEY is also set.

The issue: when litellm.openai_key is populated (e.g. by a LangChain
wrapper like ChatLiteLLM setting it as a module-level global), the
Azure AI Agents handler uses the OpenAI API key as a Bearer token
against the Azure endpoint. Since OpenAI keys are not valid Azure AD
tokens, Azure returns 401.

The fix removes litellm.openai_key from the fallback chain. OpenAI
API keys are never valid credentials for Azure AI services. The
correct auth flow for Azure AI Agents is DefaultAzureCredential
(via get_azure_ad_token in agents/transformation.py), which is only
reached when api_key is None.

litellm.api_key is retained as it is an explicit user override.
This commit is contained in:
erkin98 2026-03-03 23:31:20 +04:00
parent 66c49dbb9c
commit 138349ad95

View file

@ -46,7 +46,6 @@ class AzureFoundryModelInfo(BaseLLMModelInfo):
return (
api_key
or litellm.api_key
or litellm.openai_key
or get_secret_str("AZURE_AI_API_KEY")
)