From 138349ad95683847c6d8ae6d6804707b01bb2045 Mon Sep 17 00:00:00 2001 From: erkin98 Date: Tue, 3 Mar 2026 23:31:20 +0400 Subject: [PATCH] fix(azure_ai): remove openai_key fallback from Azure AI get_api_key AzureFoundryModelInfo.get_api_key() falls back to litellm.openai_key when no explicit api_key is provided. This causes 401 Unauthorized errors when using Azure AI Foundry Agents (azure_ai/agents/*) in environments where OPENAI_API_KEY is also set. The issue: when litellm.openai_key is populated (e.g. by a LangChain wrapper like ChatLiteLLM setting it as a module-level global), the Azure AI Agents handler uses the OpenAI API key as a Bearer token against the Azure endpoint. Since OpenAI keys are not valid Azure AD tokens, Azure returns 401. The fix removes litellm.openai_key from the fallback chain. OpenAI API keys are never valid credentials for Azure AI services. The correct auth flow for Azure AI Agents is DefaultAzureCredential (via get_azure_ad_token in agents/transformation.py), which is only reached when api_key is None. litellm.api_key is retained as it is an explicit user override. --- litellm/llms/azure_ai/common_utils.py | 1 - 1 file changed, 1 deletion(-) diff --git a/litellm/llms/azure_ai/common_utils.py b/litellm/llms/azure_ai/common_utils.py index 47d397d6e98..1628d8dcd50 100644 --- a/litellm/llms/azure_ai/common_utils.py +++ b/litellm/llms/azure_ai/common_utils.py @@ -46,7 +46,6 @@ class AzureFoundryModelInfo(BaseLLMModelInfo): return ( api_key or litellm.api_key - or litellm.openai_key or get_secret_str("AZURE_AI_API_KEY") )