[GH-ISSUE #16629] feat: Allow authenticating to AzureOpenAI using DefaultAzureCredential() #104978

New Issue

GiteaMirror · 2026-05-18T02:48:31-05:00

GiteaMirror commented

2026-05-18 02:48:31 -05:00

Originally created by @selenecodes on GitHub (Aug 14, 2025).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/16629

Check Existing Issues

I have searched the existing issues and discussions.

Problem Description

Currently when using AzureOpenAI you are required to pass an API key.

Current location where Azure authentication happens (to my knowledge):

438e5d966f/backend/open_webui/routers/openai.py (L856-L859)

Desired Solution you'd like

Being able to authenticate using a DefaultAzureCredential() as an option would be preferred so that you have to worry less about API key rotation as you would get short-lived access tokens on every request. Would also save the hassle of having to rotate your keys.

Alternatives Considered

No response

Additional Context

Relevant example from the openai_python library.
See: openai-python/src/openai/lib/azure.py for full code.

    def _get_azure_ad_token(self) -> str | None:
        if self._azure_ad_token is not None:
            return self._azure_ad_token


        provider = self._azure_ad_token_provider
        if provider is not None:
            token = provider()
            if not token or not isinstance(token, str):  # pyright: ignore[reportUnnecessaryIsInstance]
                raise ValueError(
                    f"Expected `azure_ad_token_provider` argument to return a string but it returned {token}",
                )
            return token


        return None

The self._azure_ad_token_provider would be get_bearer_token_provider, see below:

from azure.identity import DefaultAzureCredential, get_bearer_token_provider

scopes = "https://cognitiveservices.azure.com/.default"
get_bearer_token_provider(DefaultAzureCredential(), scopes)

This provider would be called on every request like this.
See: openai-python/src/openai/lib/azure.py for full code.

        azure_ad_token = self._get_azure_ad_token()
        if azure_ad_token is not None:
            if headers.get("Authorization") is None:
                headers["Authorization"] = f"Bearer {azure_ad_token}"

Originally created by @selenecodes on GitHub (Aug 14, 2025). Original GitHub issue: https://github.com/open-webui/open-webui/issues/16629 ### Check Existing Issues - [x] I have searched the existing issues and discussions. ### Problem Description Currently when using AzureOpenAI you are required to pass an API key. Current location where Azure authentication happens (to my knowledge): https://github.com/open-webui/open-webui/blob/438e5d966f0f64f9ea3feab22724a5bd96a4127b/backend/open_webui/routers/openai.py#L856-L859 ### Desired Solution you'd like Being able to authenticate using a `DefaultAzureCredential()` as an option would be preferred so that you have to worry less about API key rotation as you would get short-lived access tokens on every request. Would also save the hassle of having to rotate your keys. ### Alternatives Considered _No response_ ### Additional Context Relevant example from the openai_python library. _See: [openai-python/src/openai/lib/azure.py](https://github.com/openai/openai-python/blob/34014aedbb8946c03e97e5c8d72e03ad2259cd7c/src/openai/lib/azure.py#L306-L319) for full code._ ```python def _get_azure_ad_token(self) -> str | None: if self._azure_ad_token is not None: return self._azure_ad_token provider = self._azure_ad_token_provider if provider is not None: token = provider() if not token or not isinstance(token, str): # pyright: ignore[reportUnnecessaryIsInstance] raise ValueError( f"Expected `azure_ad_token_provider` argument to return a string but it returned {token}", ) return token return None ``` The `self._azure_ad_token_provider` would be `get_bearer_token_provider`, see below: ```python from azure.identity import DefaultAzureCredential, get_bearer_token_provider scopes = "https://cognitiveservices.azure.com/.default" get_bearer_token_provider(DefaultAzureCredential(), scopes) ``` This provider would be called on every request like this. _See: [openai-python/src/openai/lib/azure.py](https://github.com/openai/openai-python/blob/34014aedbb8946c03e97e5c8d72e03ad2259cd7c/src/openai/lib/azure.py#L328-L331) for full code._ ```python azure_ad_token = self._get_azure_ad_token() if azure_ad_token is not None: if headers.get("Authorization") is None: headers["Authorization"] = f"Bearer {azure_ad_token}" ```

GiteaMirror closed this issue

2026-05-18 02:48:31 -05:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/open-webui#104978