Skip to content

Conversation

@slister1001
Copy link
Member

Add support for TokenCredential in AzureOpenAIModelConfiguration to enable AAD authentication that works in Azure Container Apps (ACA) environments where DefaultAzureCredential doesn't have access to customer resources.

Changes:

  • Add credential field to AzureOpenAIModelConfiguration TypedDict
  • Add _create_token_provider() to create callable token providers from TokenCredential objects (PyRIT's OpenAIChatTarget accepts api_key as either string or callable)
  • Update get_chat_target() to use credential when api_key not provided
  • Remove invalid api_version parameter from OpenAIChatTarget calls (PyRIT handles this via endpoint URL format)
  • Raise clear error when neither api_key nor credential is provided

Description

Please add an informative description that covers that changes made by the pull request and link all relevant issues.

If an SDK is being regenerated based on a new API spec, a link to the pull request containing these API spec changes should be included above.

All SDK Contribution checklist:

  • The pull request does not introduce [breaking changes]
  • CHANGELOG is updated for new features, bug fixes or other significant changes.
  • I have read the contribution guidelines.

General Guidelines and Best Practices

  • Title of the pull request is clear and informative.
  • There are a small number of commits, each of which have an informative message. This means that previously merged commits do not appear in the history of the PR. For more information on cleaning up the commits in your PR, see this page.

Testing Guidelines

  • Pull request includes test coverage for the included changes.

@github-actions github-actions bot added the Evaluation Issues related to the client library for Azure AI Evaluation label Jan 12, 2026
@slister1001 slister1001 force-pushed the fix/aad-auth-token-credential branch from 88b8d82 to 9f4f637 Compare January 12, 2026 20:49
Add support for TokenCredential in AzureOpenAIModelConfiguration to enable
AAD authentication that works in Azure Container Apps (ACA) environments
where DefaultAzureCredential doesn't have access to customer resources.

Changes:
- Add credential field to AzureOpenAIModelConfiguration TypedDict
- Add _create_token_provider() to create callable token providers from
  TokenCredential objects (PyRIT's OpenAIChatTarget accepts api_key as
  either string or callable)
- Update get_chat_target() to use credential when api_key not provided
- Remove invalid api_version parameter from OpenAIChatTarget calls
  (PyRIT handles this via endpoint URL format)
- Raise clear error when neither api_key nor credential is provided
@slister1001 slister1001 force-pushed the fix/aad-auth-token-credential branch from 9f4f637 to abffbb4 Compare January 12, 2026 20:50
@github-actions
Copy link

API Change Check

APIView identified API level changes in this PR and created the following API reviews

azure-ai-evaluation

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Evaluation Issues related to the client library for Azure AI Evaluation

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant