Currently, the com.azure:azure-ai-agents:2.0.1 SDK enforces a Bearer token–based authentication model via TokenCredential.
However, when using Azure API Management (APIM) in front of Azure OpenAI/Agents endpoints, authentication is commonly handled using API Key headers (e.g., x-api-key), not Bearer tokens.
At the moment, there is no first-class support to pass API key–based credentials. Even when attempting to override the pipeline manually (as shown below), the SDK still expects a credential and does not provide a clean or supported way to use API key authentication.
val builder = AgentsClientBuilder()
builder.endpoint(baseUrl)
builder.httpLogOptions(HttpLogOptions().setLogLevel(HttpLogDetailLevel.BODY_AND_HEADERS))
val httpClient = HttpClient.createDefault()
val headers = HttpHeaders()
headers.set(credentials.keyName, credentials.keyValue)
val pipeline = HttpPipelineBuilder()
.policies(AddHeadersPolicy(headers))
.httpClient(httpClient)
.build()
builder.pipeline(pipeline)
// Forced workaround
builder.credential(null)
val client = builder.buildAgentsClient()
This approach is fragile and not officially supported, making integration with APIM cumbersome.
Describe the solution
For example:
Add a method like:
builder.apiKeyCredential(ApiKeyCredential("key-name", "key-value"))
Alternatively, allow:
Custom headers to be injected without requiring TokenCredential
A dedicated AzureApiKeyCredential or similar abstraction
This would make it seamless to integrate with Azure APIM endpoints.
Currently, the com.azure:azure-ai-agents:2.0.1 SDK enforces a Bearer token–based authentication model via TokenCredential.
However, when using Azure API Management (APIM) in front of Azure OpenAI/Agents endpoints, authentication is commonly handled using API Key headers (e.g., x-api-key), not Bearer tokens.
At the moment, there is no first-class support to pass API key–based credentials. Even when attempting to override the pipeline manually (as shown below), the SDK still expects a credential and does not provide a clean or supported way to use API key authentication.
This approach is fragile and not officially supported, making integration with APIM cumbersome.
Describe the solution
For example:
Add a method like:
Alternatively, allow:
Custom headers to be injected without requiring TokenCredential
A dedicated AzureApiKeyCredential or similar abstraction
This would make it seamless to integrate with Azure APIM endpoints.