openai api behind Oauth2?

[tamis-laan]

I'm working on a project where we have openai protected behind a Oauth2 endpoint. Which works like a proxy, it recieves api calls we need to authenticate with oauth2 and then the requests are forwarded to I believe Azure openai.

I would like to use the official openai python client instead of writting my own httpx wrapper around the api. So I basically need to override the OpenAI class and implement my own authentication flow.

Can someone tell me how to do this? Which methods should I override? Are there examples of this I can use as reference? All help would be appreciated.

[manimovassagh]

You can do this without subclassing by using the http_client parameter with a custom httpx client that handles OAuth2 token injection.

Here's a clean approach:

import httpx
from openai import OpenAI

class OAuth2Auth(httpx.Auth):
    def __init__(self, token_url, client_id, client_secret):
        self.token_url = token_url
        self.client_id = client_id
        self.client_secret = client_secret
        self._token = None

    def auth_flow(self, request):
        if not self._token:
            self._fetch_token()
        request.headers["Authorization"] = f"Bearer {self._token}"
        yield request

    def _fetch_token(self):
        resp = httpx.post(
            self.token_url,
            data={
                "grant_type": "client_credentials",
                "client_id": self.client_id,
                "client_secret": self.client_secret,
            },
        )
        resp.raise_for_status()
        self._token = resp.json()["access_token"]


auth = OAuth2Auth(
    token_url="https://your-idp.com/oauth/token",
    client_id="your-client-id",
    client_secret="your-client-secret",
)

http_client = httpx.Client(auth=auth)

client = OpenAI(
    base_url="https://your-proxy-endpoint.com/v1",
    api_key="unused",  # set to any string; your proxy handles real auth
    http_client=http_client,
)

# Now use it normally
response = client.chat.completions.create(
    model="gpt-4",
    messages=[{"role": "user", "content": "Hello"}],
)

Key points:

• httpx.Auth hooks into every request to inject/refresh the OAuth2 token automatically
• base_url points to your proxy instead of api.openai.com
• Set api_key to any non-empty string (the SDK requires it but your proxy ignores it)
• For token refresh, add expiry tracking in auth_flow and re-fetch when the token expires

If your proxy expects the OpenAI API key in addition to the OAuth2 token, keep api_key set to your real key and use a different header name for OAuth2 in your custom auth class.

[Bahtya]

Using the OpenAI client with a custom OAuth2 proxy

You can achieve this with httpx event hooks or by passing a custom httpx.Auth instance. Here are two approaches:

Approach 1: Custom httpx.Auth class (recommended)

The OpenAI Python client uses httpx under the hood. You can inject a custom auth handler:

import httpx
from openai import OpenAI

class OAuth2Auth(httpx.Auth):
    def __init__(self, token_url: str, client_id: str, client_secret: str):
        self.token_url = token_url
        self.client_id = client_id
        self.client_secret = client_secret
        self._token: str | None = None

    def auth_flow(self, request: httpx.Request):
        if self._token is None:
            # Fetch OAuth2 token
            response = httpx.post(
                self.token_url,
                data={
                    "grant_type": "client_credentials",
                    "client_id": self.client_id,
                    "client_secret": self.client_secret,
                },
            )
            response.raise_for_status()
            self._token = response.json()["access_token"]

        request.headers["Authorization"] = f"Bearer {self._token}"
        yield request

# Use it
auth = OAuth2Auth(
    token_url="https://your-oauth-server/token",
    client_id="your-client-id",
    client_secret="your-client-secret",
)

client = OpenAI(
    base_url="https://your-proxy.example.com/v1",
    api_key="not-needed",  # Required by the client but auth is handled by OAuth2
    http_client=httpx.Client(auth=auth),
)

response = client.chat.completions.create(
    model="gpt-4o",
    messages=[{"role": "user", "content": "Hello!"}],
)

Approach 2: Use AzureOpenAI client with custom endpoint

If your proxy forwards to Azure OpenAI, you might be able to use the built-in Azure support:

from openai import AzureOpenAI

client = AzureOpenAI(
    azure_endpoint="https://your-proxy.example.com",
    api_version="2024-02-01",
    api_key="your-azure-key",  # Or use DefaultAzureCredential
)

Key points

• Set base_url to your proxy URL
• Pass a custom httpx.Client with your auth handler via http_client
• The api_key parameter is still required by the constructor but your proxy can ignore it if OAuth2 handles auth
• The auth_flow method handles token refresh if the server returns 401 (you can add retry logic)