Repository navigation
[awf] api-proxy: add OIDC authentication support for BYOK model provider (engine.auth) #2667
Description
Problem
BYOK mode requires static credentials via COPILOT_PROVIDER_API_KEY or COPILOT_PROVIDER_BEARER_TOKEN. This blocks Azure OpenAI deployments configured for Entra-only authentication (API keys disabled), which is the Microsoft-recommended security posture.
Context
Original request: github/gh-aw#30260
The MCP Gateway already supports OIDC via auth: { type: github-oidc }. Parity is needed in the api-proxy sidecar.
Root Cause
containers/api-proxy/ only supports injecting static bearer tokens or API keys into upstream requests. There is no mechanism to fetch a short-lived OIDC token from the GitHub Actions OIDC endpoint and use it as the Authorization: Bearer value for the upstream provider.
Proposed Solution
Add an engine.auth.type: github-oidc option to the api-proxy sidecar configuration. On each upstream request, the sidecar should:
- Request an OIDC token from
ACTIONS_ID_TOKEN_REQUEST_URLusingACTIONS_ID_TOKEN_REQUEST_TOKEN. - Set
Authorization: Bearer <oidc-token>on the forwarded request.
Mirror the implementation already present in the MCP gateway (gh-aw-mcpg).
Generated by Firewall Issue Dispatcher · ● 1.2M · ◷
Activity
github-actions commentedon May 7, 2026
👋 Hello! I noticed this issue might be related to an existing issue:
Both issues describe the same problem: the api-proxy sidecar only supports static API keys, blocking Azure OpenAI deployments with Entra-only authentication. Both propose adding
engine.auth.type: github-oidcsupport usingACTIONS_ID_TOKEN_REQUEST_URL/ACTIONS_ID_TOKEN_REQUEST_TOKEN.Since #2544 was closed as completed, this implementation may already be done. Please check if the fix from #2544 addresses your concern, or clarify how this issue differs.
This is an automated message from the issue duplication detector.
lpcox commentedon May 7, 2026
Implemented in PR #2599 (commit e26e9de):
feat(api-proxy): OIDC authentication for Azure OpenAI (Entra-only). Documentation added in PR #2612. The api-proxy sidecar now supports OIDC token acquisition for providers configured withengine.auth.