Repository navigation
[awf] api-proxy: add OIDC authentication support for BYOK model providers (Azure Entra) #2805
Description
Problem
The AWF api-proxy BYOK mode only supports static credentials (COPILOT_PROVIDER_API_KEY / COPILOT_PROVIDER_BEARER_TOKEN). Azure OpenAI deployments with API key authentication disabled (Entra-only / managed identity) cannot be used because there is no static key — authentication requires short-lived Azure AD tokens via OIDC federation.
Context
Original issue: github/gh-aw#30260
Root Cause
containers/api-proxy/providers/copilot.js reads the provider API key from the environment and injects it as a static Authorization header. There is no mechanism to acquire a token at request time using OIDC (ACTIONS_ID_TOKEN_REQUEST_URL / ACTIONS_ID_TOKEN_REQUEST_TOKEN).
Proposed Solution
Add an engine.auth configuration option (e.g. type: github-oidc, audience: <azure-resource>) mirroring what the MCP Gateway implements. In containers/api-proxy/providers/copilot.js, when OIDC auth is configured, fetch a fresh OIDC token per request using ACTIONS_ID_TOKEN_REQUEST_URL and exchange it for an Azure AD access token, then inject as the Authorization: Bearer header. Follow the pattern already established in gh-aw-mcpg PR #2878.
Generated by Firewall Issue Dispatcher · ● 876.2K · ◷
Activity
github-actions commentedon May 9, 2026
👋 Hello! I noticed this issue might be related to existing issues:
These issues describe the same problem: adding OIDC-based authentication support to the api-proxy for BYOK model providers (Azure Entra / managed identity). If one of these already addresses your concern, please consider closing this issue as a duplicate. Otherwise, feel free to clarify how your issue differs!
This is an automated message from the issue duplication detector.
lpcox commentedon May 9, 2026
Resolved by PR #2772 which added multi-provider OIDC authentication support (Azure Entra, AWS STS, GCP). The api-proxy now supports
apiProxy.auth.providerconfiguration withgithub-oidc,aws, andgcpproviders for short-lived token-based authentication with BYOK model providers.