Azure
The gateway speaks Azure OpenAI natively and holds the resource api-key.
| Property | Value |
|---|---|
| Provider id | azure-openai |
| Gateway speaks | Azure OpenAI REST ({resource}.openai.azure.com/openai) |
| Credential | api-key + resource name + deployment id + api version |
| Client base URL | OPENAI_BASE_URL → http://<gateway>:8787/v1 |
Configure the provider
Console → Providers → add azure-openai:
- API key. Your Azure OpenAI resource key
- Resource name. The resource subdomain (
{resource}.openai.azure.com) - Deployment ID. The deployment to target
- API version. For example
2024-02-01
Or seed it from the environment with ANYRAY_PROVIDER_KEY_AZURE_OPENAI. The console form covers
static api-key auth. A request can send its own Entra client credentials in headers.
With a stored key, the resource is the stored one. A request's resource name applies on its own
credentials when no key is stored, or on pass-through.
Managed and workload identity belong to the gateway, so only the operator sets them: put
azureAuthMode (and azureManagedClientId for a user-assigned identity) on the stored key with
PUT /admin/provider-keys. A request that names either mode, or a managed or workload client id,
gets a 400. An Entra app on the stored key also belongs to the gateway: its token uses the stored
tenant and client id, whatever the request names.
The gateway mints a token only for the host it calls. Any other host gets a 424, and no token is fetched.
| Host | Token for |
|---|---|
*.openai.azure.com, *.cognitiveservices.azure.com, *.services.ai.azure.com | Azure AI services |
*.blob.core.windows.net | Azure Storage (a batch's output file) |
Route requests to it
export OPENAI_BASE_URL=http://<gateway>:8787/v1
# requests carry: x-anyray-provider: azure-openai
Managed identity on the stored key (PUT /admin/provider-keys body):
{ "azure-openai": { "resourceName": "my-resource", "deploymentId": "my-deployment",
"apiVersion": "2024-02-01", "azureAuthMode": "managed" } }
Azure addresses models by deployment id, not a catalog model name, so there's no fixed model list; you call whatever you've deployed in your resource.