Feature: Entra authentication for Azure OpenAI provider

In case it can help someone, this is how I do it in the meantime:

model_provider = "azure"
provider = "azure"
model = "<deployment name>"  # Your deployment name, NOT the AI model name

[model_providers.azure]
name         = "Azure OpenAI"
base_url     = "https://<resource>.openai.azure.us/openai/deployments/<deployment name>"
env_key      = "AZURE_OPENAI_API_KEY"
query_params = { api-version = "2025-01-01-preview" }

and then as a token you pass the following:

AZURE_OPENAI_API_KEY=$(az account get-access-token --resource=https://cognitiveservices.azure.com/ --query accessToken --output tsv) \
codex

Thanks for the feedback! We're primarily focused on the native/Rust implementation of Codex CLI. Please try the latest version to see if this is still an issue. If it is, we'd be happy to consider a PR to the codex-rs/ implementation.

In case it can help someone, this is how I do it in the meantime: `` model_provider = "azure" provider = "azure" model = "<deployment name>" # Your deployment name, NOT the AI model name [model_providers.azure] name = "Azure OpenAI" base_url = "https://<resource>.openai.azure.us/openai/deployments/<deployment name>" env_key = "AZURE_OPENAI_API_KEY" query_params = { api-version = "2025-01-01-preview" } ` and then as a token you pass the following: ` AZURE_OPENAI_API_KEY=$(az account get-access-token --resource=https://cognitiveservices.azure.com/ --query accessToken --output tsv) \ codex ``

I cannot get this to work with my deployment using responses https://[resource].openai.azure.com/openai/v1/responses , any tips?

■ unexpected status 401 Unauthorized: Access denied due to invalid subscription key or wrong API endpoint. Make sure to
provide a valid key for an active subscription and use a correct regional API endpoint for your resource., url:...

This works with API_KEY but I get the error when switching to Token auth.

> In case it can help someone, this is how I do it in the meantime: > `` > model_provider = "azure" > provider = "azure" > model = "<deployment name>" # Your deployment name, NOT the AI model name > > [model_providers.azure] > name = "Azure OpenAI" > base_url = "https://<resource>.openai.azure.us/openai/deployments/<deployment name>" > env_key = "AZURE_OPENAI_API_KEY" > query_params = { api-version = "2025-01-01-preview" } > ` > > > > > > > > > > > > and then as a token you pass the following: > ` > AZURE_OPENAI_API_KEY=$(az account get-access-token --resource=https://cognitiveservices.azure.com/ --query accessToken --output tsv) \ > codex > `` I cannot get this to work with my deployment using responses https://[resource].openai.azure.com/openai/v1/responses , any tips? ■ unexpected status 401 Unauthorized: Access denied due to invalid subscription key or wrong API endpoint. Make sure to provide a valid key for an active subscription and use a correct regional API endpoint for your resource., url:... This works with API_KEY but I get the error when switching to Token auth.

UPDATED PROGRESS:

For reasons unknown, using the az cli to provide token in my WSL was not working, I was able to use the python azure-identity library to provide a working token. I added the following lines to my .bashrc:

````
$ export AZURE_OPENAI_API_KEY="$(python3 - <<'PY'
from azure.identity import DefaultAzureCredential
print(DefaultAzureCredential().get_token("https://cognitiveservices.azure.com/.default").token)
PY
)"
$ echo "[bashrc] AZURE_OPENAI_API_KEY set (len=${#AZURE_OPENAI_API_KEY})"

I have the following configuration:

model = "GPT54-GS" # Replace with your actual Azure model deployment name
model_provider = "azure"
model_reasoning_effort = "medium"

[model_providers.azure]
name = "Azure OpenAI"
base_url = "https://<myfoundry>.openai.azure.com/openai/v1" # Replace with your actual Azure foundry name
env_key      = "AZURE_OPENAI_API_KEY"
wire_api = "responses"

which is working when AZURE_OPENAI_API_KEY environment variable has the Azure Foundry key but not when i place the user token as value from the below command:
az account get-access-token --resource=https://cognitiveservices.azure.com/ --query accessToken --output tsv

I have the following configuration: `` model = "GPT54-GS" # Replace with your actual Azure model deployment name model_provider = "azure" model_reasoning_effort = "medium" [model_providers.azure] name = "Azure OpenAI" base_url = "https://<myfoundry>.openai.azure.com/openai/v1" # Replace with your actual Azure foundry name env_key = "AZURE_OPENAI_API_KEY" wire_api = "responses" ` which is working when AZURE_OPENAI_API_KEY environment variable has the Azure Foundry key but not when i place the user token as value from the below command: az account get-access-token --resource=https://cognitiveservices.azure.com/ --query accessToken --output tsv`

I had same issue trying to use az cli to get the token, my fix was to use python azure-identity (https://github.com/openai/codex/issues/1056#issuecomment-4070426232)