Langroid Files

Rotating / short-lived API keys (Vertex AI, Azure Entra ID)

OpenAIGPTConfig now supports endpoints that authenticate with short-lived, rotating bearer tokens — e.g. Google Vertex AI (OAuth/ADC tokens, ~1h TTL) or Azure OpenAI with Entra ID — via the new api_key_provider field: a callable returning a currently-valid token.

:::python
import langroid.language_models as lm

config = lm.OpenAIGPTConfig(
    chat_model="google/gemini-2.5-flash",
    api_base="https://aiplatform.googleapis.com/v1beta1/projects/<proj>"
             "/locations/global/endpoints/openapi",
    api_key_provider=get_token,   # () -> str, called before every request
)

• Resolved per request (including retries and streaming) — tokens never go stale, no matter how long the process runs. Works for both chat and achat; a blocking token refresh never stalls the event loop.
• Client cache stays bounded: clients are cached by the provider's identity, never by token values — rotating tokens create no new cache entries, and tokens are never retained in cache keys.
• Takes precedence over api_key / OPENAI_API_KEY; raises a clear error for groq/, cerebras/, and litellm-adapter models (OpenAI-client path only).
• For transport-level control (e.g. request signing), the http_client_factory + httpx.Auth pattern is documented as an alternative, along with an Azure Entra ID recipe.

📖 Docs: Rotating / Short-Lived API Keys

Note: the openai dependency floor is now >=1.106.0 (the first version with callable-API-key support); older SDKs would send the callable verbatim in the auth header.

PR [#1081], closes [#1080].