Skip to content

Support the Azure default credential chain for Azure OpenAI authentication #10764

Description

@lostmygithubaccount

What variant of Codex are you using?

CLI, App

What feature would you like to see?

I would like to see an option for the Codex CLI (and now App) to work with the Azure default credential chain. This would allow users to simply az login, setup their $HOME/.codex/config.toml to something like:

model = "gpt-5.2-codex"
model_reasoning_effort = "medium"
personality = "pragmatic"

model_provider = "azure"

[model_providers.azure]
name = "Azure OpenAI"
base_url = "https://<YOUR-FOUNDRY-RESOURCE>.openai.azure.com/openai/v1"
azure_auth = "default_credential"
wire_api = "responses"

and for Codex to "just work".

Additional information

My primary motivation is that as far as I can tell, Microsoft Foundry only allows you to have one API key. For my engineering team, we don't want to share, and would rather use Entra ID auth per-user with permissions managed like that. Claude Code already supports this and we're using it this way: https://code.claude.com/docs/en/microsoft-foundry#2-configure-azure-credentials

This should also be very straightforward using the Azure identity Rust crate. Happy to contribute this myself -- I understand the domain well (former Azure employee & decent at Rust).

Metadata

Metadata

Assignees

No one assigned

    Labels

    CLIIssues related to the Codex CLIauthIssues related to authentication and accountsazureIssues related to the Azure-hosted OpenAI modelsenhancementNew feature or request

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions