Fix/OpenAI sdk api key azure

[dylanwe]

Hey Spring Team!

I've been using the Open AI SDK for a bit and I noticed that the wrong credentials are used for Azure during auto-configuration. When doing the following in my project:

spring:
  application:
    name: spring-ai
  ai:
    openai-sdk:
      api-key: ${GEN_AI_KEY}
      base-url: https://example/openai/v1
      chat:
        options:
          model: gpt-51
        microsoft-foundry: true

The key is set within the Authorization header but Azure expects it to be set within the api-key header when using an API key and not passwordless auth.

I suggest that when Azure is used and an API key is set we add the AzureApiKeyCredential.

[jdubois]

I've add a look at your comment on ticket #3368 and I believe you are correct, when a key is provided.
Be careful for passwordless: this should still work, when no key is set up.
So I think this should be merged, but the code is starting to be quite complex so I'd like to have some test coverage for this, how about something in OpenAiSdkSetupTests like:

	@Test
	void setupSyncClient_usesApiKeyHeader_notBearerToken_forMicrosoftFoundry() throws Exception {
		OpenAIClient client = OpenAiSdkSetup.setupSyncClient("https://my-resource.openai.azure.com/", "my-foundry-key",
				null, null, null, null, true, false, null, Duration.ofSeconds(30), 2, null, null);

		Field field = client.getClass().getDeclaredField("clientOptions");
		field.setAccessible(true);
		ClientOptions options = (ClientOptions) field.get(client);
		assertInstanceOf(AzureApiKeyCredential.class, options.credential());
		assertThat(options.headers().values("api-key")).containsExactly("my-foundry-key");
		assertThat(options.headers().values("Authorization")).isEmpty();
	}

[dylanwe]

I've add a look at your comment on ticket #3368 and I believe you are correct, when a key is provided. Be careful for passwordless: this should still work, when no key is set up. So I think this should be merged, but the code is starting to be quite complex so I'd like to have some test coverage for this, how about something in OpenAiSdkSetupTests like:

	@Test
	void setupSyncClient_usesApiKeyHeader_notBearerToken_forMicrosoftFoundry() throws Exception {
		OpenAIClient client = OpenAiSdkSetup.setupSyncClient("https://my-resource.openai.azure.com/", "my-foundry-key",
				null, null, null, null, true, false, null, Duration.ofSeconds(30), 2, null, null);

		Field field = client.getClass().getDeclaredField("clientOptions");
		field.setAccessible(true);
		ClientOptions options = (ClientOptions) field.get(client);
		assertInstanceOf(AzureApiKeyCredential.class, options.credential());
		assertThat(options.headers().values("api-key")).containsExactly("my-foundry-key");
		assertThat(options.headers().values("Authorization")).isEmpty();
	}

Thanks for the review and suggestion. I've updated the PR to include the test.

[ilayaperumalg]

@dylanwe Thanks for the PR! Could you rebase and squash the commits? I am not sure why the commit f8c6c40 is part of this PR

[dylanwe]

@dylanwe Thanks for the PR! Could you rebase and squash the commits? I am not sure why the commit f8c6c40 is part of this PR

@ilayaperumalg oops don't know how that happened, my bad. I've squashed my commits into one.

[ilayaperumalg]

@dylanwe Thanks for the update! Rebased and merged as 0b142aa