langroid

Rotating / short-lived API keys (Vertex AI, Azure Entra ID)

OpenAIGPTConfig now supports endpoints that authenticate with short-lived,
rotating bearer tokens — e.g. Google Vertex AI (OAuth/ADC tokens, ~1h TTL) or
Azure OpenAI with Entra ID — via the new api_key_provider field: a callable
returning a currently-valid token.

import langroid.language_models as lm

config = lm.OpenAIGPTConfig(
    chat_model="google/gemini-2.5-flash",
    api_base="https://aiplatform.googleapis.com/v1beta1/projects/<proj>"
             "/locations/global/endpoints/openapi",
    api_key_provider=get_token,   # () -> str, called before every request
)

• Resolved per request (including retries and streaming) — tokens never go
  stale, no matter how long the process runs. Works for both chat and
  achat; a blocking token refresh never stalls the event loop.
• Client cache stays bounded: clients are cached by the provider's
  identity, never by token values — rotating tokens create no new cache
  entries, and tokens are never retained in cache keys.
• Takes precedence over api_key / OPENAI_API_KEY; raises a clear error for
  groq/, cerebras/, and litellm-adapter models (OpenAI-client path only).
• For transport-level control (e.g. request signing), the
  http_client_factory + httpx.Auth pattern is documented as an
  alternative, along with an Azure Entra ID recipe.

📖 Docs: Rotating / Short-Lived API Keys

Note: the openai dependency floor is now >=1.106.0 (the first version
with callable-API-key support); older SDKs would send the callable verbatim in
the auth header.

PR #1081, closes #1080.