[awf] API Proxy: BYOK Azure OpenAI routing fails with 404/401 across base URL variants

[lpcox]

Problem

Users routing BYOK (Bring Your Own Key) Azure OpenAI requests through the AWF API proxy sidecar consistently receive HTTP 404 or HTTP 401 regardless of COPILOT_PROVIDER_BASE_URL format used — with or without COPILOT_PROVIDER_TYPE: azure.

Context

Original issue: github/gh-aw#35483

The user tested four URL formats (with/without deployment path, with/without trailing slash) and two provider configs. All combinations fail. The API proxy sidecar (containers/api-proxy/) is responsible for injecting credentials and forwarding to Squid.

Root Cause

The Azure OpenAI API requires the full deployment path in the URL (/openai/deployments/{deployment}/chat/completions?api-version=...). The AWF API proxy likely strips, rewrites, or misroutes these path segments when constructing the upstream request, causing 404. The 401 responses suggest the api-key header is not being injected correctly for Azure-type providers (which use api-key header, not Authorization: Bearer).

Proposed Solution

1. In containers/api-proxy/, detect COPILOT_PROVIDER_TYPE=azure and switch credential injection from Authorization: Bearer to the api-key header.
2. Preserve the full request path and query string when proxying to Azure endpoints.
3. Add an integration test covering BYOK Azure routing through the proxy sidecar.

Generated by Firewall Issue Dispatcher · sonnet46 2.1M · ◷

[github-actions]

👋 Hello! I noticed this issue appears to be a duplicate of several existing issues that describe the same BYOK Azure OpenAI routing failures (404/401) in the AWF API proxy:

• [awf] api-proxy: BYOK Azure OpenAI routing fails with 404 or 401 across base URL variants #4018 — [awf] api-proxy: BYOK Azure OpenAI routing fails with 404 or 401 across base URL variants (closed as completed)
• [awf] API Proxy: BYOK Azure OpenAI routing fails with 404 or 401 #4111 — [awf] API Proxy: BYOK Azure OpenAI routing fails with 404 or 401 (closed as completed)
• [awf] api-proxy: Azure OpenAI BYOK routing fails with 404/401 due to wrong auth header and URL construction #4220 — [awf] api-proxy: Azure OpenAI BYOK routing fails with 404/401 due to wrong auth header and URL construction (closed as completed)
• [awf] api-proxy: BYOK Azure OpenAI routing fails with 404/401 due to missing Azure-specific path and auth handling #4269 — [awf] api-proxy: BYOK Azure OpenAI routing fails with 404/401 due to missing Azure-specific path and auth handling (closed as completed)

All four describe the same root causes: the api-proxy injecting Authorization: Bearer instead of the Azure-required api-key header, and incorrect URL path construction for Azure deployment endpoints.

There is also a closely related open issue worth reviewing:

• api-proxy: BYOK session_id body injection breaks Azure OpenAI /responses with HTTP 400 #4339 — api-proxy: BYOK session_id body injection breaks Azure OpenAI /responses with HTTP 400 (open) — a related but distinct BYOK Azure failure (body injection causing HTTP 400 rather than auth/routing failures).

Since #4018, #4111, #4220, and #4269 were all closed as completed, it may be worth checking whether the fixes landed correctly, or if this is a regression. If the problem persists after the fixes from those issues, please note that in this issue — that context will help distinguish this from a true duplicate.

This is an automated message from the issue duplication detector.

Generated by Issue Duplication Detector for issue #4366 · sonnet46 864.9K · ◷

[lpcox]

Addressed by the following merged PRs:

• fix(api-proxy): use api-key header for Azure OpenAI BYOK requests #4295 — fix(api-proxy): use api-key header for Azure OpenAI BYOK requests (fixes 401 by switching from Authorization: Bearer to api-key header when providerType=azure)
• Add AWF config support for model-router provider settings #4312 — Add AWF config support for model-router provider settings (adds apiProxy.modelRouter.providerType and apiProxy.modelRouter.baseUrl config fields for proper Azure routing)
• [awf] Support Azure Copilot BYOK env routing in api-proxy and resolve gpt-5.4 via gpt-5 family aliases #3241 — Support Azure Copilot BYOK env routing in api-proxy (foundational Azure BYOK support)

Both proposed fixes from this issue are now implemented:

1. ✅ Credential injection switches to api-key header for Azure providers
2. ✅ Full request path preserved via baseUrl/basePath config