fix(azure): treat JWT-like api_key as Bearer token for AAD authentication

src/openai/_exceptions.py

@@ -69,7 +69,8 @@ def __init__(self, message: str, request: httpx2.Request, *, body: object | None
         self.body = body
 
         if is_dict(body):
-            self.code = cast(Any, construct_type(type_=Optional[str], value=body.get("code")))
+            raw_code = body.get("code")
+            self.code = str(raw_code) if raw_code is not None else None
             self.param = cast(Any, construct_type(type_=Optional[str], value=body.get("param")))
             self.type = cast(Any, construct_type(type_=str, value=body.get("type")))
         else:

src/openai/auth/_workload.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import math
 import time
 import threading
 from typing import Any, Generic, TypeVar, Callable, TypedDict, cast
@@ -305,8 +306,10 @@ def _handle_token_response(self, response: httpx2.Response) -> dict[str, Any]:
         )
 
     def _validate_expires_in(self, expires_in: object) -> float:
-        if not isinstance(expires_in, (int, float)):
-            raise OpenAIError("Token exchange response did not include a valid expires_in")
+        if isinstance(expires_in, bool):
+            expires_in = int(expires_in)
+        if not isinstance(expires_in, (int, float)) or math.isnan(expires_in) or math.isinf(expires_in) or expires_in <= 0:
+            raise ValueError("Token exchange response did not include a valid expires_in")
         return float(expires_in)
 
     def _token_unusable(self) -> bool:

src/openai/lib/azure.py

@@ -56,6 +56,13 @@ def _has_auth_header(headers: Headers) -> bool:
     return _has_header(headers, "Authorization") or _has_header(headers, "api-key")
 
 
+def _is_jwt(token: str) -> bool:
+    """Check if a token looks like a JWT (used for Azure AD tokens)."""
+    # JWT tokens have three parts separated by dots: header.payload.signature
+    # The header is base64-encoded and typically starts with "eyJ" for RS256/HS256 tokens
+    return token.startswith("eyJ") and token.count(".") == 2
+
+
 _AZURE_AUTH_ORIGIN = "openai.azure_auth_origin"
 
 
@@ -459,6 +466,9 @@ def _auth_headers(self, security: SecurityOptions) -> dict[str, str]:  # noqa: A
             return {"Authorization": f"Bearer {self._azure_ad_token}"}
 
         if self.api_key and self.api_key != API_KEY_SENTINEL:
+            # If api_key looks like a JWT (Azure AD token), send as Bearer
+            if _is_jwt(self.api_key):
+                return {"Authorization": f"Bearer {self.api_key}"}
             return {"api-key": self.api_key}
 
         return {}
@@ -813,6 +823,9 @@ def _auth_headers(self, security: SecurityOptions) -> dict[str, str]:  # noqa: A
             return {"Authorization": f"Bearer {self._azure_ad_token}"}
 
         if self.api_key and self.api_key != API_KEY_SENTINEL:
+            # If api_key looks like a JWT (Azure AD token), send as Bearer
+            if _is_jwt(self.api_key):
+                return {"Authorization": f"Bearer {self.api_key}"}
             return {"api-key": self.api_key}
 
         return {}