[codex] add azure openai keyless example

README.md

@@ -11,6 +11,7 @@ Example applications demonstrating how to integrate AI agents with [Archestra Pl
 - **[openclaw](./openclaw)** - OpenClaw personal AI agent proxied through Archestra for security and observability
 - **[model-router-user-oauth](./model-router-user-oauth)** - Public OAuth app that calls the OpenAI-compatible Model Router as the signed-in user
 - **[model-router-client-credentials](./model-router-client-credentials)** - Service-to-service OAuth client credentials app for the OpenAI-compatible Model Router
+- **[azure-openai-keyless](./azure-openai-keyless)** - Azure OpenAI call using Microsoft Entra ID instead of an API key
 - **[dummy_email_mcp_server](./dummy_email_mcp_server)** - Simple MCP server for testing email tool scenarios
 
 ## Documentation

azure-openai-keyless/.env.example

@@ -0,0 +1,7 @@
+# Deployment URL mode:
+# AZURE_OPENAI_BASE_URL=https://<resource-name>.openai.azure.com/openai/deployments/<deployment-name>
+
+# Foundry v1 mode:
+AZURE_OPENAI_BASE_URL=https://<resource-name>.services.ai.azure.com/openai/v1
+AZURE_OPENAI_API_VERSION=2024-02-01
+AZURE_OPENAI_MODEL=<deployment-name>

azure-openai-keyless/.gitignore

@@ -0,0 +1,2 @@
+.env
+node_modules/

azure-openai-keyless/README.md

@@ -0,0 +1,60 @@
+# Azure OpenAI Keyless Example
+
+This example calls Azure OpenAI with Microsoft Entra ID instead of an API key. It uses Azure Identity `DefaultAzureCredential`, so the same code can use Azure CLI credentials locally or managed identity in Azure-hosted environments.
+
+## Prerequisites
+
+- Azure CLI signed in with `az login`
+- A role on the Azure OpenAI resource that can invoke deployments, such as `Cognitive Services OpenAI User`
+- An Azure OpenAI deployment
+
+## Run
+
+1. Copy the environment file:
+
+   ```sh
+   cp .env.example .env
+   ```
+
+2. Fill in:
+
+   ```sh
+   AZURE_OPENAI_BASE_URL=https://<resource-name>.openai.azure.com/openai/deployments/<deployment-name>
+   AZURE_OPENAI_API_VERSION=2024-02-01
+   AZURE_OPENAI_MODEL=<deployment-name>
+   ```
+
+   For the Foundry v1 endpoint, use:
+
+   ```sh
+   AZURE_OPENAI_BASE_URL=https://<resource-name>.services.ai.azure.com/openai/v1
+   AZURE_OPENAI_MODEL=<deployment-name>
+   ```
+
+3. Install dependencies and run:
+
+   ```sh
+   npm install
+   npm start
+   ```
+
+The script prints the model response. With the default prompt, a successful run prints `ok`.
+
+## Archestra Configuration
+
+Use the same deployment URL in Archestra:
+
+```sh
+ARCHESTRA_AZURE_OPENAI_BASE_URL=https://<resource-name>.openai.azure.com/openai/deployments/<deployment-name>
+ARCHESTRA_AZURE_OPENAI_API_VERSION=2024-02-01
+ARCHESTRA_AZURE_OPENAI_ENTRA_ID_ENABLED=true
+```
+
+For Foundry v1, use:
+
+```sh
+ARCHESTRA_AZURE_OPENAI_BASE_URL=https://<resource-name>.services.ai.azure.com/openai/v1
+ARCHESTRA_AZURE_OPENAI_ENTRA_ID_ENABLED=true
+```
+
+Deployment URLs use the token scope `https://cognitiveservices.azure.com/.default`. Foundry v1 URLs use `https://ai.azure.com/.default`.