@JDR Thanks for reaching out.
To answer your first query. Yes, your understanding is correct.
In Azure Functions, Environment Variables are set for the Function App, and can be accessed by all the functions within that app. They are set within the ‘Configuration’ tab within Settings on the left pane. They are referred to as ‘Application Settings’.
To answer your second question if you don't want to store credentials in your applications that run in the cloud then you can leverage the managed identity to authenticate your azure openai from function app. For more details from open ai end you can refer to this document. From the function app you can refer to this document.
In case if you don't want to use the managed identity (which should be used in the first case if you don't want to deal with storing the keys) and still want to use the function app configuration to store the keys and you don't have to manual copy paste it then you need to have your custom code/logic to automate it. You can use the Azure REST API to get the keys from open AI value and update it at the function end.
Let me know if you have any queries or concerns.