How to manage API Keys for Azure AI Foundry projects

Question

On the start page of https://ai.azure.com or in each model deployment you can copy an API key.

I have not found any way whatsoever to manage this API key. I asked the AI help bot and only got a broken link to '/manage/api-keys'. I cannot found anything in the UX.

Even if it's not possible to manage multiple API keys like in other products, surely there must at least be a way to rotate the API key? What if it gets compromised? The Azure portal for the resource also has only the hardcoded endpoint and no sight of where the API key comes from (the Security section only has an entry for Cloud Defender). We need to have at least a plan for this but cannot find anything in the UI, documentation or AI chat support.

Answer 1

Hi GD-2997

Thank you for inputs on rotating keys here from model endpoints in Foundry here.

Regarding rotation of keys for foundry models

Re-generation/Rotation is of keys allowed with Azure Account owner role.

Got the working commands here

Please use Foundry name/hub name (no project name) to list and re-generate key

To list Key

az cognitiveservices account keys list  --name testfoundrymodel23 --resource-group AprilRG

To rotate the keys

az login --identity 
az cognitiveservices account keys regenerate --name <usefoundryhubname> --resource-group AprilRG --key-name key2 

#you can use key1 too instead of key2

Verify the rotated key from overview page.

Attached screenshot for your confidence

Other Options

1. If those are GPT models, you can regenerate the keys from resource management tab in Azure OpenAI resources instead.
2. For Foundry models, you can also opt for Entra authentication/Service Principal Authentication. Entra authentication provides a token for authentication which changes once in a while. Permission Minimum Cognitive Services user (for OpenAI models)/ Azure AI User is needed for user to do inference call RBAC documentation/

Sample Entra code for usage can be foundry from model/deployment tabs

export AZURE_CLIENT_ID="<AZURE_CLIENT_ID>"
export AZURE_TENANT_ID="<AZURE_TENANT_ID>"
export AZURE_CLIENT_SECRET="<AZURE_CLIENT_SECRET>"

import os
from openai import AzureOpenAI
from azure.identity import DefaultAzureCredential, get_bearer_token_provider

endpoint = "https://<project name>.cognitiveservices.azure.com/"                                           model_name = "gpt-4.1-mini"
deployment = "gpt-4.1-mini"
token_provider = get_bearer_token_provider(DefaultAzureCredential(), "https://cognitiveservices.azure.com/.default")
api_version = "2024-12-01-preview"

client = AzureOpenAI(
    api_version=api_version,
    azure_endpoint=endpoint,
    azure_ad_token_provider=token_provider,
)

response = client.chat.completions.create(
    messages=[
        {
            "role": "system",
            "content": "You are a helpful assistant.",
        },
        {
            "role": "user",
            "content": "I am going to Paris, what should I see?",
        }
    ],
    max_completion_tokens=13107,
    temperature=1.0,
    top_p=1.0,
    frequency_penalty=0.0,
    presence_penalty=0.0,
    model=deployment
)

print(response.choices[0].message.content)

Reference used

Entra based authentication

Authentication and Authorization

Built in roles in Foundry (For roles and authentication)

Disable key based authentication

Thank you for your inputs on forum.