Add getBearerToken callback for BYOK providers (Managed Identity)

[SteveSandersonMS]

Summary

Adds an experimental getBearerToken callback to BYOK provider configs so the SDK consumer can resolve bearer tokens (e.g. Azure Managed Identity via the consumer's identity library) on demand. The Copilot SDK takes zero Azure dependency — the consumer fills in the callback with whatever identity library they like. The runtime does no caching — it invokes the callback once per request, so the consumer (or the identity library it wraps) owns caching/refresh. Scope/audience is closed over by the callback and never crosses the wire.

This PR ships the feature across all six SDKs — TypeScript/Node, .NET, Python, Go, Rust, and Java — each with an equivalent three-scenario e2e test.

Usage examples

Each example wires DefaultAzureCredential (Azure Managed Identity) into the callback for the https://cognitiveservices.azure.com/.default scope. The identity library caches/refreshes the underlying token, so calling it per request is cheap.

TypeScript / Node

import { DefaultAzureCredential } from "@azure/identity";
import type { GetBearerToken, ProviderConfig } from "@github/copilot";

const cred = new DefaultAzureCredential();

const provider: ProviderConfig = {
    type: "openai",
    baseUrl,
    getBearerToken: async () => (await cred.getToken()).token,
};

.NET

using Azure.Core;
using Azure.Identity;

var cred = new DefaultAzureCredential();

var provider = new ProviderConfig
{
    Type = "openai",
    BaseUrl = baseUrl,
    GetBearerToken = async args => (await cred.GetTokenAsync()).Token,
};

Python

from azure.identity.aio import DefaultAzureCredential

cred = DefaultAzureCredential()

async def get_bearer_token(args) -> str:
    token = await cred.get_token()
    return token.token

provider = {
    "type": "openai",
    "base_url": base_url,
    "get_bearer_token": get_bearer_token,
}

Go

import (
    "context"
    "github.com/Azure/azure-sdk-for-go/sdk/azcore/policy"
    "github.com/Azure/azure-sdk-for-go/sdk/azidentity"
)

cred, err := azidentity.NewDefaultAzureCredential(nil)
if err != nil {
    return err
}
scope := "https://cognitiveservices.azure.com/.default"

provider := copilot.ProviderConfig{
    Type:    "openai",
    BaseURL: baseURL,
    GetBearerToken: func(args copilot.ProviderTokenArgs) (string, error) {
        tok, err := cred.GetToken(context.Background(), policy.TokenRequestOptions{
            Scopes: []string{scope},
        })
        if err != nil {
            return "", err
        }
        return tok.Token, nil
    },
}

Rust

use std::sync::Arc;
use azure_identity::DefaultAzureCredential;
use copilot::{ProviderConfig, ProviderTokenArgs};

let cred = DefaultAzureCredential::new()?;
let scope = "https://cognitiveservices.azure.com/.default";

let provider = ProviderConfig::new(base_url)
    .with_provider_type("openai")
    .with_get_bearer_token(Arc::new(move |_args: ProviderTokenArgs| {
        let cred = cred.clone();
        async move {
            let token = cred
                .get_token(&[scope])
                .await
                .map_err(|e| BearerTokenError::new(e.to_string()))?;
            Ok(token.token.secret().to_string())
        }
    }));

Java

import com.azure.identity.DefaultAzureCredentialBuilder;
import com.azure.core.credential.TokenRequestContext;

var cred = new DefaultAzureCredentialBuilder().build();
var ctx = new TokenRequestContext().addScopes("https://cognitiveservices.azure.com/.default");

var provider = new ProviderConfig()
    .setType("openai")
    .setBaseUrl(baseUrl)
    .setGetBearerToken(args ->
        cred.getToken(ctx).map(t -> t.getToken()).toFuture());

[SteveSandersonMS]

Thanks — a couple of these points are now moot after a contract simplification pushed since this review ran:

• bearerTokenScope has been removed entirely from the wire contract and from both provider configs. Scope/audience is closed over by the consumer''s getBearerToken callback (e.g. @azure/identity already binds the scope at getToken(scope) time), so it never needs to cross the wire. Point 1 no longer applies to any SDK.
• The runtime now does no token caching — expiresOnTimestamp was also dropped from the wire result; the callback owns caching/refresh.

So the remaining cross-SDK surface is just (2) the getBearerToken callback and (3) the providerToken.acquire server→client handler. This is intentionally Node-first and @experimental; parity for Python/Go/.NET/Java/Rust is planned as follow-up, not part of this PR. I''ll open tracking issues for the other SDKs once the Node + runtime contract lands.

[github-actions]

Cross-SDK Consistency Review ✅

Reviewed the getBearerToken BYOK bearer-token provider feature against all 6 SDK implementations.

Summary

This PR achieves excellent cross-SDK consistency. Notably, the Rust SDK already had a complete implementation of this feature (in rust/src/provider_token.rs, provider_token_dispatch.rs, and integrated into types.rs) — this PR brings the remaining five SDKs up to full parity with Rust.

Consistency checks ✅

Aspect	Node.js	Python	Go	.NET	Java	Rust
getBearerToken on ProviderConfig	✅	✅	✅	✅	✅	✅ (pre-existing)
getBearerToken on NamedProviderConfig	✅	✅	✅	✅	✅	✅ (pre-existing)
RPC method: providerToken.getToken	✅	✅	✅	✅	✅	✅ (pre-existing)
Wire flag: hasBearerTokenProvider	✅	✅	✅	✅	✅	✅ (pre-existing)
Default provider name: "default"	✅	✅	✅	✅	✅	✅ (pre-existing)
ProviderTokenArgs.providerName	✅	✅	✅	✅	✅	✅ (pre-existing)
@experimental marking	✅	✅	✅	✅	✅	✅ (pre-existing)
E2E tests	✅	✅	✅	✅	✅	✅ (pre-existing)

Language-idiomatic differences (expected, not flagged)

• Rust uses Arc<dyn BearerTokenProvider> (trait + impl for closures) instead of a plain function type — required for Send + Sync in async contexts
• Go exposes GetBearerToken error via (string, error) return — idiomatic for Go vs exceptions in other languages
• Java uses a @FunctionalInterface GetBearerToken with getToken(ProviderTokenArgs) — standard Java functional pattern
• .NET uses Func<ProviderTokenArgs, Task<string>> directly (no dedicated delegate type) alongside a BearerTokenProvider.cs for the args type

No cross-SDK inconsistencies found. The feature is fully implemented across all six languages with appropriate language-idiomatic adaptations.

Generated by SDK Consistency Review Agent for issue #1748 · sonnet46 1.8M · ◷