Address PR review comments

tests/providers/test_azure_openai_provider.py

@@ -93,10 +93,57 @@ def test_init_missing_key_uses_aad_token_provider(monkeypatch):
     assert isinstance(provider._token_provider, _AzureTokenProvider)
     # DefaultAzureCredential must have been instantiated exactly once
     credential_factory.assert_called_once_with()
-    # The SDK client must have received the token provider as its api_key
-    # (the SDK stores it on the auth wrapper, not directly accessible — so
-    # we assert the callable was wired in via the provider attribute).
     assert provider._token_provider._credential is credential_instance
+    # The token provider must be wired into the OpenAI SDK as its
+    # ``_api_key_provider`` callable — that's what the SDK invokes per
+    # request to refresh the bearer token.
+    assert provider._client._api_key_provider is provider._token_provider
+    # Static api_key starts empty until the first refresh.
+    assert provider._client.api_key == ""
+
+
+@pytest.mark.asyncio
+async def test_aad_token_provider_wires_into_sdk_auth_headers(monkeypatch):
+    """End-to-end: SDK ``_refresh_api_key`` invokes our callable and the
+    resulting bearer token shows up in ``auth_headers``.
+
+    This is a regression guard against a future refactor that constructs
+    ``_AzureTokenProvider`` but forgets to pass it to ``AsyncOpenAI`` (in
+    which case the outgoing request would carry no Authorization header).
+    """
+    access_token = SimpleNamespace(token="token-A", expires_on=time.time() + 3600)
+    credential_instance = MagicMock()
+    credential_instance.get_token = AsyncMock(return_value=access_token)
+    credential_factory = MagicMock(return_value=credential_instance)
+    _install_fake_azure_identity(monkeypatch, credential_factory)
+
+    provider = AzureOpenAIProvider(
+        api_key="", api_base="https://res.openai.azure.com",
+    )
+
+    # Before any refresh, the SDK has no key yet -> no auth header.
+    assert provider._client.api_key == ""
+    assert provider._client.auth_headers == {}
+
+    # Trigger the SDK's refresh path; it must call our async callable.
+    refreshed = await provider._client._refresh_api_key()
+
+    assert refreshed == "token-A"
+    assert provider._client.api_key == "token-A"
+    assert provider._client.auth_headers == {"Authorization": "Bearer token-A"}
+    credential_instance.get_token.assert_awaited_with(
+        "https://cognitiveservices.azure.com/.default"
+    )
+
+    # A second refresh picks up a rotated token without re-instantiating
+    # the credential — proves we delegate per-request rather than caching
+    # the first value.
+    credential_instance.get_token = AsyncMock(
+        return_value=SimpleNamespace(token="token-B", expires_on=time.time() + 3600)
+    )
+    await provider._client._refresh_api_key()
+    assert provider._client.auth_headers == {"Authorization": "Bearer token-B"}
+    credential_factory.assert_called_once_with()
 
 
 def test_init_explicit_key_does_not_construct_credential(monkeypatch):