The SDK uses DefaultAzureCredential from the Azure Identity library, which automatically tries multiple authentication methods:
az login) — for local development| Environment | Use | Why |
|---|---|---|
| Local Dev | Azure CLI (az login) | Simple, no secrets to manage |
| Production | Managed Identity | No credentials in code, auto-rotated |
| CI/CD | Service Principal + Environment vars | Automated, scoped permissions |
DefaultAzureCredential or Managed Identity. API keys should only be used for quick prototyping and testing.