Fix/azure image edit auth header

[justalittleadam]

Verified end-to-end through LiteLLM Proxy → Azure APIM → Azure OpenAI against gpt-image-1.5 for /v1/images/edits. Returns a real edited image (~300 KB JSON payload).

Type

🐛 Bug Fix

Changes

litellm/llms/azure/image_edit/transformation.py

AzureImageEditConfig.validate_environment now delegates to BaseAzureLLM._base_validate_azure_environment — the canonical helper already used by every other Azure provider in the codebase (videos, vector_stores, responses, containers, assistants, batches, files, fine_tuning, …). This:

• Prefers the Azure-native api-key: <key> header when an API key is available (env vars, litellm.api_key, litellm.azure_key, litellm_params.api_key, or the api_key kwarg).
• Falls back to Authorization: Bearer <azure_ad_token> only when AAD auth is configured (azure_ad_token / azure_ad_token_provider in litellm_params).
• Removes the previous unconditional Authorization: Bearer <api_key> header that was incorrect for Azure-style deployments.

Why delegate instead of just renaming the header

Naively swapping Authorization: Bearer → api-key: would fix subscription-key auth but silently break AAD/Entra ID auth, which legitimately needs Authorization: Bearer <token>. BaseAzureLLM._base_validate_azure_environment already encodes the correct branching and is the source of truth for Azure auth across the rest of the provider surface — image-edit was the only outlier hand-rolling its own header logic. This change brings it back in line and means future improvements to Azure auth (e.g., new token providers) automatically apply to image-edit too.

tests/test_litellm/llms/azure/image_edit/test_azure_image_edit_transformation.py

Three new regression tests:

• test_validate_environment_uses_api_key_header_from_kwarg — passing api_key= results in an api-key header and no Authorization: Bearer leak.
• test_validate_environment_uses_api_key_header_from_litellm_params — litellm_params={"api_key": ...} resolves to the api-key header.
• test_validate_environment_falls_back_to_aad_bearer — when only azure_ad_token is supplied, the call falls back to Authorization: Bearer <token>, so AAD users are unaffected.

---

Note

Medium Risk
Changes request authentication for Azure image-edit calls, which can affect connectivity for different Azure deployments (API key vs AAD) if any edge-case header precedence differs from prior behavior.

Overview
Fixes Azure /images/edits authentication by replacing the image-edit-specific header logic with BaseAzureLLM._base_validate_azure_environment, so requests use api-key when an API key is available and only fall back to Authorization: Bearer <AAD token> when configured.

Adds regression tests covering subscription-key header usage, litellm_params["api_key"] precedence over the positional api_key, and the AAD bearer fallback path.

^{Reviewed by Cursor Bugbot for commit 7e32c65. Bugbot is set up for automated code reviews on this repo. Configure here.}

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
2 out of 3 committers have signed the CLA.

✅ yuneng-berri
✅ ryan-crabbe-berri
❌ adamkirsteindisney
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[greptile-apps]

Greptile Summary

This PR fixes a bug in AzureImageEditConfig.validate_environment that was unconditionally setting Authorization: Bearer <api_key> (OpenAI-style) instead of the api-key header expected by Azure OpenAI and API Management gateways. The fix delegates to the shared BaseAzureLLM._base_validate_azure_environment helper, aligning the image-edit route with every other Azure provider in the codebase.

• litellm/llms/azure/image_edit/transformation.py: Replaced the hardcoded Authorization: Bearer logic with a call to BaseAzureLLM._base_validate_azure_environment, which prefers the api-key header for API-key auth and falls back to Authorization: Bearer <aad_token> for AAD auth. The api_key positional argument is merged into GenericLiteLLMParams before delegation, with litellm_params.api_key taking precedence over the positional api_key when both are supplied.
• tests/…/test_azure_image_edit_transformation.py: Three new unit tests cover the subscription-key header path, litellm_params API-key precedence, and the AAD-token fallback; all use mocks and make no real network calls."

Confidence Score: 4/5

The fix correctly aligns the image-edit auth path with every other Azure provider and is safe to merge; the precedence inversion for callers that supply both the positional key argument and a key inside litellm_params is worth documenting.

The core change is a targeted, well-justified one-line delegation to a shared helper already proven across other Azure providers. Three new mock-only tests cover the primary auth paths. The only noteworthy subtlety is that the new merge logic silently gives litellm_params priority over the positional api_key argument when both are non-None, which is an inversion of the old behavior and could surprise callers who pass both — but no existing call site appears to do so.

No files require special attention; both changed files are small and self-contained.

Important Files Changed

Filename	Overview
litellm/llms/azure/image_edit/transformation.py	Replaces incorrect Bearer-token header with proper Azure api-key auth by delegating to the shared BaseAzureLLM helper; logic is consistent with other Azure providers.
tests/test_litellm/llms/azure/image_edit/test_azure_image_edit_transformation.py	Adds three well-isolated mock-only unit tests covering the fixed auth-header paths; no real network calls.

_{Reviews (1): Last reviewed commit: "fix(azure/image_edit): use api-key heade..." | Re-trigger Greptile}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[oss-pr-review-agent-shin]

🤖 litellm-agent: This PR is currently BLOCKED from merge.

Score: 4/5 ❌

Why blocked:

• 2 unresolved reviewer concerns (greptile, cla-assistant[bot]) (unresolved_concern, -1 pts)

Details: Score docked for: 2 unresolved reviewer concerns (greptile, cla-assistant[bot]).

Fix the issues above and push an update — the bot will re-review automatically.

Note: This bot is still in beta and might not always work as expected. Please share any feedback via Slack.

[ishaan-berri]

bugbot review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 7e32c65. Configure here.}