Enum EmbeddingEndpointCredentialKind

Namespace

MailFathom.AI.Embeddings

Assembly

MailFathom.AI.dll

Names how a deployment proves its identity to one embedding endpoint.

public enum EmbeddingEndpointCredentialKind

Fields

ApiKey = 0

A key the provider issued, carried as a secret reference and resolved per request.

ClientCertificate = 4

A registered application authenticating with its certificate.

ClientSecret = 3

A registered application authenticating with its client secret.

ManagedIdentity = 1

The managed identity assigned to the Azure resource the service runs on.

The shape with no secret at all, which is why it is preferred wherever the deployment can hold one.

WorkloadIdentity = 2

The federated workload identity a Kubernetes service account is annotated with.

Also holds no secret: the projected service-account token is exchanged for an access token, and the projection is the platform's to rotate.

Remarks

Every member is non-interactive, and that is the whole of the set rather than a subset of a longer one. MailFathom is a background service with nobody at a keyboard, so a credential that opens a browser or prints a device code has no way to complete and would surface as a request that never returns. That is also why the Microsoft Entra chain is composed from these members explicitly rather than taken from DefaultAzureCredential, whose chain contains both those shapes and the developer-tool credentials besides.