Enum ProviderEndpointCredentialKind

Namespace

MailFathom.AI.Providers

Assembly

MailFathom.AI.dll

Names how a deployment proves its identity to one AI provider endpoint.

public enum ProviderEndpointCredentialKind

Fields

ApiKey = 0

A key the provider issued, carried as a secret reference and resolved per request.

ClientCertificate = 4

A registered application authenticating with its certificate.

ClientSecret = 3

A registered application authenticating with its client secret.

ManagedIdentity = 1

The managed identity assigned to the Azure resource the service runs on.

The shape with no secret at all, which is why it is preferred wherever the deployment can hold one.

Unauthenticated = 5

Nothing at all: the endpoint asks for no credential, and the request carries none.

The ordinary shape of a model server the operator runs themselves, which admits a caller by being reachable only from the network it was put on. It is a member of this set rather than an absence outside it, because an endpoint that needs no credential has to be able to say so: an omission is what a forgotten key reference looks like, and startup goes on refusing that.

WorkloadIdentity = 2

The federated workload identity a Kubernetes service account is annotated with.

Also holds no secret: the projected service-account token is exchanged for an access token, and the projection is the platform's to rotate.

Remarks

One set for every provider role rather than one per role. An endpoint that serves embeddings and an endpoint that serves generation are reached through the same client library, at the same kind of address, with the same shapes of credential, so a second copy of this set would be two enumerations that had to be kept identical by hand.

Every member is non-interactive, and that is the whole of the set rather than a subset of a longer one. MailFathom is a background service with nobody at a keyboard, so a credential that opens a browser or prints a device code has no way to complete and would surface as a request that never returns. That is also why the Microsoft Entra chain is composed from these members explicitly rather than taken from DefaultAzureCredential, whose chain contains both those shapes and the developer-tool credentials besides.