feat: Remove unnecessary client_id when using workload identity provider for auth

Author: jtian-oai

README.md

@@ -83,15 +83,12 @@ from openai.auth import k8s_service_account_token_provider
 
 client = OpenAI(
     workload_identity={
-        "client_id": "your-client-id",
         "identity_provider_id": "idp-123",
         "service_account_id": "sa-456",
         "provider": k8s_service_account_token_provider(
             "/var/run/secrets/kubernetes.io/serviceaccount/token"
         ),
     },
-    organization="org-xyz",
-    project="proj-abc",
 )
 
 response = client.chat.completions.create(
@@ -108,7 +105,6 @@ from openai.auth import azure_managed_identity_token_provider
 
 client = OpenAI(
     workload_identity={
-        "client_id": "your-client-id",
         "identity_provider_id": "idp-123",
         "service_account_id": "sa-456",
         "provider": azure_managed_identity_token_provider(
@@ -126,7 +122,6 @@ from openai.auth import gcp_id_token_provider
 
 client = OpenAI(
     workload_identity={
-        "client_id": "your-client-id",
         "identity_provider_id": "idp-123",
         "service_account_id": "sa-456",
         "provider": gcp_id_token_provider(audience="https://api.openai.com/v1"),
@@ -146,7 +141,6 @@ def get_custom_token() -> str:
 
 client = OpenAI(
     workload_identity={
-        "client_id": "your-client-id",
         "identity_provider_id": "idp-123",
         "service_account_id": "sa-456",
         "provider": {
@@ -165,7 +159,6 @@ from openai.auth import k8s_service_account_token_provider
 
 client = OpenAI(
     workload_identity={
-        "client_id": "your-client-id",
         "identity_provider_id": "idp-123",
         "service_account_id": "sa-456",
         "provider": k8s_service_account_token_provider("/var/token"),

src/openai/auth/_workload.py

@@ -27,10 +27,6 @@ class SubjectTokenProvider(TypedDict):
 
 
 class WorkloadIdentity(TypedDict):
-    """A unique string that identifies the client."""
-
-    client_id: str
-
     """Identity provider resource id in WIFAPI."""
     identity_provider_id: str
 
@@ -253,7 +249,6 @@ def _fetch_token_from_exchange(self) -> dict[str, Any]:
                 self.token_exchange_url,
                 json={
                     "grant_type": TOKEN_EXCHANGE_GRANT_TYPE,
-                    "client_id": self.workload_identity["client_id"],
                     "subject_token": subject_token,
                     "subject_token_type": subject_token_type,
                     "identity_provider_id": self.workload_identity["identity_provider_id"],

tests/test_auth.py

@@ -36,7 +36,6 @@ def test_basic_auth():
 
     client = OpenAI(
         workload_identity={
-            "client_id": "client_123",
             "identity_provider_id": "idp_123",
             "service_account_id": "sa_123",
             "provider": {
@@ -82,7 +81,6 @@ def provider() -> str:
 
     client = OpenAI(
         workload_identity={
-            "client_id": "client_123",
             "identity_provider_id": "idp_123",
             "service_account_id": "sa_123",
             "provider": {
@@ -103,7 +101,6 @@ def provider() -> str:
     assert json.loads(exchange_request.content) == snapshot(
         {
             "grant_type": "urn:ietf:params:oauth:grant-type:token-exchange",
-            "client_id": "client_123",
             "subject_token": "fake_subject_token",
             "subject_token_type": "urn:ietf:params:oauth:token-type:jwt",
             "identity_provider_id": "idp_123",
@@ -136,7 +133,6 @@ def test_workload_identity_exchange_error() -> None:
 
     client = OpenAI(
         workload_identity={
-            "client_id": "client_123",
             "identity_provider_id": "idp_123",
             "service_account_id": "sa_123",
             "provider": {

tests/test_client.py

@@ -45,7 +45,6 @@
 api_key = "My API Key"
 admin_api_key = "My Admin API Key"
 workload_identity: WorkloadIdentity = {
-    "client_id": "client_123",
     "identity_provider_id": "provider_123",
     "service_account_id": "service_account_123",
     "provider": {