Azure OpenAI

Simplest path. Each Azure OpenAI resource exposes two interchangeable API keys (Key 1 and Key 2 — for rotation). Parleq sends whichever you pasted in the api-key header.

Setup:

1. On your resource's portal page → Keys and Endpoint. Copy Key 1 and the Endpoint.
2. In Parleq's Setup Wizard, pick Azure OpenAI, leave Auth mode on API key, fill in:
   • Resource: see the next section.
   • Deployment: the deployment name you picked in step 2 above.
   • API Key: paste Key 1.
3. Continue → Finish & Restart.

Parleq mints a short-lived OAuth bearer token from your az login session and sends it as Authorization: Bearer <token>. No API key to paste, no secrets in the Keychain — auth flows entirely through your existing Azure CLI session and refreshes via az account get-access-token.

Setup:

# Install the Azure CLI if you haven't:
brew install azure-cli

# Sign in (opens browser):
az login

# If you have multiple subscriptions, set the right one as default:
az account set --subscription "My Team Subscription"

Critical IAM step. Owner / Contributor on the subscription is not enough — those are control-plane roles, and Azure OpenAI requires the data-plane role Cognitive Services OpenAI User (a97b65f3-24c7-4388-baec-2e87135dc908) on the resource itself.

Grant it: Resource → Access control (IAM) → Add → Add role assignment → Cognitive Services OpenAI User → assign to your user. Wait ~1 minute for the assignment to propagate before testing.

Then in Parleq's Setup Wizard, pick Azure OpenAI, switch Auth mode to Microsoft Entra ID, fill in Resource + Deployment, then Finish & Restart. No API key field appears in this mode.

Parleq augments PATH at process launch to include /opt/homebrew/bin and /usr/local/bin, so a Homebrew-installed az is reachable even when launched from Spotlight or as a login item.

Parleq accepts three input shapes in the Resource field, so you can paste whatever the Azure portal shows you:

• Bare resource name — my-openai. Parleq builds the URL as my-openai.openai.azure.com. Use this for classic Azure OpenAI resources.
• Full hostname — my-openai.cognitiveservices.azure.com or my-openai.services.ai.azure.com. Use this for newer AI Foundry resources where the hostname uses a different domain.
• Full URL — https://my-openai.cognitiveservices.azure.com/openai/responses?api-version=.... Parleq strips the scheme and path and uses just the hostname. Convenient when you copy-paste the full Endpoint URL from the portal.

Detection rule: if the value contains a dot, it's treated as a hostname; otherwise as a bare resource name. Azure resource names are alphanumeric + hyphens, no dots, so this is unambiguous.

Azure's API routes calls by deployment name, not model name — there is no per-call model identifier on the wire, only the deployment you pick in the URL. So Parleq's Settings doesn't ask for a model name; instead, it asks for a Model family:

• Standard — pick this when your deployment serves gpt-4o-mini, gpt-4o, gpt-4, gpt-3.5-turbo, or any non-reasoning model. Parleq sends max_tokens + an explicit temperature.
• Reasoning — pick this when your deployment serves gpt-5, gpt-5-mini, or any o-series model (o1, o3, o4, o5). These models reject max_tokens in favor of max_completion_tokens and refuse any temperature other than 1.0, so Parleq has to send a different request shape.

Default is Standard. If you mismatch (e.g., picked Standard but deployed a gpt-5 model), Azure responds with a clear 400 error message that names the offending parameter — flip the family in Settings and dictate again.

API version. Defaults to 2025-04-01-preview, which supports gpt-5-series models. If your deployment requires a different version, override in Settings.

Reasoning models are noticeably slower than the gpt-4o family — they think before responding. Worth it if you've tuned the cleanup style toward gpt-5; otherwise the gpt-4o-mini path wins on latency.

Per-token pricing per Azure's published rates, plus regional capacity (TPM — tokens per minute) granted per deployment. Cleanup traffic is short-prompt + short-response, so single-user dictation use is well below default TPM caps.

Charges land on the Azure subscription that owns the resource, alongside everything else your org bills there.

Cleaning up after testing. Idle Azure OpenAI resources don't incur compute charges — there's no provisioned capacity to pay for unless you've explicitly purchased it. You can leave the resource in place between sessions; if you want to remove it entirely, delete the deployment first, then the resource, both from the Azure portal.

Azure OpenAI traffic is governed by your Microsoft Customer Agreement / EA terms, not OpenAI's. Per Microsoft's documented data privacy commitments, prompts and completions are not used to train or improve OpenAI's or Microsoft's foundation models. Data stays in the Azure region you deployed to. Activity logs (Azure Monitor → Diagnostic settings on the resource) capture call metadata for audit.

Audio never reaches Azure. Only the text transcript output by Parleq's on-device speech model is sent.