Develop Azure AI services applications with Azure Key Vault

• A valid Azure subscription - Create one for free
• Visual Studio IDE
• An Azure Key Vault
• An Azure AI services resource

• A valid Azure subscription - Create one for free.
• Python 3.7 or later
• Azure CLI or Azure PowerShell
• An Azure Key Vault
• An Azure AI services resource

• A valid Azure subscription - Create one for free.
• Java Development Kit (JDK) version 8 or above
• Azure CLI or Azure PowerShell
• An Azure Key Vault
• An Azure AI services resource

• A valid Azure subscription - Create one for free.
• Current Node.js v14 LTS or later
• Azure CLI or Azure PowerShell
• An Azure Key Vault
• An Azure AI services resource

Authenticate to Azure using Visual Studio

Developers using Visual Studio 2017 or later can authenticate a Microsoft Entra account through Visual Studio. This enables you to access secrets in your key vault by signing into your Azure subscription from within the IDE.

To authenticate in Visual Studio, select Tools from the top navigation menu, and select Options. Navigate to the Azure Service Authentication option to sign in with your user name and password.

Authenticate using the command line

Before you can grant access to your key vault, you must authenticate with your Microsoft Entra user name and password.

az login

Connect-AzAccount

Grant access to your key vault

Create an access policy for your key vault that grants secret permissions to your user account.

az keyvault set-policy --name Your-Key-Vault-Name --upn [email protected] --secret-permissions delete get list set purge

Set-AzKeyVaultAccessPolicy -VaultName 'Your-Key-Vault-Name' -UserPrincipalName '[email protected]' -PermissionsToSecrets delete,get,list,set,purge -PassThru

Create a new C# application

Using the Visual Studio IDE, create a new .NET Core console app. This will create a "Hello World" project with a single C# source file: program.cs.

Install the following client libraries by right-clicking on the solution in the Solution Explorer and selecting Manage NuGet Packages. In the package manager that opens select Browse and search for the following libraries, and select Install for each:

• Azure.Security.KeyVault.Secrets
• Azure.Identity

Import the example code

Copy the following example code into your program.cs file. Replace Your-Key-Secret-Name and Your-Endpoint-Secret-Name with the secret names that you set in your key vault.

using System;
using System.Threading.Tasks;
using Azure;
using Azure.Identity;
using Azure.Security.KeyVault.Secrets;
using System.Net;

namespace key_vault_console_app
{
    class Program
    {
        static async Task Main(string[] args)
        {
            //Name of your key vault
            var keyVaultName = Environment.GetEnvironmentVariable("KEY_VAULT_NAME");

            //variables for retrieving the key and endpoint from your key vault.
            //Set these variables to the names you created for your secrets
            const string keySecretName = "Your-Key-Secret-Name";
            const string endpointSecretName = "Your-Endpoint-Secret-Name";

            //Endpoint for accessing your key vault
            var kvUri = $"https://{keyVaultName}.vault.azure.net";

            var keyVaultClient = new SecretClient(new Uri(kvUri), new DefaultAzureCredential());

            Console.WriteLine($"Retrieving your secrets from {keyVaultName}.");

            //Key and endpoint secrets retrieved from your key vault
            var keySecret = await keyVaultClient.GetSecretAsync(keySecretName);
            var endpointSecret = await keyVaultClient.GetSecretAsync(endpointSecretName);
            Console.WriteLine($"Your key secret value is: {keySecret.Value.Value}");
            Console.WriteLine($"Your endpoint secret value is: {endpointSecret.Value.Value}");
            Console.WriteLine("Secrets retrieved successfully");

        }
    }
}

Run the application

Run the application by selecting the Debug button at the top of Visual Studio. Your key and endpoint secrets will be retrieved from your key vault.

Send a test Language service call (optional)

If you're using a multi-service resource or Language resource, you can update your application by following these steps to send an example Named Entity Recognition call by retrieving a key and endpoint from your key vault.

1. Install the Azure.AI.TextAnalytics library by right-clicking on the solution in the Solution Explorer and selecting Manage NuGet Packages. In the package manager that opens select Browse and search for the following libraries, and select Install for each:

2. Add the following directive to the top of your program.cs file.

   using Azure.AI.TextAnalytics;
   

3. Add the following code sample to your application.

   // Example method for extracting named entities from text 
   private static void EntityRecognitionExample(string keySecret, string endpointSecret)
   {
       //String to be sent for Named Entity Recognition
       var exampleString = "I had a wonderful trip to Seattle last week.";
   
       AzureKeyCredential azureKeyCredential = new AzureKeyCredential(keySecret);
       Uri endpoint = new Uri(endpointSecret);
       var languageServiceClient = new TextAnalyticsClient(endpoint, azureKeyCredential);
   
       Console.WriteLine($"Sending a Named Entity Recognition (NER) request");
       var response = languageServiceClient.RecognizeEntities(exampleString);
       Console.WriteLine("Named Entities:");
       foreach (var entity in response.Value)
       {
           Console.WriteLine($"\tText: {entity.Text},\tCategory: {entity.Category},\tSub-Category: {entity.SubCategory}");
           Console.WriteLine($"\t\tScore: {entity.ConfidenceScore:F2},\tLength: {entity.Length},\tOffset: {entity.Offset}\n");
       }
   }
   

4. Add the following code to call EntityRecognitionExample() from your main method, with your key and endpoint values.

   EntityRecognitionExample(keySecret.Value.Value, endpointSecret.Value.Value);
   

5. Run the application.

Authenticate your application

Before you can grant access to your key vault, you must authenticate with your Microsoft Entra user name and password.

az login

Connect-AzAccount

Grant access to your key vault

Create an access policy for your key vault that grants secret permissions to your user account.

az keyvault set-policy --name Your-Key-Vault-Name --upn [email protected] --secret-permissions delete get list set purge

Set-AzKeyVaultAccessPolicy -VaultName 'Your-Key-Vault-Name' -UserPrincipalName '[email protected]' -PermissionsToSecrets delete,get,list,set,purge -PassThru

Create a Python application

Create a new folder named keyVaultExample. Then use your preferred code editor to create a file named program.py inside the newly created folder.

Install Key Vault and Language service packages

1. In a terminal or command prompt, navigate to your project folder and install the Microsoft Entra identity library:

   pip install azure-identity
   

2. Install the Key Vault secrets library:

   pip install azure-keyvault-secrets
   

Import the example code

Add the following code sample to the file named program.py. Replace Your-Key-Secret-Name and Your-Endpoint-Secret-Name with the secret names that you set in your key vault.

import os
from azure.keyvault.secrets import SecretClient
from azure.identity import DefaultAzureCredential
from azure.core.credentials import AzureKeyCredential

keyVaultName = os.environ["KEY_VAULT_NAME"]

# Set these variables to the names you created for your secrets
keySecretName = "Your-Key-Secret-Name"
endpointSecretName = "Your-Endpoint-Secret-Name"

# URI for accessing key vault
KVUri = f"https://{keyVaultName}.vault.azure.net"

# Instantiate the client and retrieve secrets
credential = DefaultAzureCredential()
kv_client = SecretClient(vault_url=KVUri, credential=credential)

print(f"Retrieving your secrets from {keyVaultName}.")

retrieved_key = kv_client.get_secret(keySecretName).value
retrieved_endpoint = kv_client.get_secret(endpointSecretName).value

print(f"Your secret key value is {retrieved_key}.");
print(f"Your secret endpoint value is {retrieved_endpoint}.");

Run the application

Use the following command to run the application. Your key and endpoint secrets will be retrieved from your key vault.

python ./program.py

Send a test Language service call (optional)

If you're using a multi-service resource or Language resource, you can update your application by following these steps to send an example Named Entity Recognition call by retrieving a key and endpoint from your key vault.

1. Install the Language service library:

   pip install azure-ai-textanalytics==5.1.0
   

2. Add the following code to your application

   from azure.ai.textanalytics import TextAnalyticsClient
   # Authenticate the key vault secrets client using your key and endpoint 
   azure_key_credential = AzureKeyCredential(retrieved_key)
   # Now you can use key vault credentials with the Language service
   language_service_client = TextAnalyticsClient(
       endpoint=retrieved_endpoint, 
       credential=azure_key_credential)
   
   # Example of recognizing entities from text
   
   print("Sending NER request")
   
   try:
       documents = ["I had a wonderful trip to Seattle last week."]
       result = language_service_client.recognize_entities(documents = documents)[0]
       print("Named Entities:\n")
       for entity in result.entities:
           print("\tText: \t", entity.text, "\tCategory: \t", entity.category, "\tSubCategory: \t", entity.subcategory,
                   "\n\tConfidence Score: \t", round(entity.confidence_score, 2), "\tLength: \t", entity.length, "\tOffset: \t", entity.offset, "\n")
   
   except Exception as err:
       print("Encountered exception. {}".format(err))
   

3. Run the application.

Authenticate your application

Before you can grant access to your key vault, you must authenticate with your Microsoft Entra user name and password.

az login

Connect-AzAccount

Grant access to your key vault

Create an access policy for your key vault that grants secret permissions to your user account.

az keyvault set-policy --name Your-Key-Vault-Name --upn [email protected] --secret-permissions delete get list set purge

Set-AzKeyVaultAccessPolicy -VaultName 'Your-Key-Vault-Name' -UserPrincipalName '[email protected]' -PermissionsToSecrets delete,get,list,set,purge -PassThru

Create a java application

In your preferred IDE, create a new Java console application project, and create a class named Example.

Add dependencies

In your project, add the following dependencies to your pom.xml file.

<dependencies>
    <dependency>
        <groupId>com.azure</groupId>
        <artifactId>azure-security-keyvault-secrets</artifactId>
        <version>4.2.3</version>
    </dependency>
    <dependency>
        <groupId>com.azure</groupId>
        <artifactId>azure-identity</artifactId>
        <version>1.2.0</version>
    </dependency>
</dependencies>

Import the example code

Copy the following code into a file named Example.java. Replace Your-Key-Secret-Name and Your-Endpoint-Secret-Name with the secret names that you set in your key vault.

import com.azure.identity.DefaultAzureCredentialBuilder;
import com.azure.security.keyvault.secrets.SecretClient;
import com.azure.security.keyvault.secrets.SecretClientBuilder;
import com.azure.core.credential.AzureKeyCredential;

public class Example {

    public static void main(String[] args) {

        String keyVaultName = System.getenv("KEY_VAULT_NAME");
        String keyVaultUri = "https://" + keyVaultName + ".vault.azure.net";

        //variables for retrieving the key and endpoint from your key vault.
        //Set these variables to the names you created for your secrets
        String keySecretName = "Your-Key-Secret-Name";
        String endpointSecretName = "Your-Endpoint-Secret-Name";

        //Create key vault secrets client
        SecretClient secretClient = new SecretClientBuilder()
                .vaultUrl(keyVaultUri)
                .credential(new DefaultAzureCredentialBuilder().build())
                .buildClient();

        //retrieve key and endpoint from key vault
        String keyValue = secretClient.getSecret(keySecretName).getValue();
        String endpointValue = secretClient.getSecret(endpointSecretName).getValue();
        System.out.printf("Your secret key value is: %s", keyValue)
        System.out.printf("Your secret endpoint value is: %s", endpointValue)
    }
}

Send a test Language service call (optional)

If you're using a multi-service resource or Language resource, you can update your application by following these steps to send an example Named Entity Recognition call by retrieving a key and endpoint from your key vault.

1. In your application, add the following dependency:

   <dependency>
       <groupId>com.azure</groupId>
       <artifactId>azure-ai-textanalytics</artifactId>
       <version>5.1.12</version>
   </dependency>
   

2. add the following import statements to your file.

   import com.azure.ai.textanalytics.models.*;
   import com.azure.ai.textanalytics.TextAnalyticsClientBuilder;
   import com.azure.ai.textanalytics.TextAnalyticsClient;
   

3. Add the following code to the main() method in your application:

   
   TextAnalyticsClient languageClient = new TextAnalyticsClientBuilder()
           .credential(new AzureKeyCredential(keyValue))
           .endpoint(endpointValue)
           .buildClient();
   
   // Example for recognizing entities in text
   String text = "I had a wonderful trip to Seattle last week.";
   
   for (CategorizedEntity entity : languageClient.recognizeEntities(text)) {
       System.out.printf(
               "Recognized entity: %s, entity category: %s, entity sub-category: %s, score: %s, offset: %s, length: %s.%n",
               entity.getText(),
               entity.getCategory(),
               entity.getSubcategory(),
               entity.getConfidenceScore(),
               entity.getOffset(),
               entity.getLength());
   }
   

4. Run your application

Authenticate your application

Before you can grant access to your key vault, you must authenticate with your Microsoft Entra user name and password.

az login

Connect-AzAccount

Grant access to your key vault

Create an access policy for your key vault that grants secret permissions to your user account.

az keyvault set-policy --name Your-Key-Vault-Name --upn [email protected] --secret-permissions delete get list set purge

Set-AzKeyVaultAccessPolicy -VaultName 'Your-Key-Vault-Name' -UserPrincipalName '[email protected]' -PermissionsToSecrets delete,get,list,set,purge -PassThru

Create a new Node.js application

Create a Node.js application that uses your key vault.

In a terminal, create a folder named key-vault-js-example and change into that folder:

mkdir key-vault-js-example && cd key-vault-js-example

Initialize the Node.js project:

npm init -y

Install Key Vault and Language service packages

1. Using the terminal, install the Azure Key Vault secrets library, @azure/keyvault-secrets for Node.js.

   npm install @azure/keyvault-secrets
   

2. Install the Azure Identity library, @azure/identity package to authenticate to a Key Vault.

   npm install @azure/identity
   

Import the code sample

Add the following code sample to a file named index.js. Replace Your-Key-Secret-Name and Your-Endpoint-Secret-Name with the secret names that you set in your key vault.

const { SecretClient } = require("@azure/keyvault-secrets");
const { DefaultAzureCredential } = require("@azure/identity");
// Load the .env file if it exists
const dotenv = require("dotenv");
dotenv.config();

async function main() {
    const credential = new DefaultAzureCredential();

    const keyVaultName = process.env["KEY_VAULT_NAME"];
    const url = "https://" + keyVaultName + ".vault.azure.net";

    const kvClient = new SecretClient(url, credential);

    // Set these variables to the names you created for your secrets
    const keySecretName = "Your-Key-Secret-Name";
    const endpointSecretName = "Your-Endpoint-Secret-Name";

    console.log("Retrieving secrets from ", keyVaultName);
    const retrievedKey = await (await kvClient.getSecret(keySecretName)).value;
    const retrievedEndpoint = await (await kvClient.getSecret(endpointSecretName)).value;
    console.log("Your secret key value is: ", retrievedKey);
    console.log("Your secret endpoint value is: ", retrievedEndpoint);
}

main().catch((error) => {
  console.error("An error occurred:", error);
  process.exit(1);
});

Run the sample application

Use the following command to run the application. Your key and endpoint secrets will be retrieved from your key vault.

node index.js

Send a test Language service call (optional)

If you're using a multi-service resource or Language resource, you can update your application by following these steps to send an example Named Entity Recognition call by retrieving a key and endpoint from your key vault.

1. Install the Azure AI service for Language library, @azure/ai-text-analytics to send API requests to the Language service.

   npm install @azure/[email protected]
   

2. Add the following code to your application:

   const { TextAnalyticsClient, AzureKeyCredential } = require("@azure/ai-text-analytics");
   // Authenticate the language client with your key and endpoint
   const languageClient = new TextAnalyticsClient(retrievedEndpoint,  new AzureKeyCredential(retrievedKey));
   
   // Example for recognizing entities in text
   console.log("Sending NER request")
   const entityInputs = [
       "I had a wonderful trip to Seattle last week."
   ];
   const entityResults = await languageClient.recognizeEntities(entityInputs);
   entityResults.forEach(document => {
       console.log(`Document ID: ${document.id}`);
       document.entities.forEach(entity => {
           console.log(`\tName: ${entity.text} \tCategory: ${entity.category} \tSubcategory: ${entity.subCategory ? entity.subCategory : "N/A"}`);
           console.log(`\tScore: ${entity.confidenceScore}`);
       });
   });
   

3. Run the application.