From 69304c8200b312e36ab75884ce8d3e5ab4bbf436 Mon Sep 17 00:00:00 2001
From: Kyle Barron <kyle@developmentseed.org>
Date: Thu, 25 Jun 2026 10:05:55 -0400
Subject: [PATCH] feat: Config option to choose azure credential type

---
 obstore/python/obstore/_store/_azure.pyi | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/obstore/python/obstore/_store/_azure.pyi b/obstore/python/obstore/_store/_azure.pyi
index c2742155..631006a8 100644
--- a/obstore/python/obstore/_store/_azure.pyi
+++ b/obstore/python/obstore/_store/_azure.pyi
@@ -61,6 +61,27 @@ class AzureConfig(TypedDict, total=False):
     - `AZURE_STORAGE_CLIENT_SECRET`
     - `AZURE_CLIENT_SECRET`
     """
+
+    credential_type: str
+    """Credential type to use for authentication.
+
+    When multiple credential configurations are present, this key forces the builder to
+    use a specific credential type instead of relying on the default resolution order.
+
+    Supported values:
+
+    - `auto` (default) — use the built-in priority chain
+    - `bearer_token` — use a static bearer token
+    - `access_key` — use an access key
+    - `client_secret` — use client secret (service principal) OAuth
+    - `workload_identity` — use workload identity federation
+    - `sas_token` — use a shared access signature
+    - `azure_cli` — use Azure CLI
+    - `managed_identity` — use IMDS managed identity
+
+    **Environment variable**: `AZURE_CREDENTIAL_TYPE`.
+    """
+
     tenant_id: str
     """The tenant id for use in client secret or k8s federated credential flow.