Azure Key Vault × Sentiqra

Store and retrieve Sentiqra API credentials through Azure Key Vault.

Why This Integration Matters

Every enterprise security team requires programmatic secret rotation. If you don't document how Sentiqra API keys integrate with industry-standard secret managers, security engineers assume you don't support it and route to a competitor who does.

Azure Key Vault is the native Microsoft Azure solution for secret management. By storing Sentiqra API keys in Key Vault, your application fetches credentials at request time with managed identity authentication - zero human touch on production secrets.

This addresses the "how do we rotate API keys without downtime?" procurement question for Azure-native deployments. Key Vault integrates natively with Azure AD, App Service, and AKS managed identities.

Reference Architecture

┌──────────────────────────────────────────────────────────────┐
│                  Azure Infrastructure                        │
│                                                               │
│  ┌──────────┐    ┌───────────────┐    ┌──────────┐           │
│  │  App      │───▶│ Azure Key     │───▶│ Returns  │           │
│  │  (App     │    │ Vault         │    │ API Key  │           │
│  │   Service /│    │               │    │          │           │
│  │   AKS /   │    │ Managed       │    │          │           │
│  │   Func)   │    │ Identity auth │    │          │           │
│  │           │◀───│ Key returned  │◀───│          │           │
│  └─────┬─────┘    └───────────────┘    └──────────┘           │
│        │  API Key from Key Vault                              │
│        ▼                                                      │
│  ┌──────────┐                                                │
│  │ Sentiqra │                                                │
│  │  API     │                                                │
│  └──────────┘                                                │
└──────────────────────────────────────────────────────────────┘

Data flow: Your application authenticates to Key Vault using its managed identity (no credentials needed) → Key Vault returns the Sentiqra API key → your application calls Sentiqra → Key Vault can auto-rotate the key on a configured schedule.

Working Code

Actual, tested, copy-pasteable code. Not pseudocode. Not aspirational.

import requests
from azure.identity import DefaultAzureCredential
from azure.keyvault.secrets import SecretClient

# 1. Authenticate with managed identity (no credentials in code)
credential = DefaultAzureCredential()
client = SecretClient(
    vault_url="https://sentiqra-vault.vault.azure.net",
    credential=credential,
)

# 2. Fetch API key from Key Vault
api_key = client.get_secret("sentiqra-api-key").value

# 3. Use Sentiqra with Azure-managed key
response = requests.post(
    "https://sentiqra.tech/v1/analyze",
    headers={
        "Authorization": f"Bearer {api_key}",
        "Content-Type": "application/json",
    },
    json={"text": "you are a worthless idiot", "language": "en", "analyzers": ["trust-safety"]},
    timeout=10,
)
data = response.json()
top = data["signals"][0]
print(top["code"])    # 'insults_derogation'
print(top["score"])   # 0.99

az keyvault create --name sentiqra-vault --resource-group prod-rg

az keyvault secret set \
  --vault-name sentiqra-vault \
  --name sentiqra-api-key \
  --value "sq_live_your_api_key_here"

# Grant your app's managed identity access:
az keyvault set-policy \
  --name sentiqra-vault \
  --spn  \
  --secret-permissions get

Security & Compliance Posture

• ✓
  SOC 2 Type II - CC6.1 - Logical Access: API keys are stored in Key Vault with Azure AD-based access control. No human access to production secrets.
• ✓
  Managed Identity: No credentials in code or environment variables. Azure AD managed identity provides passwordless authentication to Key Vault.
• ✓
  Azure Native Integration: Works with App Service, AKS, Functions, and VMs - no additional infrastructure required for Azure-native deployments.
• ✓
  Audit Trail: Key Vault logging integrates with Azure Monitor and Log Analytics, providing a complete audit trail of secret access.
• ✓
  HSM-Backed Option: Key Vault Managed HSM provides FIPS 140-2 Level 3 validated hardware security modules for the highest compliance requirements.

Deployment Notes