In Azure AI Studio (formerly Microsoft Foundry), an OpenAPI tool must be explicitly associated with a connection to use the credentials stored within it. The 401 Unauthorized error, coupled with the trace showing a missing API key header, indicates that the tool is not configured to retrieve the key. By connecting the tool to Connection1, the AI Studio runtime is instructed to fetch the API key from that connection and automatically inject it into the HTTP header of every request, as defined by the tool's authentication settings. This resolves the authentication failure.

A. There is no concept of a generic "default connection" for custom OpenAPI tools in a project; connections must be explicitly assigned to the tools that use them.

C. Identity passthrough uses the caller's Microsoft Entra ID token for authentication, which is incorrect for an external API that specifically requires a static API key.

D. Hardcoding secrets like an API key directly into the OpenAPI specification is a severe security anti-pattern and is not the correct or secure way to manage credentials.

1. Microsoft Learn, "How to use OpenAPI tool in prompt flow":

Section: Set up OpenAPI tool > Authentication

Content: This document explicitly states, "For API Key, you need to select a connection that contains the API key." This confirms that the tool must be connected to the specific connection resource to function correctly. The UI shown in the documentation includes a dropdown to select the appropriate connection.

2. Microsoft Learn, "Connections in Azure AI Studio":

Section: Overview

Content: "Connections in Azure AI Studio are a way to store and manage secrets and credentials that your application needs to connect to external services... When you create a connection, you select a connection type and provide the required information to connect to the service." This establishes that connections are the designated mechanism for storing secrets like API keys, which are then consumed by other components like tools.