A hands-on exploration of programmatic API onboarding with Azure API Management (APIM), comparing it against the SoundCloud ideal of fully scriptable credential provisioning. APIM's 'application' is actually a subscription tied to a product, not an OAuth client — credentials are subscription keys sent via the Ocp-Apim-Subscription-Key header. The management plane is clean and fully REST-scriptable with idempotent PUT calls, but requires an existing Azure AD bearer token and RBAC role, making it inaccessible to external agents or new developers. A complete Node.js 18+ script is provided that reads environment variables, optionally provisions a user, creates or fetches a subscription, and retrieves keys via a separate listSecrets call. The conclusion: APIM works well for first-party automation inside an Azure tenant but lacks a public OAuth-driven self-signup path that would make it truly agentic-ready for external consumers.
