OpenAI

Calls the OpenAI API with a key the customer owns. One variable, injected server-side at deploy time, so the key never reaches a repository or a browser, and never a client bundle, where a pasted key is public within the hour. Create the key in a project of its own so it can be revoked without touching anything else, and give it the least permission that works: a key that calls models does not need to manage the account. Usage is billed by OpenAI on the customer’s account, so set a monthly budget in the console before the first deploy.

Before you connect it

What your application receives

An admin enters these once, and the platform injects them as environment variables at deploy time. Your code reads them. It never sees a login screen or an SDK for this.