Calls the OpenAI API with a key the customer owns. One variable, injected server-side at deploy time, so the key never reaches a repository or a browser, and never a client bundle, where a pasted key is public within the hour. Create the key in a project of its own so it can be revoked without touching anything else, and give it the least permission that works: a key that calls models does not need to manage the account. Usage is billed by OpenAI on the customer’s account, so set a monthly budget in the console before the first deploy.
OpenAI's own documentation →OPENAI_API_KEY