OpenAI SDK for .NET 2.14.0

Apply the C# 14 prompt first. These rules cover the official OpenAI NuGet package as researched at 2.14.0 in C# 14/.NET 10 applications. Its .NET 8 and .NET Standard 2.0 compatibility does not extend the security support of an end-of-life host runtime.

Clients and outbound traffic

• Authorize the application caller before sending any request. Keep OpenAI API keys on the server, scoped to the intended project; provider credentials do not grant an end user permission to use application tools or stored resources.
• Reuse an OpenAIClient, ResponsesClient, or feature client only across requests with the same credential, endpoint, organization, and project policy. Build tenant histories and resource-ID mappings per caller; never mutate a shared credential or options object to switch tenants.
• Construct OpenAIClientOptions or ResponsesClientOptions from trusted configuration. Restrict Endpoint, authentication policies, RequestOptions headers, and custom transports to approved HTTPS destinations; apply egress checks at connection and after redirects, including private and metadata addresses. Give application-opened model URLs and external tool URLs the same destination policy.
• Give each SDK operation a cancellation token and finite overall deadline. Configure finite NetworkTimeout, but budget separately for retries, pagination, streaming, background polling, and local tool work; that timeout covers an individual network operation.
• Review retry behavior for writes that can create jobs, files, or responses. Set RetryPolicy through ClientRetryPolicy when