OpenAI SDK for Go 3

Apply the Go 1.27 baseline first. These rules cover the github.com/openai/openai-go/v3 module, which requires Go 1.26 or newer. Apply them where the application constructs clients, sends model input, executes tools, handles streams or webhooks, and stores API resources.

Credentials and client scope

• Construct openai.NewClient in trusted server or worker code. Load option.WithAPIKey from deployment secrets; keep project API keys out of browsers, mobile apps, user prompts, and tool arguments.
• Review DefaultClientOptions before relying on environment configuration: OPENAI_API_KEY, OPENAI_ADMIN_KEY, OPENAI_ORG_ID, OPENAI_PROJECT_ID, OPENAI_WEBHOOK_SECRET, OPENAI_BASE_URL, and OPENAI_CUSTOM_HEADERS can change credentials, scope, destination, or headers. Treat the newline-separated custom headers as privileged deployment configuration.
• Keep option.WithAdminAPIKey and client.Admin in a separate administrative process or client with narrower access and auditing. Do not expose administrative methods through ordinary inference routes.
• Select option.WithOrganization and option.WithProject from authenticated server-side tenant configuration, never from an unchecked request field. A shared SDK credential does not enforce tenant ownership or quotas.
• Choose one authentication mode for each client. With option.WithWorkloadIdentity, bind IdentityProviderID and ServiceAccountID to deployment policy, use the intended Kubernetes, Azure, or GCP subject-token source, and reject fallback to an unrelated API key or custom Authorization header.