OpenAI SDK for Go 3.54.0

Apply the Go 1.27 baseline first. Use these additional rules for github.com/openai/openai-go/v3 v3.54.0. This SDK requires Go 1.25 or newer; the included baseline targets Go 1.27. SDK types and model instructions do not enforce application authorization.

Clients and credentials

• Construct openai.NewClient with protected, least-privilege project credentials. Isolate option.WithAdminAPIKey, OPENAI_ADMIN_KEY, and client.Admin operations from ordinary application workers; never distribute project or admin keys to browsers or mobile clients.
• Audit environment defaults including OPENAI_API_KEY, OPENAI_BASE_URL, OPENAI_ORG_ID, OPENAI_PROJECT_ID, and OPENAI_CUSTOM_HEADERS. Accept endpoint, organization, project, header, middleware, and transport options only from trusted configuration, including options supplied to individual service methods.
• Separate project credentials and quotas across environments; bind each tenant to its authorized client configuration and resource IDs. Do not mutate shared client or service Options to switch tenants.
• Choose an approved HTTPS endpoint with option.WithBaseURL or option.WithDataResidency. Do not combine them in the same configuration call; either can replace an inherited endpoint. WithDataResidency selects routing only and does not enable project or model eligibility for that region.
• Prefer a native *http.Client when using option.WithHTTPClient: it retains SDK credential-origin checks on redirects. A bespoke option.HTTPClient.Do owns its internal redirects and must preserve the same origin