OpenAI SDK for Go 3.56.0

Apply the Go 1.27 baseline first. These rules cover github.com/openai/openai-go/v3 v3.56.0, whose module minimum is Go 1.25. Use a supported, patched Go toolchain. Apply these controls to SDK credentials and providers, request construction, model and tool boundaries, retained data, streams, files, webhooks, and diagnostics.

Client construction and environment defaults

• Build openai.NewClient in trusted server or worker code; for API-key authentication, load the intended credential from deployment secrets and pass option.WithAPIKey explicitly.
• Audit DefaultClientOptions: the ordinary constructor reads OPENAI_BASE_URL, OPENAI_API_KEY, OPENAI_ADMIN_KEY, OPENAI_ORG_ID, OPENAI_PROJECT_ID, OPENAI_WEBHOOK_SECRET, and OPENAI_CUSTOM_HEADERS before applying explicit options. Setting an API key does not clear unrelated environment headers or routing.
• Treat OPENAI_CUSTOM_HEADERS as trusted deployment configuration only, since every newline-separated Name: value line becomes a header on each request the client sends.
• Do not set OPENAI_ADMIN_KEY in a process that serves ordinary inference traffic, because the same client then carries an administrative credential on client.Admin calls.
• Account for provider-specific defaults: azure.WithEndpoint at client construction and bedrock.NewClient suppress ambient OPENAI_* options; workload-identity options clear inherited authentication but do not discard all routing and custom headers.
• Separate administrative and inference credentials and isolate production from development projects. When