OpenAI SDK for TypeScript 7.9

Apply the Node.js 24 and TypeScript 7 prompts first. These rules cover openai 7.9 clients, credential resolution, Responses, structured output, tools, streaming, realtime, files, webhooks, provider transports, and operations.

Clients, credentials, and endpoints

• Construct OpenAI in trusted server or worker code. dangerouslyAllowBrowser: true disables the browser guard but does not make a reusable API key safe in client-side code, so mint a short-lived scoped credential server-side instead.
• Pick one credential mechanism deliberately. apiKey and workloadIdentity are mutually exclusive, and an inherited OPENAI_API_KEY causes a constructor error, so unset it or pass apiKey: null when federating identity.
• Prefer workload identity federation (k8sServiceAccountTokenProvider(), azureManagedIdentityTokenProvider(), gcpIDTokenProvider(), or a custom getToken() provider) or the X.509 credential option over a long-lived static key, and budget refreshBufferSeconds for expected request latency and clock skew; the effective buffer is capped at half the token lifetime.
• Use the X.509 credential only with the HTTPS host mtls.api.openai.com and base path /v1, and call credential.close() after requests drain; 7.9 excludes browsers, WebSockets, and third-party providers from this authentication path.
• Keep adminAPIKey (OPENAI_ADMIN_KEY) in a separate administrative service. Never let a request path that serves end-user traffic reach client.admin.organization.* users, projects, certificates, spend controls, or usage and cost reporting.