OpenAI SDK for Java 4.58.0

Last reviewed Sep 24, 2026

Export as PDF

Prompt Details

Prompt Composition

2prompts
  1. Java 25113 lines · 2.8K tokens
  2. OpenAI SDK for Java 4.58.0103 lines · 5.4K tokens
Total216 lines · 8.3K tokens

CWE Coverage

  • 20
  • 22
  • 59
  • 78
  • 79
  • 88
  • 89
  • 95
  • 117
  • 190
  • 201
  • 208
  • 209
  • 214
  • 294
  • 295
  • 297
  • 323
  • 327
  • 338
  • 347
  • 362
  • 367
  • 378
  • 427
  • 470
  • 471
  • 494
  • 502
  • 532
  • 611
  • 639
  • 653
  • 681
  • 732
  • 770
  • 772
  • 776
  • 789
  • 807
  • 841
  • 862
  • 863
  • 915
  • 916
  • 918
  • 922
  • 942
  • 1333
  • 1426
  • 1427

Prompt Preview

Apply the Java 25 prompt first. These rules cover com.openai:openai-java, openai-java-core, openai-java-client-okhttp, and openai-java-bedrock at 4.58.0. The framework-neutral artifacts require Java 8 or later and declare consumer tests on Java 8, 11, 17, 21, and 25; these rules target Java 25.

Client construction and credential scope

  • Construct OpenAIOkHttpClient and OpenAIOkHttpClientAsync in trusted backend code. Select one authentication mode deliberately: apiKey(...), credential(...), workloadIdentity(...), or x509WorkloadIdentity(...); keep inference credentials out of browser, mobile, and distributed desktop applications.
  • Audit fromEnv() before using it: it reads openai.apiKey/OPENAI_API_KEY, openai.adminKey/OPENAI_ADMIN_KEY, openai.orgId/OPENAI_ORG_ID, openai.projectId/OPENAI_PROJECT_ID, openai.webhookSecret/OPENAI_WEBHOOK_SECRET, openai.baseUrl/OPENAI_BASE_URL, AZURE_OPENAI_KEY, OPENAI_CUSTOM_HEADERS, and OPENAI_LOG. System properties take precedence over matching environment variables; builder setters and fromEnv() apply in call order, so apply trusted overrides last.
  • Treat newline-separated OPENAI_CUSTOM_HEADERS as privileged configuration because its values accompany requests. An explicit API key does not neutralize an inherited endpoint, admin key, logging level, or custom headers.
  • Set organization(...) and project(...) explicitly when required by the deployment. In 4.58.0, fromEnv() applies the organization and project environment values only in its OpenAI API-key branch, not when