OpenAI SDK for Java 4.91

Last reviewed Oct 25, 2026

Export as PDF

Prompt Details

Prompt Composition

2prompts
  1. Java 25113 lines · 2.8K tokens
  2. OpenAI SDK for Java 4.9162 lines · 2.8K tokens
Total175 lines · 5.6K tokens

CWE Coverage

  • 20
  • 22
  • 59
  • 78
  • 79
  • 88
  • 89
  • 95
  • 117
  • 190
  • 201
  • 208
  • 209
  • 214
  • 294
  • 295
  • 297
  • 323
  • 327
  • 338
  • 347
  • 362
  • 367
  • 378
  • 427
  • 470
  • 471
  • 494
  • 502
  • 532
  • 611
  • 639
  • 653
  • 681
  • 732
  • 770
  • 772
  • 776
  • 789
  • 807
  • 841
  • 862
  • 863
  • 915
  • 916
  • 918
  • 922
  • 942
  • 1333
  • 1426
  • 1427

Prompt Preview

Apply the Java 25 prompt first. These rules cover the framework-neutral OpenAI Java client and its optional Bedrock and Vertex transports, researched against the 4.91.0 release. Keep provider credentials, destinations, and tenant state in trusted backend code.

Client identity and configuration

  • Build OpenAIOkHttpClient or OpenAIOkHttpClientAsync per credential and project boundary. Keep apiKey(...), credential(...), workload identity, and administrative credentials on the server; never expose client.admin() through an end-user proxy.
  • Review every value loaded by fromEnv(): system properties take precedence over environment variables for API and admin keys, organization, project, webhook secret, and base URL; it also reads logging and custom-header settings. Set trusted overrides after fromEnv() and do not let a request choose a credential, project, organization, or endpoint.
  • Treat OPENAI_CUSTOM_HEADERS as privileged configuration. Do not forward inbound headers into it or putAdditionalHeader(...); request overrides can replace prepared authentication or project headers.
  • Keep OpenAI, Azure, Bedrock, and Vertex clients separate. Use one explicit credential mode per client, and review the precedence of ambient cloud credentials and bearer-token environment variables before constructing a provider client.
  • Reuse clients within their identity boundary and close the owning client at shutdown. Account for shared transport and executor resources in withOptions(...) clones and caller-supplied executors.

Outbound requests and transport