OpenAI openai¶

The OpenAI platform API paid by the deployment's own key. Routes are openai/<model> over openai-chat. Not to be confused with codex: that route spends an agent's ChatGPT subscription through an OAuth bearer against the ChatGPT backend, this one spends the deployment's platform account through an API key against api.openai.com.

How we authenticate¶

There is no login flow here. OpenAI issues a long-lived sk-... API key in its console; an operator stores it once in the Skarbiec vault, and at final use the gateway redeems the deployment's capability for this provider through the local entitlements router, reduces the stored document to the bare key, and sends it as Authorization: Bearer <key>. The key has no refresh path and no invented expiry — it works until OpenAI revokes it or an operator replaces it in the vault.

The two failure shapes point at two different repairs: a 503 credential_unauthorized means no capability, read grant or trust material produced a key at final use — repair the authorization chain (runbook); a 502 provider_failure with provider_authentication: Incorrect API key provided: ... means the key was produced and OpenAI rejected it — repair the provider account.

Models¶

No pinned rows: the catalog is discovered live from https://api.openai.com/v1/models. Discovery follows the shared provider transport contract; public metadata comes from models.dev and is advisory only. Embeddings and moderation name a concrete OpenAI model like every other route (openai/text-embedding-3-small, openai/omni-moderation-latest), usually through an alias the route registry declares; no route stands for a model Brama chose, and a model OpenAI does not serve on that endpoint is refused in OpenAI's words. Chat names a concrete openai/<model> or an alias the route registry points here.

Plan usage¶

OpenAI publishes no free plan-usage report for API keys. The ledger records that absence as the provider's own answer, never as a zero (subscription).

Endpoints¶

This is the one provider here that generates in every shape. The media paths are reached through the image-model, video-model and voice-model aliases or a canonical route the catalogue lists as that kind, and they are paid by this deployment's own key rather than by any subscription (media).