Quick Start
The runtime is detected automatically — pass credentials directly on the Agent.1
Browser / Electron renderer (auto-detected)
The browser guard is enabled for you — no config needed.
2
Tauri / native fetch bridge
Pass a custom
fetch to route requests through native code — the key stays out of the JS heap.3
Explicit override
Force the browser guard on or off — useful in tests.
How It Works
The Agent detects the runtime and merges the right options before constructing the OpenAI SDK.When to use which option
Pick the option that matches where your code runs and how sensitive the key is.Configuration
Four knobs control credentials and transport across every runtime.
Precedence: an explicit
dangerouslyAllowBrowser always wins — false even strips a pre-set flag. A custom fetch implies dangerouslyAllowBrowser: true, so a native bridge works even outside a webview.
buildOpenAIClientOptions Reference
TypeScript helper that merges runtime-aware options
Common Patterns
Tauri desktop app
Route every OpenAI request through a Rust command that owns the key.Electron renderer
Talk directly to OpenAI from the renderer — the guard is auto-added.React Native mobile app
navigator.product === 'ReactNative' is auto-detected.
Best Practices
Prefer injectable fetch over dangerouslyAllowBrowser in production
Prefer injectable fetch over dangerouslyAllowBrowser in production
A custom
fetch routes requests through native code, keeping the API key out of the JS heap. Reserve dangerouslyAllowBrowser for internal tools and demos.Never bundle the API key into a shipped webview build
Never bundle the API key into a shipped webview build
Anything in the JS bundle is readable. In production Tauri / Electron / mobile apps, keep the key in native code and expose only a proxy command.
Use a per-agent apiKey for multi-tenant apps
Use a per-agent apiKey for multi-tenant apps
When multiple agents talk to different tenants or endpoints, set
apiKey and baseURL per agent instead of relying on a single shared environment variable.Related
Agent
Per-agent apiKey, baseURL, and fetch
Providers
fetch and dangerouslyAllowBrowser on ProviderConfig

