JS Credential Rotation

Update OPENAI_API_KEY or OPENAI_BASE_URL at runtime without restarting the process

praisonai-ts picks up a changed OPENAI_API_KEY or OPENAI_BASE_URL on the next call — no restart, no code change.

The env-only OpenAI client caches on client identity (apiKey + baseURL). Rotate either and the next call rebuilds automatically — the exact flow a settings screen needs when a user pastes a new key.

Quick Start

1. Rotate the key in your settings screen

   Set the env var; the next call uses the new key.

   import { Agent } from 'praisonai';
   
   process.env.OPENAI_API_KEY = 'sk-new';
   const agent = new Agent({ instructions: 'You are helpful' });
   await agent.chat('Hello');   // uses sk-new — no restart

2. Point at a different gateway

   Set OPENAI_BASE_URL; the next call rebuilds against the new endpoint.

   process.env.OPENAI_BASE_URL = 'https://gateway.example/v1';
   await agent.chat('Hello via gateway');   // rebuilt against the new endpoint

3. Force a rebuild explicitly

   Call resetOpenAIClient() to rebuild on the next call — useful in tests and after a bulk settings change.

   import { resetOpenAIClient } from 'praisonai';
   
   resetOpenAIClient();
   await agent.chat('Fresh client');

How It Works

The env-only client keys its cache on apiKey + baseURL. A settings-screen edit to either env var changes that identity, so the next getOpenAIClient() rebuilds.

When Does This Apply?

Rotation applies only to the shared env-only client. Per-agent credentials never touch that cache.

An Agent built with an explicit apiKey or baseURL gets its own dedicated client, so a later env-var change does not affect it. Rotate by constructing a new Agent with the new value.

Concurrency

A resetOpenAIClient() or credential change that races an in-flight request is safe. Each caller keeps the client it built for its own identity — an overlapping call that swaps the key never hands back another call’s client, and a reset mid-flight never yields null.

Security

The identity that keys the cache contains the secret key. praisonai-ts never logs it — do not add logging that prints it either.

API Reference

Two exports back the rotation contract. The recommended user surface stays new Agent(...) and agent.chat(...).

import { Agent } from 'praisonai';

process.env.OPENAI_API_KEY = 'sk-first';
const agent = new Agent({ instructions: 'You are helpful' });
await agent.chat('Hello');           // uses sk-first

// Settings screen updates the env var:
process.env.OPENAI_API_KEY = 'sk-second';
await agent.chat('Hello again');     // rebuilds automatically; uses sk-second

import { Agent } from 'praisonai';

process.env.OPENAI_API_KEY = 'sk-shared';
process.env.OPENAI_BASE_URL = 'https://gateway-a.example/v1';
const agent = new Agent({ instructions: 'You are helpful' });
await agent.chat('Hello via gateway A');

process.env.OPENAI_BASE_URL = 'https://gateway-b.example/v1';
await agent.chat('Hello via gateway B');   // rebuilt against gateway B

import { Agent, resetOpenAIClient } from 'praisonai';

process.env.OPENAI_API_KEY = 'sk-stable';
const agent = new Agent({ instructions: 'You are helpful' });
await agent.chat('One');

resetOpenAIClient();                   // force next call to rebuild
await agent.chat('Two');               // fresh client, same env