01 / Keys
Keep credentials out of clients.
OpenWaya API keys belong only in trusted server environments. Keys are organization-scoped, shown once, stored as non-reversible verifier material, and identified by a safe prefix for rotation and audit workflows.
Server-side initialization
const client = new OpenAI({
apiKey: process.env.OPENWAYA_API_KEY,
baseURL: "https://api.openwaya.africa/v1",
});02 / Least privilege
Limit blast radius by design.
Use separate keys for each environment and workload. Grant the narrowest available scope, rotate on a schedule and after personnel or system changes, revoke immediately on suspected exposure, and never reuse provider credentials as OpenWaya client keys.
- Never commit keys, print them, place them in URLs, or send them to analytics.
- Protect admin changes with step-up authentication and four-eyes approval where required.
- Keep tenant ID and authorization predicates in every organization-owned query.
03 / Data
Minimize before encrypting.
Collect only the data needed to route, meter, support, and secure a request. Safe operational logs use request IDs and bounded metadata; prompts, outputs, bearer keys, payment credentials, and raw webhook bodies are excluded from routine logs.