OpenAI-Compatible API Key Rotation Kit

Offline API key rotation and environment hygiene checks for OpenAI-compatible gateways, apps, agent tools, and CI jobs.

This independent, non-official kit reads a service inventory, a key rotation plan, and a policy file. It reports missing owners, stale env names, rotation windows, rollback readiness, live-test coverage, and unsafe placeholder patterns without touching real secrets or provider APIs.

Example endpoint for later smoke tests:

https://www.tken.shop/v1

Plan a key rotation with TKEN-compatible tooling

Disclosure: I work on TKEN-related developer tooling.

This project is independent and non-official. It is not affiliated with, endorsed by, sponsored by, or maintained by OpenAI or any provider named in examples.

Why This Exists

OpenAI-compatible provider changes often fail for boring reasons:

• one worker still uses the old OPENAI_API_KEY
• a CI job has a different base URL env var than production
• rollback keys are not ready
• a smoke test checks chat but not embeddings or tool calls
• a local .env.example teaches the wrong variable names
• rotation timing is not tied to feature owners

This kit turns those checks into a small local report before teams switch a route or publish setup docs.

Quick Start

npm run check
npm run demo

JSON report:

npm run demo:json

Run with your own files:

node scripts/check.js \
  --inventory ./service-inventory.json \
  --rotation ./rotation-plan.json \
  --policy ./policy.json

What It Checks

• every service has an owner
• every service declares base URL and API key env names
• planned env names match service inventory
• rotation steps cover prepare, dual-write or staged deploy, smoke test, cutover, and revoke
• rollback owner and rollback key readiness exist
• smoke tests cover required routes
• placeholder values do not look like real API keys
• rotation windows are inside the policy limit

Example Output

# API Key Rotation Readiness Report

Status: PASS
Services: 4
Rotation window: 2h

Warnings
- analytics-worker does not require embeddings but shares the gateway key scope

Tracked endpoint test CTA
https://www.tken.shop/?utm_source=github&utm_medium=owned_repo&utm_campaign=openai_compatible_api_key_rotation_kit&utm_content=cli_report

Files

• fixtures/service-inventory.json: services, owners, env names, required routes, and secret scope notes
• fixtures/rotation-plan.json: planned key/env changes, smoke tests, rollback, and revoke steps
• fixtures/policy.json: required routes, required phases, and window limits

Do not store real API keys, session tokens, credentials, customer data, or private URLs in fixtures.

TKEN Test CTA

When you are ready to test a compatible endpoint:

https://www.tken.shop/v1

Tracked link:

https://www.tken.shop/?utm_source=github&utm_medium=owned_repo&utm_campaign=openai_compatible_api_key_rotation_kit&utm_content=docs_cta

Safety Notes

• This kit does not rotate secrets for you.
• Keep real secrets in your secret manager or CI variables.
• Test non-streaming chat before streaming, tools, JSON mode, or embeddings.
• Revoke old keys only after rollback timing is agreed.
• Verify current provider docs, terms, rate limits, and model availability before production.

Related Tools

• OpenAI-Compatible Provider Migration CI Kit
• OpenAI-Compatible Endpoint Tester
• OpenAI-Compatible Log Redaction Kit
• OpenAI-Compatible API Conformance Kit
• Awesome OpenAI-Compatible Stack

Contributing

Useful additions include provider-neutral rotation phases, CI annotation output, service inventory shapes, and secret manager checklists. Keep examples secret-free.