Topic
Storage, per-tenant scoping, caching and rotation of provider API keys in application code.
The stable build includes a Custom Endpoint provider that speaks Chat Completions, Responses and Messages, so a compatible API and your own key are enough to get streamed chat and tool calls inside the editor.
Reality
Plain API keys leak more than any other credential and still have no standard kill switch, so a draft called ORKS copies OAuth's discoverable revocation endpoint and lets the person who found the key pull it.
Reality
Okta's read of one Telegram stealer dump shows commodity malware now hoovering up AI session tokens and API keys, and a replayed token walks past MFA because the second factor was spent when the token was minted.
Reality
Wire-protocol fidelity is the first row on a gateway checklist published by someone who sells a gateway, and the tests that settle it cost nothing but curl. The rows that price your supply-chain risk need the vendor to answer in writing.
Reality
A FastAPI writeup on isolating Anthropic keys per tenant is really a bug report about ambient request context, and about what breaks the moment a background task reads it.
Reality