openai 7.7.0 → 7.8.0

package/src/auth/types.ts

@@ -21,7 +21,7 @@ export interface WorkloadIdentity {
   /** Provider that obtains the external subject token for each token exchange. */
   provider: SubjectTokenProvider;
 
-  /** Seconds before expiration when access-token refresh begins; defaults to 1,200 seconds. */
+  /** Seconds before expiration when access-token refresh begins; defaults to 1,200 seconds and is capped at half of the actual token lifetime. */
   refreshBufferSeconds?: number;
 }
 
@@ -36,7 +36,10 @@ export interface X509WorkloadIdentity {
   /** OpenAI service account authorized for the verified certificate identity. */
   serviceAccountId: string;
 
-  /** Optional milliseconds before expiry when the certificate-backed token should refresh. */
+  /** Seconds before expiration when access-token refresh begins; defaults to 1,200 seconds. */
+  refreshBufferSeconds?: number;
+
+  /** @deprecated Use refreshBufferSeconds to match other workload-identity credentials. */
   refreshBufferMs?: number;
 
   /** X.509 federation proves certificate possession instead of supplying a subject token. */
@@ -44,9 +47,12 @@ export interface X509WorkloadIdentity {
 
   /** X.509 federation does not send an OAuth client identifier. */
   clientId?: never;
+}
 
-  /** X.509 federation does not accept subject-token refresh configuration. */
-  refreshBufferSeconds?: never;
+/** An SDK-owned certificate credential created by the Node-only X.509 authentication helper. */
+export interface X509Credential {
+  /** Closes the credential's owned certificate transport after requests have finished. */
+  close: () => Promise<void>;
 }
 
 /** OAuth token-exchange response returned by the OpenAI workload-identity endpoint. */

package/src/auth/workload-identity-auth.ts

@@ -6,6 +6,7 @@ import { APIError, OAuthError, OpenAIError } from '../core/error';
 interface CachedToken {
   token: string;
   expiresAt: number;
+  refreshAt: number;
 }
 
 const SUBJECT_TOKEN_TYPES: Record<WorkloadIdentity['provider']['tokenType'], string> = {
@@ -14,6 +15,20 @@ const SUBJECT_TOKEN_TYPES: Record<WorkloadIdentity['provider']['tokenType'], str
 };
 
 const TOKEN_EXCHANGE_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:token-exchange';
+// Cap the refresh buffer at half the actual token lifetime, matching the X.509
+// workload-identity path, so short-lived tokens keep a usable cache window.
+const MAX_REFRESH_BUFFER_FRACTION = 0.5;
+
+function calculateRefreshAt(
+  expiresAt: number,
+  now: number,
+  refreshBufferSeconds: number | undefined,
+): number {
+  const configuredBufferMs = (refreshBufferSeconds ?? 1200) * 1000;
+  const effectiveBufferMs = Math.min(configuredBufferMs, (expiresAt - now) * MAX_REFRESH_BUFFER_FRACTION);
+  return expiresAt - effectiveBufferMs;
+}
+
 const NATIVE_RESPONSE_PROTOTYPE = Response.prototype;
 const READ_NATIVE_RESPONSE_BODY = NATIVE_RESPONSE_PROTOTYPE.arrayBuffer;
 
@@ -133,7 +148,17 @@ export class WorkloadIdentityAuth {
    * @param fetch Optional fetch implementation for calls to the OpenAI token endpoint.
    */
   constructor(config: WorkloadIdentity, fetch?: Fetch) {
-    this.config = config;
+    const { identityProviderId, serviceAccountId, clientId, refreshBufferSeconds, provider } = config;
+    this.config = {
+      identityProviderId,
+      serviceAccountId,
+      ...(clientId === undefined ? {} : { clientId }),
+      ...(refreshBufferSeconds === undefined ? {} : { refreshBufferSeconds }),
+      provider: {
+        tokenType: provider.tokenType,
+        getToken: provider.getToken.bind(provider),
+      },
+    };
     this.fetch = fetch ?? Shims.getDefaultFetch();
   }
 
@@ -165,7 +190,7 @@ export class WorkloadIdentityAuth {
       }
     }
 
-    if (this.needsRefresh(this.cachedToken) && !this.refreshPromise) {
+    if (WorkloadIdentityAuth.needsRefresh(this.cachedToken) && !this.refreshPromise) {
       const refreshPromise = this.refreshToken(this.tokenGeneration).finally(() => {
         if (this.refreshPromise === refreshPromise) {
           this.refreshPromise = null;
@@ -250,6 +275,7 @@ export class WorkloadIdentityAuth {
       this.cachedToken = {
         token: accessToken,
         expiresAt,
+        refreshAt: calculateRefreshAt(expiresAt, now, this.config.refreshBufferSeconds),
       };
     }
 
@@ -260,10 +286,8 @@ export class WorkloadIdentityAuth {
     return Date.now() >= cachedToken.expiresAt;
   }
 
-  private needsRefresh(cachedToken: CachedToken): boolean {
-    const bufferSeconds = this.config.refreshBufferSeconds ?? 1200;
-    const bufferMs = bufferSeconds * 1000;
-    return Date.now() >= cachedToken.expiresAt - bufferMs;
+  private static needsRefresh(cachedToken: CachedToken): boolean {
+    return Date.now() >= cachedToken.refreshAt;
   }
 
   /** Discards the cached access token so the next request performs a fresh exchange. */

package/src/auth/x509-transport.ts

@@ -1,15 +1,284 @@
 import { AsyncLocalStorage } from 'node:async_hooks';
+import { createPrivateKey, X509Certificate } from 'node:crypto';
 import { setTimeout as delay } from 'node:timers/promises';
+import { types } from 'node:util';
+import { Agent, ProxyAgent } from 'undici';
 import {
   createX509Transport as createCapability,
   registerX509Transport,
   sendX509Request,
 } from '../internal/auth/x509-transport-capability';
-import type { X509Transport, X509TransportOptions } from '../internal/auth/x509-transport-capability';
+import type {
+  X509ProxyMode,
+  X509Transport,
+  X509TransportOptions,
+} from '../internal/auth/x509-transport-capability';
 import { exchangeX509Token } from '../internal/auth/x509-token-exchange';
 import { isRetryableX509TransportFailure } from '../internal/auth/x509-transport-registry';
 import type { X509RequestScope } from '../internal/auth/x509-transport-registry';
-import { markTransientX509ConnectionError } from '#x509-transport-state';
+import { markTransientX509ConnectionError, rememberX509Credential } from '#x509-transport-state';
+import type { X509Credential, X509WorkloadIdentity } from './types';
+
+/** Explicit, separately trusted CONNECT configuration for an SDK-owned X.509 credential. */
+export interface X509CredentialProxyOptions {
+  /** CONNECT proxy endpoint; its protocol must match the selected mode. */
+  url: string | URL;
+
+  /** Whether the connection to the CONNECT proxy itself is encrypted. */
+  mode: Exclude<X509ProxyMode, 'direct'>;
+
+  /** Optional private trust roots for the HTTPS proxy; never used for workload TLS. */
+  ca?: string | string[] | undefined;
+}
+
+/** Private certificate material and enrolled selectors for one SDK-owned workload credential. */
+export interface X509CredentialOptions {
+  /** Leaf client certificate followed by its required PEM intermediate chain. */
+  certificateChain: string;
+
+  /** PEM private key matching the leaf client certificate. */
+  privateKey: string;
+
+  /** Existing OpenAI identity-provider resource enrolled for the certificate. */
+  identityProviderId: string;
+
+  /** OpenAI service account authorized for the verified certificate identity. */
+  serviceAccountId: string;
+
+  /** Optional private certificate authorities trusted for OpenAI's issuer and API. */
+  ca?: string | string[] | undefined;
+
+  /** Optional passphrase used to decrypt an encrypted PEM private key. */
+  passphrase?: string | undefined;
+
+  /** Optional CONNECT proxy with separately scoped target and proxy TLS settings. */
+  proxy?: X509CredentialProxyOptions | undefined;
+
+  /** Seconds before expiration when access-token refresh begins; defaults to 1,200. */
+  refreshBufferSeconds?: number | undefined;
+}
+
+const credentialOptionNames = new Set([
+  'certificateChain',
+  'privateKey',
+  'identityProviderId',
+  'serviceAccountId',
+  'ca',
+  'passphrase',
+  'proxy',
+  'refreshBufferSeconds',
+]);
+const proxyOptionNames = new Set(['url', 'mode', 'ca']);
+
+function safeOptionRecord(
+  value: unknown,
+  allowed: ReadonlySet<string>,
+  label: string,
+): Record<string, unknown> {
+  if (!value || typeof value !== 'object' || types.isProxy(value)) {
+    throw new Error(`X.509 ${label} options must be a non-proxy object.`);
+  }
+  const prototype: unknown = Object.getPrototypeOf(value);
+  if (prototype !== Object.prototype && prototype !== null) {
+    throw new Error(`X.509 ${label} options must have only own plain data properties.`);
+  }
+  const snapshot = Object.create(null) as Record<string, unknown>;
+  for (const name of Reflect.ownKeys(value)) {
+    if (typeof name !== 'string' || !allowed.has(name)) {
+      throw new Error(`Unsupported X.509 ${label} option: \`${String(name)}\`.`);
+    }
+    const descriptor = Object.getOwnPropertyDescriptor(value, name);
+    if (!descriptor || !('value' in descriptor)) {
+      throw new Error(`X.509 ${label} option \`${name}\` must be a plain data property.`);
+    }
+    snapshot[name] = descriptor.value;
+  }
+  return snapshot;
+}
+
+function requiredCredentialValue(options: Record<string, unknown>, name: string): string {
+  const value = options[name];
+  if (typeof value !== 'string' || value.trim().length === 0) {
+    throw new Error(`X.509 credential requires a nonempty own \`${name}\` value.`);
+  }
+  return value;
+}
+
+function snapshotCertificateAuthorities(value: unknown): string | string[] | undefined {
+  if (value === undefined) {
+    return undefined;
+  }
+  if (typeof value === 'string') {
+    if (value.trim().length === 0) {
+      throw new Error('X.509 certificate authorities must contain nonempty PEM values.');
+    }
+    return value;
+  }
+  if (!Array.isArray(value) || types.isProxy(value) || value.length === 0) {
+    throw new Error('X.509 certificate authorities must be a PEM string or plain PEM string array.');
+  }
+  const authorities: string[] = [];
+  for (let index = 0; index < value.length; index += 1) {
+    const entry = Object.getOwnPropertyDescriptor(value, String(index));
+    if (!entry || !('value' in entry) || typeof entry.value !== 'string' || entry.value.trim().length === 0) {
+      throw new Error('X.509 certificate authorities require own plain nonempty PEM strings.');
+    }
+    authorities.push(entry.value);
+  }
+  return authorities;
+}
+
+class OwnedX509Credential implements X509Credential {
+  readonly #dispatcher: Agent | ProxyAgent;
+  #closing: Promise<void> | undefined;
+
+  constructor(dispatcher: Agent | ProxyAgent) {
+    this.#dispatcher = dispatcher;
+    Object.freeze(this);
+  }
+
+  /** Closes this credential's owned transport once all in-flight requests have drained. */
+  close(): Promise<void> {
+    this.#closing ??= this.#dispatcher.close();
+    return this.#closing;
+  }
+}
+
+interface ValidatedX509CredentialOptions {
+  certificateChain: string;
+  privateKey: string;
+  identityProviderId: string;
+  serviceAccountId: string;
+  refreshBufferSeconds: number | undefined;
+  passphrase: string | undefined;
+  ca: string | string[] | undefined;
+  proxy: unknown;
+}
+
+function validatedCredentialOptions(options: X509CredentialOptions): ValidatedX509CredentialOptions {
+  const configured = safeOptionRecord(options, credentialOptionNames, 'credential');
+  const certificateChain = requiredCredentialValue(configured, 'certificateChain');
+  const privateKeyPEM = requiredCredentialValue(configured, 'privateKey');
+  const identityProviderId = requiredCredentialValue(configured, 'identityProviderId');
+  const serviceAccountId = requiredCredentialValue(configured, 'serviceAccountId');
+  const { refreshBufferSeconds, passphrase } = configured;
+  if (passphrase !== undefined && typeof passphrase !== 'string') {
+    throw new Error('X.509 credential requires a string private-key passphrase.');
+  }
+  if (
+    refreshBufferSeconds !== undefined &&
+    (typeof refreshBufferSeconds !== 'number' ||
+      !Number.isSafeInteger(refreshBufferSeconds) ||
+      refreshBufferSeconds < 0 ||
+      !Number.isSafeInteger(refreshBufferSeconds * 1000))
+  ) {
+    throw new Error('X.509 credential requires a nonnegative integer refreshBufferSeconds.');
+  }
+  const ca = snapshotCertificateAuthorities(configured['ca']);
+
+  const leaf = new X509Certificate(certificateChain);
+  const privateKey = createPrivateKey({
+    key: privateKeyPEM,
+    ...(passphrase === undefined ? {} : { passphrase }),
+  });
+  if (!leaf.checkPrivateKey(privateKey)) {
+    throw new Error('X.509 credential private key must match its leaf client certificate.');
+  }
+
+  return {
+    certificateChain,
+    privateKey: privateKeyPEM,
+    identityProviderId,
+    serviceAccountId,
+    refreshBufferSeconds,
+    passphrase,
+    ca,
+    proxy: configured['proxy'],
+  };
+}
+
+interface VerifiedX509TLSOptions {
+  cert: string;
+  key: string;
+  rejectUnauthorized: true;
+  passphrase?: string;
+  ca?: string | string[];
+}
+
+function proxyAuthentication(url: URL): string | undefined {
+  if (url.username === '' && url.password === '') {
+    return undefined;
+  }
+  let username: string;
+  let password: string;
+  try {
+    username = decodeURIComponent(url.username);
+    password = decodeURIComponent(url.password);
+  } catch {
+    throw new Error('X.509 CONNECT proxy credentials contain invalid URL encoding.');
+  }
+  if (username.includes(':')) {
+    throw new Error('X.509 CONNECT proxy username cannot contain a colon.');
+  }
+  return Buffer.from(`${username}:${password}`, 'utf-8').toString('base64');
+}
+
+function normalizeProxyURL(value: unknown): URL {
+  if (typeof value !== 'string' && (typeof value !== 'object' || value === null || types.isProxy(value))) {
+    throw new Error('X.509 CONNECT proxy requires an own URL string or URL value.');
+  }
+  try {
+    return new URL(typeof value === 'string' ? value : URL.prototype.toString.call(value));
+  } catch {
+    throw new Error('X.509 CONNECT proxy requires a valid proxy URL.');
+  }
+}
+
+function credentialDispatcher(
+  proxyOptionsInput: unknown,
+  requestTls: VerifiedX509TLSOptions,
+): { dispatcher: Agent | ProxyAgent; proxy: X509ProxyMode } {
+  if (proxyOptionsInput === undefined) {
+    return { dispatcher: new Agent({ connect: requestTls }), proxy: 'direct' };
+  }
+
+  const proxyOptions = safeOptionRecord(proxyOptionsInput, proxyOptionNames, 'proxy');
+  const url = normalizeProxyURL(proxyOptions['url']);
+  const selected = proxyOptions['mode'];
+  const proxy: X509ProxyMode =
+    selected === 'http-connect' || selected === 'https-connect' ? selected : 'direct';
+  if (
+    (proxy !== 'http-connect' && proxy !== 'https-connect') ||
+    url.protocol !== (proxy === 'https-connect' ? 'https:' : 'http:') ||
+    url.pathname !== '/' ||
+    url.search ||
+    url.hash
+  ) {
+    throw new Error('X.509 CONNECT proxy URL protocol must match its selected secure proxy mode.');
+  }
+  const proxyCA = snapshotCertificateAuthorities(proxyOptions['ca']);
+  if (proxy === 'http-connect' && proxyCA !== undefined) {
+    throw new Error('A plaintext X.509 CONNECT proxy cannot configure proxy TLS authorities.');
+  }
+  const auth = proxyAuthentication(url);
+
+  return {
+    proxy,
+    dispatcher: new ProxyAgent({
+      uri: url.href,
+      ...(auth === undefined ? {} : { auth }),
+      requestTls,
+      ...(proxy === 'https-connect'
+        ? {
+            proxyTls: {
+              rejectUnauthorized: true,
+              ...(proxyCA === undefined ? {} : { ca: proxyCA }),
+            },
+          }
+        : {}),
+    }),
+  };
+}
 
 /** Creates one frozen, caller-attested Node.js transport for X.509 workload authentication. */
 export function createX509Transport(options: X509TransportOptions): X509Transport {
@@ -42,6 +311,46 @@ export function createX509Transport(options: X509TransportOptions): X509Transpor
   return capability;
 }
 
+/** Creates a first-class certificate credential with SDK-owned, verified TLS and CONNECT policy. */
+export function fromX509(options: X509CredentialOptions): X509Credential {
+  const configured = validatedCredentialOptions(options);
+
+  const requestTls = {
+    cert: configured.certificateChain,
+    key: configured.privateKey,
+    rejectUnauthorized: true as const,
+    ...(configured.passphrase === undefined ? {} : { passphrase: configured.passphrase }),
+    ...(configured.ca === undefined ? {} : { ca: configured.ca }),
+  };
+  const { dispatcher, proxy } = credentialDispatcher(configured.proxy, requestTls);
+
+  try {
+    const transport = createX509Transport({
+      runtime: 'node',
+      dispatcher,
+      certificateIdentity: 'static',
+      proxy,
+    });
+    const identity: X509WorkloadIdentity = Object.freeze({
+      type: 'x509',
+      identityProviderId: configured.identityProviderId,
+      serviceAccountId: configured.serviceAccountId,
+      ...(configured.refreshBufferSeconds === undefined
+        ? {}
+        : { refreshBufferSeconds: configured.refreshBufferSeconds }),
+    });
+    const credential = new OwnedX509Credential(dispatcher);
+    rememberX509Credential(credential, Object.freeze({ identity, transport }));
+    return credential;
+  } catch (error) {
+    void dispatcher.close();
+    throw error;
+  }
+}
+
+/** Namespaced first-class credential factory, isolated from ordinary browser-safe auth imports. */
+export const workloadIdentity = Object.freeze({ fromX509 });
+
 export type {
   X509ProxyMode,
   X509Transport,

package/src/azure.ts

@@ -13,7 +13,7 @@ import { assertNoDataResidency } from './internal/data-residency';
 /** API Client for interfacing with the Azure OpenAI API. */
 export interface AzureClientOptions extends Omit<
   ClientOptions,
-  'provider' | 'dataResidency' | 'workloadIdentity' | 'x509Transport'
+  'provider' | 'dataResidency' | 'credential' | 'workloadIdentity' | 'x509Transport'
 > {
   /** AzureOpenAI does not support third-party provider configuration. */
   provider?: never;
@@ -21,6 +21,9 @@ export interface AzureClientOptions extends Omit<
   /** OpenAI data residency cannot be combined with Azure routing. */
   dataResidency?: never;
 
+  /** Azure cannot receive an SDK-owned OpenAI X.509 certificate credential. */
+  credential?: never;
+
   /** Azure cannot receive OpenAI X.509 workload-identity certificate transports. */
   x509Transport?: never;
 

package/src/bedrock.ts

@@ -20,7 +20,7 @@ import type * as ResponsesAPI from './resources/responses/responses';
 /** Configures Amazon Bedrock's OpenAI-compatible endpoint and bearer-token authentication. */
 export interface BedrockClientOptions extends Omit<
   ClientOptions,
-  'apiKey' | 'adminAPIKey' | 'baseURL' | 'workloadIdentity' | 'x509Transport' | 'dataResidency'
+  'apiKey' | 'adminAPIKey' | 'baseURL' | 'credential' | 'workloadIdentity' | 'x509Transport' | 'dataResidency'
 > {
   /**
    * Bedrock bearer token used for authentication.
@@ -46,6 +46,9 @@ export interface BedrockClientOptions extends Omit<
   /** OpenAI data residency cannot be combined with Bedrock routing. */
   dataResidency?: never;
 
+  /** Bedrock cannot receive an SDK-owned OpenAI X.509 certificate credential. */
+  credential?: never;
+
   /**
    * BedrockOpenAI only supports Bedrock bearer token authentication.
    */

package/src/beta/realtime/ws.ts

@@ -3,6 +3,7 @@ import { assertBedrockWebSocketOrigin } from '../../internal/bedrock';
 import { protectWebSocketOptionsFromCredentialRedirects } from '../../internal/ws';
 import type { AzureOpenAI } from '../../index';
 import { OpenAI } from '../../index';
+import { VERSION } from '../../version';
 import type { RealtimeClientEvent } from '../../resources/beta/realtime/realtime';
 import { OpenAIRealtimeEmitter, buildRealtimeURL, isAzure, parseRealtimeEvent } from './internal-base';
 import type { RealtimeConnectionConfig } from './internal-base';
@@ -68,6 +69,7 @@ export class OpenAIRealtimeWS extends OpenAIRealtimeEmitter {
     assertTrustedRealtimeURL(client, this.url);
     assertBedrockWebSocketOrigin(client, this.url);
     const headers = {
+      'User-Agent': `${client.constructor.name}/JS ${VERSION}`,
       ...props.options?.headers,
       ...(isAzure(client) && !props.__resolvedApiKey ? {} : { Authorization: `Bearer ${client.apiKey}` }),
       'OpenAI-Beta': 'realtime=v1',

package/src/client.ts

@@ -17,17 +17,20 @@ import { resolveDataResidency, type DataResidency } from './internal/data-reside
 export type { DataResidency } from './internal/data-residency';
 import * as Errors from './core/error';
 import * as Pagination from './core/pagination';
-import type { WorkloadIdentity, X509WorkloadIdentity } from './auth/types';
+import type { WorkloadIdentity, X509Credential, X509WorkloadIdentity } from './auth/types';
 import { WorkloadIdentityAuth } from './auth/workload-identity-auth';
+import { X509_API_BASE_URL, assertX509APIOrigin } from './internal/auth/x509-api-origin';
 import {
-  X509_API_BASE_URL,
   X509WorkloadIdentityAuth,
-  assertX509APIOrigin,
   assertX509RequestOptions,
   isX509WorkloadIdentity,
   snapshotX509RequestOptions,
 } from './internal/auth/x509-workload-identity-auth';
 import type { X509Transport } from './internal/auth/x509-transport-registry';
+import {
+  normalizeX509CredentialOptions,
+  prepareX509ClientClone,
+} from './internal/auth/x509-credential-options';
 import { isTransientX509ConnectionError, markApprovedX509Client } from '#x509-transport-state';
 import { OAuthError, SubjectTokenProviderError } from './core/error';
 import {
@@ -258,6 +261,7 @@ import {
   formatRequestDetails,
   loggerFor,
   parseLogLevel,
+  redactURL,
 } from './internal/utils/log';
 import { isEmptyObj } from './internal/utils/values';
 
@@ -430,6 +434,9 @@ export interface ClientOptions {
   /** Approved, frozen Node.js certificate transport required only for X.509 workload identity. */
   x509Transport?: X509Transport | undefined;
 
+  /** First-class certificate credential created with `fromX509` from `openai/auth/x509-transport`. */
+  credential?: X509Credential | undefined;
+
   /**
    * Configure this client to use a third-party API provider.
    * Mutually exclusive with top-level authentication and `baseURL` options.
@@ -457,6 +464,7 @@ export class OpenAI {
   private fetch: Fetch;
   #encoder: Opts.RequestEncoder;
   #x509Authentication: X509WorkloadIdentityAuth | undefined;
+  #x509Credential: X509Credential | undefined;
   #x509Fetch: Fetch | undefined;
   // Preserve an explicit global selection without storing a second routing URL.
   #explicitDataResidency = false;
@@ -495,6 +503,8 @@ export class OpenAI {
    * @param {boolean} [opts.dangerouslyAllowBrowser=false] - By default, client-side use of this library is not allowed, as it risks exposing your secret API credentials to attackers.
    */
   constructor(clientOptions: ClientOptions = {}) {
+    const { credential, options: normalizedOptions } = normalizeX509CredentialOptions(clientOptions);
+    clientOptions = normalizedOptions;
     const residencyBaseURL = resolveDataResidency(clientOptions);
     const provider = clientOptions.provider;
     const {
@@ -508,6 +518,7 @@ export class OpenAI {
       webhookSecret = readEnv('OPENAI_WEBHOOK_SECRET') ?? null,
       workloadIdentity,
       x509Transport,
+      credential: _credential,
       ...opts
     } = clientOptions as InternalClientOptions;
     if (provider) {
@@ -601,7 +612,7 @@ export class OpenAI {
     this.fetch = options.fetch ?? Shims.getDefaultFetch();
     this.#encoder = Opts.FallbackEncoder;
 
-    const customHeadersEnv = provider ? undefined : readEnv('OPENAI_CUSTOM_HEADERS');
+    const customHeadersEnv = provider || credential ? undefined : readEnv('OPENAI_CUSTOM_HEADERS');
     if (customHeadersEnv) {
       const parsed: Record<string, string> = {};
       for (const line of customHeadersEnv.split('\n')) {
@@ -620,6 +631,7 @@ export class OpenAI {
       const authentication = new X509WorkloadIdentityAuth(x509Identity, x509Transport, organization, project);
       this._workloadIdentityAuth = authentication;
       this.#x509Authentication = authentication;
+      this.#x509Credential = credential;
       this.#x509Fetch = authentication.fetch();
       this.fetch = this.#x509Fetch;
       markApprovedX509Client(this);
@@ -639,8 +651,6 @@ export class OpenAI {
    */
   withOptions(options: Partial<ClientOptions>): this {
     const residencyBaseURL = resolveDataResidency(options);
-    const inheritedProvider = this._options.provider;
-    const provider = options.provider ?? inheritedProvider;
     const x509Authentication = this.#x509Authentication;
     const inheritedOptions: ClientOptions = {
       ...this._options,
@@ -659,47 +669,41 @@ export class OpenAI {
       project: this.project,
       webhookSecret: this.webhookSecret,
     };
-    const currentlyX509 = x509Authentication !== undefined;
-    const nextIdentity = hasOwn(options, 'workloadIdentity')
-      ? options.workloadIdentity
-      : inheritedOptions.workloadIdentity;
-    const nextX509 = isX509WorkloadIdentity(nextIdentity);
-    if (currentlyX509 !== nextX509) {
-      delete inheritedOptions.fetch;
-      delete inheritedOptions.baseURL;
-      if (nextX509) {
-        inheritedOptions.apiKey = null;
-      } else {
-        delete inheritedOptions.x509Transport;
-      }
-    }
+    const { credential, provider } = prepareX509ClientClone(
+      inheritedOptions,
+      options,
+      this.#x509Credential,
+      x509Authentication !== undefined,
+    );
     if (residencyBaseURL !== undefined) {
       delete inheritedOptions.baseURL;
     }
-    if (provider) {
-      delete inheritedOptions.apiKey;
-      delete inheritedOptions.adminAPIKey;
-      delete inheritedOptions.workloadIdentity;
-      delete inheritedOptions.x509Transport;
-      delete inheritedOptions.baseURL;
-      if (provider !== inheritedProvider) {
-        delete inheritedOptions.organization;
-        delete inheritedOptions.project;
-        delete inheritedOptions.defaultHeaders;
-      }
-    }
 
     const clientOptions: InternalClientOptions = {
       ...inheritedOptions,
       ...options,
+      credential,
       provider,
       [inheritedDataResidencySelection]:
         this.#explicitDataResidency &&
         residencyBaseURL === undefined &&
         !hasOwn(options, 'baseURL') &&
+        options.credential === undefined &&
         !provider,
     };
     const client = new (this.constructor as any as new (props: ClientOptions) => typeof this)(clientOptions);
+    if (provider && new URL(client.baseURL).origin !== new URL(this.baseURL).origin) {
+      Object.assign(client._options, {
+        defaultHeaders: options.defaultHeaders,
+        defaultQuery: options.defaultQuery,
+        fetchOptions: options.fetchOptions,
+        fetch: options.fetch,
+      });
+      client.fetchOptions = options.fetchOptions;
+      client.fetch = options.fetch ?? Shims.getDefaultFetch();
+      client.organization = options.organization ?? null;
+      client.project = options.project ?? null;
+    }
     if (
       this.#x509Authentication &&
       client.#x509Authentication &&
@@ -1151,9 +1155,10 @@ export class OpenAI {
       retriesRemaining = maxRetries;
     }
 
+    const x509Authentication = this.#x509Authentication;
+    x509Authentication?.beginRequestPreparation();
     await this.prepareOptions(options);
 
-    const x509Authentication = this.#x509Authentication;
     x509Authentication?.beginRequestPlanning();
     let built: { req: FinalizedRequestInit; url: string; timeout: number };
     try {
@@ -1346,7 +1351,7 @@ export class OpenAI {
       .filter(([name]) => name === 'x-request-id')
       .map(([name, value]) => ', ' + name + ': ' + JSON.stringify(value))
       .join('');
-    const responseInfo = `[${requestLogID}${retryLogStr}${specialHeaders}] ${req.method} ${url} ${
+    const responseInfo = `[${requestLogID}${retryLogStr}${specialHeaders}] ${req.method} ${redactURL(url)} ${
       response.ok ? 'succeeded' : 'failed'
     } with status ${response.status} in ${headersTime - startTime}ms`;