Keep the application key on your server
Session operations require api.agents.read and api.agents.write; inference requires api.responses.write. Vault management needs its corresponding permissions. Do not expose this key in client JavaScript or in the agent sandbox.
Executor keys have a different job
The self-hosted executor uses an environment key as CODEX_API_KEY. It only permits environment connections. Agent-generated code can read environment credentials, which is why the application key belongs outside this compute boundary.
Tools are authority boundaries
Validate function inputs and enforce authorization inside the function or downstream service. Use separate environments for workloads that must not share data. Restrict network destinations and use credential brokers where possible. Require human approval in your application before high-impact actions.
Check data controls separately
The documented Agents API data controls currently support US data residency and do not support Zero Data Retention. Choosing a self-hosted sandbox does not make the managed service ZDR-eligible. Verify current endpoint-specific retention requirements for your workload.
Read the official reference
Check the source for current API fields, account requirements, and service limits.
OpenAI: security Agents API data controls