Your code asks for access. It never holds the key.

// npm install @grant/sdk openai
import { grant } from "@grant/sdk";

const openai = grant.client("openai");   // self-refreshing, budget-capped

const reply = await openai.chat.completions.create({
  model: "gpt-4.1",
  messages: [{ role: "user", content: "Hello" }],
});

# pip install grant-sdk openai
import grant

openai = grant.client("openai")              # the official OpenAI client
reply = openai.chat.completions.create(
    model="gpt-4.1",
    messages=[{"role": "user", "content": "Hello"}],
)

balance = grant.request("stripe", "GET", "/v1/balance")  # any HTTP API

# The agent gets lease tokens. Your identity token is removed.
$ grant run --cap openai,anthropic -- claude

grant: openai leased (broker, 900s, renewed while running)
grant: anthropic leased (broker, 900s, renewed while running)

# When the session ends, both leases are revoked.

// grant.json, committed with the code and reviewed in pull requests
{
  "capabilities": {
    "openai":      { "intent": "dev" },
    "stripe-live": { "reason": "refund flow" }
  }
}

$ grant check
ok       openai       allow
pending  stripe-live  approval_required