Complete procedures with a way back.

Build a server-only OpenAI integration with project-scoped service accounts, tenant authorization, application quotas, project spend alerts, privacy-preserving audit events, retention controls, key rotation, and tested incident recovery.

Generate a protected key, publish and verify DNS, sign only owned outbound domains, test canonicalization and alignment, monitor failures, and rehearse rotation.