base_url to KINDI's OpenAI proxy path and use two headers: your KINDI
key as the bearer (authenticates you to KINDI and meters the masking fee),
and your OpenAI key as X-Provider-Key (KINDI forwards your request to
OpenAI with it, never stored).https://api.kindi.me/api/v1/proxy/openai/v1Authorization: Bearer <your KINDI key> (mk_live_…)X-Provider-Key: <your OpenAI key> (sk-…)X-Provider-Key is
not in KINDI's CORS allow-list, so a browser preflight carrying it is
rejected and the request never leaves the page; call the proxy from your
backend, not from front-end JavaScript. (You wouldn't want to anyway:
a provider key in a browser is exposed to every visitor.) The
browser-reachable path is the dashboard's managed demo; see
Keys & auth.proxy_config helper that returns the exact
base_url + headers, so you don't hand-assemble them.1234567891011121314151617181920212223from openai import OpenAI from kindi import proxy_config cfg = proxy_config( "openai", kindi_api_key="mk_live_...", provider_key="sk-...", ) # cfg == {"base_url": "https://api.kindi.me/api/v1/proxy/openai/v1", # "default_headers": {"Authorization": "Bearer mk_live_...", # "X-Provider-Key": "sk-..."}} client = OpenAI( base_url=cfg["base_url"], default_headers=cfg["default_headers"], api_key="unused", # the bearer is set via default_headers ) resp = client.chat.completions.create( model="gpt-5.4-mini", messages=[{"role": "user", "content": "Summarize: patient John Doe, ID 1012345672, complains of headache."}], ) print(resp.choices[0].message.content)
12345678910from openai import OpenAI client = OpenAI( base_url="https://api.kindi.me/api/v1/proxy/openai/v1", api_key="unused", default_headers={ "Authorization": "Bearer mk_live_...", "X-Provider-Key": "sk-...", }, )
tool_calls arguments and tool (tool-result) messages, forwards, and
unmasks the response, so a tool argument containing PII is masked too.X-Kindi-Preserve-Tags header so
OpenAI is instructed to reproduce the <MASKED_…> tokens verbatim. See
Preserve tags./chat/completions only. Other OpenAI endpoints return
501 endpoint_not_supported_in_v1; see Limitations.