Call OpenAI or any other API from your hosted service without putting the key in your code.
First, confirm Yard is set up on this machine. Run `yard version`, and check that the Yard skill exists at ~/.agents/skills/yard/SKILL.md (%USERPROFILE%\.agents\skills\yard\SKILL.md on Windows). If either the CLI or the skill is missing, fetch https://yard.sh/setup.txt and follow it through to the end before you do anything else. If both are already in place, go straight to the task below. --- Add an endpoint to my Yard-hosted service that calls a third-party API (for example OpenAI, Resend or a weather API), keeping the API key in Yard secrets instead of the code. 1. Ask me which API, what the endpoint should do, and which service in .yard/settings.json it belongs to. Pick an UPPER_SNAKE secret name such as OPENAI_API_KEY (DB and ASSETS are reserved). 2. In that service's _service.js, read the key as env.<NAME> and call the API with plain fetch. If the secret is missing, answer a clear 500. Never log the key or send it back in a response. 3. For local testing, the key goes in .yard/dev/secrets.env as NAME=value (that folder is never pushed or committed). Ask me to paste the key, or let me add the line myself. Run yard dev in the background and exercise the endpoint with curl. 4. Ask me before setting the hosted value with yard service secrets set NAME=..., or let me run it myself. Confirm with yard service secrets list, then run yard service check and yard push. Secrets apply on the next deploy, so remind me the endpoint only works hosted once the next release is published. Before you finish, double-check that no key is in git.