Yes, you can even have it tpm-backed. echo -n "sk-proj-12345..." | systemd-creds encrypt --with-key=tpm2 --name=openai_key - openai.cred And then at runtime e

Yes, you can even have it tpm-backed. echo -n "sk-proj-12345..." | systemd-creds encrypt --with-key=tpm2 --name=openai_key - openai.cred And then at runtime export OPENAI_API_KEY=$(sudo systemd-creds decrypt openai.cred)