Configure the private OPENAI_API_KEY secret on the Cloudflare worker. The key never enters the browser.