Fix 401 "Incorrect API key provided" in production but not locally

The problem

Worked locally; the deployed function threw:

AuthenticationError: Error code: 401 - {'error': {'message': 'Incorrect API key provided:
 sk-proj-***. You can find your API key at https://platform.openai.com/account/api-keys.'}}

Actually worse than a wrong key: the env var was undefined in production, so the SDK sent no credential at all.

What didn't work

• Adding the key to .env.local — gitignored by convention and never uploaded; it exists only on your machine.
• console.log(process.env.OPENAI_API_KEY) inside the handler — locally it prints a key, in prod undefined... but the module-scope new OpenAI() was ALREADY constructed with undefined, so the log told me the truth after the damage.
• Rotating the key because "it leaked" — the new key also 401s, because the deployed runtime was never reading any key.

The fix

// lib/openai.ts — validate at import time, not at the first request
const apiKey = process.env.OPENAI_API_KEY;
if (!apiKey?.startsWith('sk-')) {
  throw new Error(
    'OPENAI_API_KEY missing or malformed — check the DEPLOYMENT environment variables, not .env.local'
  );
}
export const openai = new OpenAI({ apiKey });

# verify what the deployed runtime will actually see, before deploying:
vercel env pull .env.production.local --environment=production
grep OPENAI .env.production.local

Why it works

Module-scope construction snapshots the environment at cold start, so a missing variable silently yields a client with no key; validating the sk- prefix at import turns a runtime 401 into a boot error that names the variable and points at the deployment env where it must be set.