// HACKER NEWS — CYBERSECURITY
OpenAI: Migrating to HTTPX2
The OpenAI Python SDK now uses HTTPX2 for its
synchronous and asynchronous HTTP clients. HTTPX2 is installed automatically
with openai; the previous httpx package is not. This guide explains what
changes for applications that interact with the SDK's HTTP layer.
If you construct an OpenAI or
AsyncOpenAI client without providing http_client, your existing API calls,
parsed response models, streaming APIs, authentication, retries, and numeric
timeouts continue to work:
No HTTPX2 extra or separate installation is required:
If your application imported httpx only because an earlier SDK installed it
transitively, add your own httpx dependency or migrate those imports to
httpx2. Installing the SDK no longer installs httpx for you.
HTTPX2 changes the default TLS trust store, including for applications that
use the SDK's default HTTP client. HTTPX previously verified certificates
against the CA bundle provided by certifi. HTTPX2 instead uses the
operating-system trust store, and the SDK no longer installs certifi.
This can break certificate verification in minimal container images without
system CA certificates, environments using corporate TLS-inspecting proxies,
and deployments that relied on a custom or modified certifi bundle. Install
the required CA certificates in the operating-system trust store, or configure
an explicit certificate bundle:
Alternatively, configure a directory of trusted CA certificates:
These environment variables are honored when trust_env=True, which is the
default. To control trust explicitly on a custom client, pass an
ssl.SSLContext through verify:
Use DefaultAsyncHttpx2Client(verify=ssl_context) for the equivalent async
configuration. The SDK's aiohttp transport uses the same HTTPX2 TLS settings.
Use HTTPX2 clients and HTTPX2 configuration objects. The SDK provides helpers
that preserve its recommended timeout, connection-pool, and redirect defaults: