docs: add API-key mTLS HTTP client recipes

[jbeckwith-oai]

Summary

• document API-key HTTP mTLS using native ssl.SSLContext configuration and the existing custom http_client seam
• add standalone sync and async examples for HTTPX and experimental HTTPX2
• verify all four examples against a local TLS server that requires a full client certificate chain
• document explicit mTLS endpoint selection, separate server trust, transport-wide certificate scoping, rotation, and non-goals

Why

Python already supports client certificates through SSLContext.load_cert_chain(), and both supported HTTP client implementations accept that context through verify=. This provides a small, language-native mTLS path without adding a new SDK API or runtime dependency.

Because the SDK cannot infer that an arbitrary custom HTTP client is configured for mTLS, callers select https://mtls.api.openai.com/v1 (or an EU/custom endpoint) explicitly. The examples dedicate the certificate-bearing transport to that origin and disable redirects.

User impact

Users can copy tested file-based PEM recipes for synchronous or asynchronous API-key traffic with either HTTPX or HTTPX2. There are no exported API, generated-client, dependency, or lockfile changes.

Validation

• rye run pytest -vv -n 0 tests/test_mtls_http_client.py — 4 passed
• ./scripts/lint
• rye build
• rye run python scripts/utils/validate-httpx2-wheel.py
• ./scripts/test — 7,083 passed, 29 skipped
• Pydantic v1 — 7,069 passed, 43 skipped
• thermo-nuclear code-quality review — no remaining blockers

Scope

This does not add certificate-only X.509 workload identity, token exchange, certificate refresh, or Realtime/WebSocket mTLS.

[openai-sdks]

OkTest Summary

✅ 237/237 SDK tests passed in 9.952s for Python SDK PR #3552.

Test results — 42 files

Test	Result	Time
tests/chat-completions-complex-body.test.ts	✅ Passed	181ms
tests/chat-completions-create.test.ts	✅ Passed	203ms
tests/chat-completions-stream.test.ts	✅ Passed	130ms
tests/files-content-binary.test.ts	✅ Passed	180ms
tests/files-create-multipart.test.ts	✅ Passed	192ms
tests/files-list-pagination.test.ts	✅ Passed	141ms
tests/initialize-config.test.ts	✅ Passed	165ms
tests/instance-isolation.test.ts	✅ Passed	161ms
tests/models-list.test.ts	✅ Passed	135ms
tests/responses-background-lifecycle.test.ts	✅ Passed	191ms
tests/responses-body-method-errors.test.ts	✅ Passed	307ms
tests/responses-cancel-timeout.test.ts	✅ Passed	214ms
tests/responses-cancel.test.ts	✅ Passed	174ms
tests/responses-compact-retries.test.ts	✅ Passed	295ms
tests/responses-compact.test.ts	✅ Passed	254ms
tests/responses-create-advanced-stream.test.ts	✅ Passed	107ms
tests/responses-create-advanced.test.ts	✅ Passed	195ms
tests/responses-create-disconnect.test.ts	✅ Passed	1.102s
tests/responses-create-errors.test.ts	✅ Passed	219ms
tests/responses-create-malformed-api-responses.test.ts	✅ Passed	108ms
tests/responses-create-retries.test.ts	✅ Passed	277ms
tests/responses-create-stream-failures.test.ts	✅ Passed	117ms
tests/responses-create-stream-timeout.test.ts	✅ Passed	208ms
tests/responses-create-stream-wire.test.ts	✅ Passed	3.074s
tests/responses-create-stream.test.ts	✅ Passed	176ms
tests/responses-create-terminal-states.test.ts	✅ Passed	250ms
tests/responses-create-timeout.test.ts	✅ Passed	186ms
tests/responses-create.test.ts	✅ Passed	489ms
tests/responses-delete.test.ts	✅ Passed	198ms
tests/responses-input-items-errors.test.ts	✅ Passed	268ms
tests/responses-input-items-list.test.ts	✅ Passed	247ms
tests/responses-input-items-options.test.ts	✅ Passed	220ms
tests/responses-input-tokens-count-timeout.test.ts	✅ Passed	229ms
tests/responses-input-tokens-count.test.ts	✅ Passed	176ms
tests/responses-malformed-inputs.test.ts	✅ Passed	2.348s
tests/responses-not-found-errors.test.ts	✅ Passed	238ms
tests/responses-parse.test.ts	✅ Passed	359ms
tests/responses-retrieve-retries.test.ts	✅ Passed	226ms
tests/responses-retrieve.test.ts	✅ Passed	199ms
tests/responses-stored-method-errors.test.ts	✅ Passed	597ms
tests/retry-behavior.test.ts	✅ Passed	3.297s
tests/sdk-error-shape.test.ts	✅ Passed	292ms

View OkTest run #30562700932

_{SDK merge (6bbff4e0d71e) · head (4272e720e6c6) · base (4f404262955c) · OkTest (91635c6a2723)}

[HAYDEN-OAI]

Reviewed the mTLS recipe end to end against the SDK custom-client seam and HTTPX/HTTPX2 transport behavior. The approach is sound; I left two low-priority documentation/example comments.