# Useful but Little-Known Features of OpenAI Agent SDK 🌍 Does your agent's conversation history contain sensitive data stored in plaintext? EncryptedSession protects conversation data with Fernet encryption and supports TTL-based auto-expiration. 📌 Title: Encrypted Session (EncryptedSession) 🔗 URL: 🧩 Overview `EncryptedSession` is a drop-in wrapper that encrypts conversation data for any session backend passed as `underlying_session`. It uses Fernet encryption with HKDF per-session key derivation (info string `"agents.session-store.hkdf.v1"`, session ID as salt), ensuring cryptographic isolation between sessions. Items older than `ttl` (default 600 seconds) are silently skipped on retrieval. Provide a high-entropy master key such as `Fernet.generate_key()` output — raw strings are still accepted for compatibility, but passwords and other low-entropy secrets are unsuitable. 🛠 How to use it ```python import os from cryptography.fernet import Fernet from agents import SQLiteSession from agents.extensions.memory import EncryptedSession # Wrap a base session with encryption base_session = SQLiteSession("chat-001", "sessions.db") # Use a high-entropy master key, e.g. generated with Fernet encryption_key = Fernet.generate_key().decode("ascii") encrypted = EncryptedSession( session_id="chat-001", underlying_session=base_session, encryption_key=encryption_key, ttl=3600, # Expire after 1 hour (default is 600 seconds) ) # For persistent storage, load and reuse the same stored key encrypted = EncryptedSession( session_id="chat-001", underlying_session=base_session, encryption_key=os.environ["SESSION_ENCRYPTION_KEY"], ttl=7200, ) # Use the same interface as any other session items = await encrypted.get_items() ``` 🏗 Building it into production ・Meet compliance requirements in regulated industries like healthcare and finance ・HKDF derives unique keys per session, so one session's compromise doesn't affect others ・Use TTL for "cryptographic data erasure" — data becomes unrecoverable after expiration ・Wraps existing SQLiteSession / RedisSession with zero migration cost 💡 Use cases 🏥 Encrypted storage for conversations containing medical information 🏦 Security hardening for agents handling financial data 🔐 GDPR "right to be forgotten" compliance via TTL expiration 🛡 Inter-session data isolation in multi-tenant environments ⚠️ Watch out Install the `encrypt` extra first: `pip install 'openai-agents[encrypt]'`. Content search methods like `find_turns_by_content()` don't work on encrypted data. If search is needed, maintain a separate search index. Also, losing the encryption key makes data permanently unrecoverable — secure key management (e.g., Secret Manager) is essential. Changing `encryption_key` does not re-encrypt stored records, so existing data still requires the original key. ✨ With EncryptedSession, protect conversation data with just one line of code. #OpenAIAgentSDK# #AIAgent#