fix: validate OpenAI hook credentials (#14068)

# Pull Request Template

## Description

- Validates openai key while configuring hooks
- added backfill logic

Fixes # (issue)

## Type of change

- [x] New feature (non-breaking change which adds functionality)


## How Has This Been Tested?

Please describe the tests that you ran to verify your changes. Provide
instructions so we can reproduce. Please also list any relevant details
for your test configuration.
locally

<img width="1710" height="1234" alt="CleanShot 2026-04-15 at 16 15
02@2x"
src="https://github.com/user-attachments/assets/3d319fe0-19f9-4fd0-9308-74987daac2e1"
/>

<img width="2884" height="1136" alt="CleanShot 2026-05-11 at 19 22
53@2x"
src="https://github.com/user-attachments/assets/5eae8650-985b-4c4a-af42-35f7175ff52d"
/>



## Checklist:

- [x] My code follows the style guidelines of this project
- [x] I have performed a self-review of my code
- [x] I have commented on my code, particularly in hard-to-understand
areas
- [ ] I have made corresponding changes to the documentation
- [x] My changes generate no new warnings
- [x] I have added tests that prove my fix is effective or that my
feature works
- [x] New and existing unit tests pass locally with my changes
- [x] Any dependent changes have been merged and published in downstream
modules

---------

Co-authored-by: Vishnu Narayanan <iamwishnu@gmail.com>

app/models/integrations/hook.rb

@@ -29,6 +29,7 @@ class Integrations::Hook < ApplicationRecord
   validates :inbox_id, presence: true, if: -> { hook_type == 'inbox' }
   validate :validate_settings_json_schema
   validate :ensure_feature_enabled
+  validate :validate_openai_api_key, if: :validate_openai_api_key?
   validates :app_id, uniqueness: { scope: [:account_id], unless: -> { app.present? && app.params[:allow_multiple_hooks].present? } }
 
   # TODO: This seems to be only used for slack at the moment
@@ -56,6 +57,10 @@ class Integrations::Hook < ApplicationRecord
     app_id == 'dialogflow'
   end
 
+  def openai?
+    app_id == 'openai'
+  end
+
   def notion?
     app_id == 'notion'
   end
@@ -95,6 +100,26 @@ class Integrations::Hook < ApplicationRecord
     errors.add(:settings, ': Invalid settings data') unless JSONSchemer.schema(app.params[:settings_json_schema]).valid?(settings)
   end
 
+  # TODO: When adding credential validation for other integrations (dialogflow, dyte, etc.),
+  # extract this into an app-level config flag in apps.yml instead of hardcoding app_id checks.
+  def validate_openai_api_key?
+    openai? && enabled? && (new_record? || openai_api_key_changed? || will_save_change_to_status?)
+  end
+
+  def openai_api_key_changed?
+    settings_api_key(settings) != settings_api_key(settings_in_database)
+  end
+
+  def validate_openai_api_key
+    return if Integrations::Openai::KeyValidator.valid?(settings_api_key(settings))
+
+    errors.add(:base, I18n.t('errors.openai.invalid_api_key'))
+  end
+
+  def settings_api_key(value)
+    value&.dig('api_key') || value&.dig(:api_key)
+  end
+
   def trigger_setup_if_crm
     # we need setup services to create data prerequisite to functioning of the integration
     # in case of Leadsquared, we need to create a custom activity type for capturing conversations and transcripts