Yes, you can even have it tpm-backed.

echo -n "sk-proj-12345..." | systemd-creds encrypt --with-key=tpm2 --name=openai_key - openai.cred

And then at runtime export OPENAI_API_KEY=$(sudo systemd-creds decrypt openai.cred)