This page is about creating an API key with OpenAI. For an All AI Ask key, see /api-keys.

How to Get an OpenAI API Key

How do I get an OpenAI API key?

OpenAI (OpenAI OpCo, LLC) API key: open the official console, create a key for the correct project, workspace, or account, and copy it immediately. The key format is Project keys begin with sk-proj-. Use the least-privilege permissions for this service. Store it as OPENAI_API_KEY in a server-side secret manager. Key creation itself does not require payment.

Verified 2026-08-14 — source

Steps

  1. Open the OpenAI API keys console and select the project that should own the credential. (verified 2026-08-14)
  2. Choose Create new secret key, name it, and select the least-privilege project permissions available for the workload. (verified 2026-08-14)
  3. Copy the key immediately; OpenAI shows the full secret value only at creation. (verified 2026-08-14)
  4. Add a payment method under Billing before making paid API calls; API usage is billed to the owning organization and project. (verified 2026-08-14)
  5. Store the value as OPENAI_API_KEY in a server-side environment or secret manager, never in source control or browser code. (verified 2026-08-14)

Key facts

Env varOPENAI_API_KEY
Consolehttps://platform.openai.com/api-keys
Key formatProject keys begin with sk-proj-; legacy user keys use sk-. Treat both as secrets.
Scope and permissionsProject-scoped keys can be restricted by permission; organization and project roles determine who can create, manage, or use them.
BillingUsage is metered against the owning OpenAI organization/project and charged through the organization billing settings; the key itself is not a separate purchase.
Payment required before first callNo
Scoped to project/orgYes
Shown onceYes
Revoke a key →

Rotate or revoke a key

Rotation

  1. Create a replacement key in the same project.
  2. Deploy the replacement through the server-side secret manager.
  3. Verify a real request, then revoke the old key.

Revocation

  1. Open the project API keys page.
  2. Find the key by name or last-used metadata.
  3. Revoke/delete it and remove the old secret from deployments.

First API call

python example using gpt-5.6-luna; the key stays in OPENAI_API_KEY and is never included in the snippet.

client = OpenAI(api_key=os.environ["OPENAI_API_KEY"])

response = client.chat.completions.create(
    model=MODEL,
    messages=[{"role": "user", "content": "Say hello in one sentence."}],
)

print(response.choices[0].message.content)

FAQ

Do I need a credit card to get an OpenAI API key?

No — you can generate the key without a payment method, though usage limits stay low until you add one.

Can I see my OpenAI API key again after closing the page?

No — OpenAI shows the full key value exactly once. If you lose it, revoke it and create a new one.

Is this the same as an All AI Ask API key?

No. This page is about creating an API key with OpenAI directly, for calling their API yourself. For an All AI Ask key — one key that routes to OpenAI and every other provider we support — see /api-keys.

OpenAI provider hubOpenAI rate limits

Batch 49 · openai decision and evidence contributions. Surface verification: 2026-08-14. These are route-local, server-rendered fixtures; unavailable values are not inferred.

OpenAI principal-project-permission resolver

Frozen Batch 49 fixture board. Formula / decision rule: eligible = organization + project + principal + role + endpoint permission + billing owner Boundary: A valid credential does not prove the correct project or authorization scope.

Frozen fixture / field IDJoined inputs and observationCalculated resultState
batch49-openai-m1-r1
owner user · project member		org=org-demo; project=proj-prod; principal=user; role=owner; key=fp-oai-u-01; permission=responses.write; billing=org-demo
Principal, project, endpoint permission, and billing owner join.		eligible=production Responses workloadPASS WITH SCOPE — project-bound.
batch49-openai-m1-r2
restricted project key · rejected operation		org=org-demo; project=proj-sandbox; principal=service-account; role=developer; key=fp-oai-s-02; permission=responses.read; request=responses.write
The credential is valid but its permission set excludes the requested write operation.		eligible=read only; rejected=responses.writeREJECT — permission boundary.
batch49-openai-m1-r3
organization admin key · wrong project		org=org-demo; project=proj-old; principal=admin; key=fp-oai-a-03; billing=proj-prod; request=prod
Admin identity joins the organization, but the key’s project and billing owner do not join production.		valid secret ∧ wrong project → do not promoteFAIL CLOSED — rebind project.

Provenance: Batch 49 openai module 1 first-party evidence and surface verification date 2026-08-14. OpenAI API key help. Missing joins fail closed.

OpenAI secret-placement exposure gate

Frozen Batch 49 fixture board. Formula / decision rule: safe = server boundary ∧ managed source ∧ no source/build/log exposure Boundary: Any client-distributed or source-controlled secret is a hard failure.

Frozen fixture / field IDJoined inputs and observationCalculated resultState
batch49-openai-m2-r1
local shell · managed secret store · CI masked variable		source=secret-manager; injection=server process; client-visible=No; logs=masked; scan=clean; key=fp-oai-dev-01
The three server-side paths keep only fingerprints in deployment metadata.		decision=PASS; rotation authority=secret store ownerPASS — server custody.
batch49-openai-m2-r2
container image · serverless environment		source=image layer; injection=build; client-visible=No; build-cache=retained; scan=flagged; key=fp-oai-img-02
Image history and build cache retain the secret-bearing layer.		decision=FAIL; rebuild without secret and rotateFAIL CLOSED — build exposure.
batch49-openai-m2-r3
browser bundle · mobile binary		source=public artifact; injection=client; client-visible=Yes; logs=unknown; scan=not-run; key=fp-oai-client-03
The credential is distributed to an untrusted client boundary.		decision=FAIL; revoke and replace through a server proxyFAIL CLOSED — client exposure.

Provenance: Batch 49 openai module 2 first-party evidence and surface verification date 2026-08-14. OpenAI API key help. Missing joins fail closed.

OpenAI rotation-and-revocation propagation ledger

Frozen Batch 49 fixture board. Formula / decision rule: complete only when coverage = 100% AND old-key rejection is observed Boundary: Unresolved consumers keep the old credential live.

Frozen fixture / field IDJoined inputs and observationCalculated resultState
batch49-openai-m3-r1
blue/green API services · two regions		old=fp-oai-old-01; new=fp-oai-new-02; waves=green-us/green-eu; validation=req-oai-91; replicas=12/12; old-use=none
Both regions validate the new fingerprint and all replicas report coverage.		coverage=12/12=100%; old rejection=observed → completeCOMPLETE — revoke old key.
batch49-openai-m3-r2
background workers · scheduled jobs · rollback deployment		old=fp-oai-old-03; new=fp-oai-new-04; workers=18/20; jobs=3/4; rollback=old; last-use=2h ago
Two workers and one scheduled job still reference the old fingerprint; rollback also depends on it.		coverage=21/24=87.5%; revoke=blockedINCOMPLETE — migrate orphan consumers.
batch49-openai-m3-r3
leaked-key incident		old=fp-oai-leak-05; new=fp-oai-new-06; leak=log artifact; revoke=2026-08-14T10:20Z; negative-test=401; coverage=100%
The old fingerprint is revoked, a negative test rejects it, and consumers use the replacement.		incident containment = revoke + rotate + negative testCOMPLETE — evidence receipt joined.

Provenance: Batch 49 openai module 3 first-party evidence and surface verification date 2026-08-14. OpenAI API key help. Missing joins fail closed.

Run the openai Batch 49 evidence scenario →