How to Get an OpenAI API Key Safely (and Test It)
To create an OpenAI API key, sign in to the OpenAI Platform API keys page, select the project that should own the application, create a secret key and copy it into an approved secret store. Do not paste a production key into browser code, a public repository or an unverified third-party tool.
The clicking part is easy. Choosing the right owner, billing account and storage location is what stops a quick experiment becoming somebody's unexplained bill.
Verified on 24 August 2026 against current OpenAI Platform and Help Centre documentation.
ChatGPT and the OpenAI API are separate
A ChatGPT subscription does not include OpenAI API usage. OpenAI runs ChatGPT billing and API Platform billing as separate systems.
You therefore need:
- access to the OpenAI Platform, not only ChatGPT;
- the correct API organisation and project;
- permission to create a key in that project;
- API billing configured if your account requires it; and
- a server-side place to store the secret.
Do not create a company integration under a departing employee's personal project. For shared or production work, the organisation should own the project, billing and recovery process. OpenAI's project guide explains project owners, members, service accounts, budgets and project-scoped keys.
Create the key
- Open platform.openai.com/api-keys and sign in.
- Check the organisation and project switchers before creating anything.
- Create or select a project dedicated to the application or environment.
- Open that project's API keys area and select Create new secret key.
- Give it a name that identifies the workload and environment, such as
support-triage-development. - Where permission controls are available, grant only the API access the workload needs. OpenAI supports All, Restricted and Read Only key permissions.
- Create the key and copy it once into your password manager or deployment secret store.
OpenAI only displays the full secret at creation. Losing it is not a disaster. Create a replacement, update the application and delete the old key.
For a long-running organisational service, consider a project service account instead of attaching production to one person's user key. Service accounts are project-scoped and can be removed without sharing a credential between people.
Store it without leaking it
For a local test, set an environment variable in the terminal session that will run the command:
export OPENAI_API_KEY="<YOUR_API_KEY>"
Do not run echo $OPENAI_API_KEY in a recorded session, shared terminal or support ticket. It prints the secret.
For production, use the secret facility provided by your host. The application should read the key on the server. It should never send the key to a browser, mobile app or client-side JavaScript bundle.
OpenAI's API key safety guidance explicitly advises against shared keys, client-side deployment and committing keys to source control.
Test authentication without generating content
This request asks the API for the models available to the key. It does not contain a prompt or a real secret in the command itself:
curl --fail-with-body --silent --show-error \
https://api.openai.com/v1/models \
-H "Authorization: Bearer $OPENAI_API_KEY"
A JSON response containing a data list shows that the API received a usable credential with access to that endpoint. It does not prove that every model or endpoint is enabled for the project.
Do not send customer data just to test a key. After authentication works, use the current OpenAI quickstart for a minimal inference request and review the model, data and cost implications first.
Diagnose common failures
401 or invalid authentication
Check that the entire key was copied, the environment variable is available to the running process, and the key has not been deleted. Do not paste the key into logs while investigating.
403 or permission denied
The key may be restricted, the project may not permit the requested endpoint, or your user may be in the wrong project. Review the key's permissions and project membership.
429, quota or billing errors
A 429 can mean a rate limit or an account quota problem. Check the exact error body, the selected project, API billing, project limits and the Platform usage view. Do not assume a ChatGPT payment covers it.
The key works locally but not after deployment
Confirm the secret exists in the deployed environment, not merely in your laptop's shell. Restart or redeploy the service if its platform only loads secrets at startup.
A third-party app rejects the key
Confirm that the app genuinely supports the OpenAI API and does not expect Azure OpenAI, another provider or an OAuth connection. Before handing it a key, check who stores the secret, whether it is encrypted, what data it sends and how you revoke access.
Rotate or revoke an OpenAI key
For planned rotation:
- Create a replacement key in the same intended project.
- Store it in the application's secret manager.
- Deploy or restart the application and run a harmless test.
- Inspect usage and errors.
- Delete the old key from the API keys page.
If a key may have leaked, delete or revoke it immediately, then investigate usage and rotate any application secret that contained it. Removing the key from a Git commit, screenshot or chat message does not make the exposed value safe again.
Production handover checklist
Before a prototype becomes real work, record:
- the owning organisation, project and service owner;
- where API billing and usage are monitored;
- where the secret is stored and which runtime can read it;
- who can create, rotate and revoke keys;
- which endpoints the key is allowed to use;
- the development, test and production separation; and
- the application's response to authentication, rate-limit and provider failures.
If you are turning API experiments into supportable client work, join The 50x Founder Space. Bring the ownership and failure-boundary questions, never the key itself.