How to Get and Use an OpenAI API Key: A Complete Guide

An OpenAI API key is a secret credential that lets your code authenticate with the OpenAI API. You create it in the API platform, store it outside your source code and let the official SDK read it from an environment variable.

Without an API key, you can’t use OpenAI’s AI models, including GPT-5.6, DALL·E, and Whisper in your applications. 

Your API key tracks your usage and ensures that only authorized users can access the AI tools.

Because it acts as a key to OpenAI’s powerful AI models, you should never share or expose it. 

Infact, OpenAI makes it hard by only displaying the keys during creation process only. So, if you would be reusing them across different applications, it makes sense to save them but in a secure place.

If someone else gets access to your API key, they could use it and potentially drain your credits or compromise your projects.

The key is not a free pass to ChatGPT. ChatGPT subscriptions and API usage have separate billing, and the API charges your platform account for the requests your software makes.

Before You Create the Key, Set Up the Right Account Boundary

You need four things:

• an account on the OpenAI API platform;

• access to an API project;

• API billing or available credits; and

• a Python or Node.js version supported by the current OpenAI SDK, for the test request.

OpenAI organises API work into projects.

A project gives you a separate place to manage keys, members, model access, usage and spending controls. If you work alone, you can use the default project for an initial test.

For a real application, create a named project so its activity does not disappear into a general account total.

Only an organisation owner can create a project. A project owner can manage that project’s members and spending controls, while project members can create keys and make API requests within their assigned project.

ChatGPT billing does not pay for API calls

OpenAI manages ChatGPT and the API platform as separate products. A ChatGPT Plus, Pro, Business or Enterprise subscription does not automatically fund your API requests.

Open the API billing overview and add a payment method or prepaid credit if your account requires it. Review auto-recharge before confirming a prepaid purchase; OpenAI’s current setup flow may enable it by default.

Then set a realistic project budget and alerts. A budget helps you notice unexpected use, but you should check the current limit controls rather than assume every alert stops requests automatically.

Create a Project-Scoped OpenAI API Key

The exact labels can move as the platform changes, but the current flow centres on the selected project rather than a profile dropdown.

1. Sign in at platform.openai.com.

2. Select the correct organisation and project from the project switcher. If you own the organisation and need a new boundary, choose Create project, name it and create it.

3. Open the project’s API Keys settings.

4. Select Create new secret key.

5. Give the key a name that identifies its purpose and environment, such as invoice-helper-development.

6. Choose the narrowest permissions that let the application work. OpenAI currently offers All, Restricted and Read Only permission levels.

7. Create the key and copy the secret into a password manager or development secret store immediately.

Do not paste the real key into a support ticket, screenshot, chat message or code example. A useful name describes the key without exposing any part of the secret.

One key should have one job. Use different keys for development, staging and production so you can trace unusual activity and replace one credential without interrupting every environment.

Store the Key as OPENAI_API_KEY

The official OpenAI SDKs automatically read the OPENAI_API_KEY environment variable. This keeps the secret out of the script you commit to Git.

Windows PowerShell

Run this with your real key in place of the placeholder:

setx OPENAI_API_KEY "your_api_key_here"

setx writes the variable for future terminal sessions. Close PowerShell, open a new window and confirm only that the variable exists:

if ($env:OPENAI_API_KEY) { "OPENAI_API_KEY is set" }

Do not print the value to a shared screen or paste terminal output into a public issue.

macOS or Linux

Set the variable for the current terminal session:

export OPENAI_API_KEY="your_api_key_here"

Confirm its presence without displaying the secret:

test -n "$OPENAI_API_KEY" && echo "OPENAI_API_KEY is set"

That value disappears when the session ends unless your shell or deployment platform stores it. For production, put the key in the hosting platform’s secret manager or environment configuration, not in a shell-history file or public repository.

Make Your First Request With Python

Create a new folder, open a terminal in it and install the official Python package:

python -m pip install openai

Create example.py:

from openai import OpenAI

client = OpenAI()

response = client.responses.create(
    model="gpt-5.6-luna",
    input="Reply with exactly: API connection works.",
)

print(response.output_text)

Run it:

python example.py

The SDK reads OPENAI_API_KEY, sends your input to the Responses API and prints the model’s text output. If the connection and account setup work, you should see:

API connection works.

The example uses gpt-5.6-luna, which OpenAI currently positions for cost-sensitive workloads. Model availability and names change, so check the current model catalogue before publication or when adapting the example for production.

Make the Same Request With Node.js

Initialise a project and install the official JavaScript package:

npm init -y
npm install openai

Create example.mjs:

import OpenAI from "openai";

const client = new OpenAI();

const response = await client.responses.create({
  model: "gpt-5.6-luna",
  input: "Reply with exactly: API connection works.",
});

console.log(response.output_text);

Run it:

node example.mjs

This is the same server-side pattern as the Python example. The SDK loads the key from the environment; the file contains no secret.

Do not replace new OpenAI() with new OpenAI({ apiKey: "..." }) and paste the key into the script. That shortcut makes accidental commits and screenshots much more likely.

Keep the Key Behind Your Backend

Never put an OpenAI API key in browser JavaScript or a mobile application. The same rule applies to a WordPress page or distributed desktop binary. A visitor can inspect the client, extract the credential and make requests that charge your account.

Use this request path instead:

Customer's browser or mobile app
            ↓
Your authenticated backend endpoint
            ↓
OpenAI API

Your backend can validate the user, reject oversized input, apply rate limits, remove data your application should not send and record enough information to investigate abuse. It then calls OpenAI with the secret stored in its environment.

If you need a persistent Python or Node.js backend, our VPS hosting gives you root access to install the runtime and deploy a custom application.

Choose managed VPS when you want us to handle server administration, updates, security and backups; choose unmanaged VPS when your team will maintain the operating system and application stack.

Hosting the backend does not remove your security responsibilities. Restrict the public endpoint, patch your application, use HTTPS, validate requests and keep the API key in the server’s secret configuration.

Use Projects and Permissions to Limit the Damage of a Leak

A secret can still leak through a log, copied configuration, vulnerable dependency or compromised machine.

Design the account so one exposed key cannot affect unrelated applications.

• Create separate projects for genuinely separate products, clients or environments.

• Give each key a clear name and the minimum useful permissions.

• Use a service account for production systems instead of tying production access to one employee’s personal key.

• Restrict project model access when the application needs only a small set of models.

• Configure spending alerts and review the Usage dashboard by project and key.

• Consider IP allowlisting when your account and infrastructure support stable outbound addresses.

• Delete unused keys and rotate active credentials on a documented schedule.

Do not share one personal key with a team. Invite each person to the organisation and the relevant project, then let them use their own project-scoped credentials.

This preserves access control and makes usage easier to audit.

Fix the First Errors Without Exposing the Secret

Read the complete error message, but remove request content and credentials before sharing it.

“Incorrect API key” or an authentication error

Check that you opened a new terminal after using setx, selected the intended project and copied the complete secret without spaces. If you no longer trust the key, delete it and create a replacement instead of repeatedly pasting it into different tools.

“Insufficient quota” or a billing error

Confirm that you added API billing to the platform account, not only a ChatGPT subscription. Check available credit, the organisation’s billing status and the selected project’s spending controls.

A rate-limit response

Rate limits and account spending are different controls. Slow repeated requests, add retry logic with increasing delays and inspect the model limits for your project. Do not retry every failed request immediately in a tight loop.

A model-access or permission error

Confirm that the model appears in the current catalogue and that the project allows it. A restricted key may also lack permission for the endpoint your code calls.

Python cannot import openai

Install the package through the same Python interpreter that runs the file:

python -m pip install openai
python example.py

If several Python installations exist, pip and python may otherwise point to different environments.

Treat a Leaked Key as an Incident

Do not merely remove a leaked key from the latest Git commit. Copies may remain in repository history, build logs, caches or forks.

1. Delete or revoke the exposed key in the correct project’s API Keys page.

2. Create a replacement with the minimum required permissions.

3. Update the server’s secret store and restart or redeploy the application.

4. Review usage for unfamiliar requests or spending.

5. Search source history, logs, deployment settings and team messages for the exposed value.

6. Fix the path that leaked it before distributing the replacement.

OpenAI states that it disables keys it detects on the public internet or inside published applications. Your own response should still start immediately; do not wait for automated detection.

OpenAI API Key FAQs

Is an OpenAI API key free with ChatGPT Plus?

No. OpenAI manages ChatGPT subscriptions and API billing separately. Add billing or available credit to your API platform account before expecting a key to make billable requests.

Where do I find my OpenAI API key?

Select the intended project in the OpenAI API platform and open that project’s API Keys settings. You can see and manage key records there, but you should store a newly created secret immediately because the platform does not provide a safe way to recover a lost secret value.

Can I use an OpenAI API key in frontend JavaScript?

No. Anyone can inspect code and network activity in a browser. Send the user’s request to your own authenticated backend, then let the backend call OpenAI with the key stored in a server-side environment variable or secret manager.

Why does my key say I exceeded my quota?

Check API billing, available credit and organisation or project spending controls. A ChatGPT subscription does not cover API usage. If the message describes a rate limit instead, reduce request frequency and follow the retry guidance for that model.

What should I do if I accidentally publish my API key?

Delete or revoke it immediately, create a replacement, update your secret store and review usage. Removing the visible line from Git is not enough because the key may remain in history, logs, caches or forks.

The first successful request proves only that your credential and account work. Before you turn it into a public feature, move the call behind an authenticated backend, set project controls, add error handling and test what happens when the model or network returns something your application did not expect.

---

Open AI Key FAQs

1) Can I have multiple API keys?

Yes. OpenAI allows you to generate multiple API keys. This is useful if you need separate keys for different projects or team members.

2) What should I do if my API key gets leaked?

Immediately revoke the key from the OpenAI dashboard and create a new one.

3) Can I share my API key with others?

No, OpenAI prohibits sharing API keys. Each user should generate and use their own key.

4) How do I check my OpenAI API usage?

You can track your API usage in the OpenAI dashboard under the “Usage” tab.

5) Does OpenAI charge for API usage?

Yes, OpenAI’s API is not free. The cost depends on the model you use and the amount of text you process.