Start free

Providers / OpenAI API

AI APIs

OpenAI API API keys and credentials

What every OpenAI API credential a founder holds does, whether it expires, and what tends to break. Each fact links to OpenAI API's own docs.

Last checked 2026-11-08 · platform.openai.com

At a glance

CredentialExpiryPermissions
Project API key (sk-proj-...)You chooseNot documented
Project service account API keyYou chooseNot documented
Admin API keyYou choose, max 1 yearFull access only
OpenAI platform account loginNot documented–

How to rotate the OpenAI project API key

  1. Issue a replacement key before the old one expires, with an expiration that complies with your organization and project key policies. OpenAI API docs
  2. Update the workload (environment variable or secret store) to use the replacement key. OpenAI API docs
  3. Verify that the replacement works. OpenAI API docs
  4. Revoke the previous key. The API reference documents deleting a project key with DELETE /organization/projects/{project_id}/api_keys/{api_key_id}; it requires permission to write project API keys. OpenAI API docs

Can the old and new key work at the same time? OpenAI API's docs don't say. The docs give the order issue, update, verify, then revoke, which implies the old key keeps working until you revoke it, but they never say so explicitly.

Revoking the old one: Revoke the old key. The API reference documents deleting a project key with DELETE /organization/projects/{project_id}/api_keys/{api_key_id}, which requires permission to write project API keys.

Source: developers.openai.com/api/docs/guides/api-keys, checked

Does the OpenAI project API key expire?

It's up to you: you can set an expiry for the OpenAI project API key.

What breaks when the OpenAI project API key expires

Per OpenAI's error codes guide (https://developers.openai.com/api/docs/guides/error-codes): it documents a 401 "Incorrect API key provided" error for a key that is not correct (a revoked key cached locally is one cause) and a 401 "Invalid Authentication" error for a revoked key. The Python library's AuthenticationError covers a key that was "invalid, expired, or revoked". The docs do not name a separate error for an expired key, so expiry and revocation may look the same. You would notice it as every request using that key failing with a 401 at once; no expiry warning is documented.

Other things that often go wrong with OpenAI API:

How to rotate the OpenAI service account key

  1. Create a replacement key for the existing service account (POST /organization/projects/{project_id}/service_accounts/{service_account_id}/api_keys). The reference example authenticates with an admin key. Set expires_in_seconds within your policy; the documented range is 1 to 31536000 (one year). The response reports expires_at as null if the key does not expire. OpenAI API docs
  2. Store the new key value straight away. The API returns the full value only when the key is created. OpenAI API docs
  3. Update the workload to use the new key and verify that it works. OpenAI API docs
  4. Revoke the previous key. The service account itself stays the same, so only its keys change. OpenAI API docs

Can the old and new key work at the same time? OpenAI API's docs don't say. The docs say a service account's identity can remain the same while its keys change, and give the order issue, update, verify, revoke. They do not state whether several keys on one service account are valid at once, nor any limit on the number of keys.

Revoking the old one: DELETE /organization/projects/{project_id}/api_keys/{api_key_id} deletes the key and requires permission to write project API keys. Deleting a service-account key does not delete the service account or its other keys.

Source: developers.openai.com/api/docs/guides/api-keys, checked

Does the OpenAI service account key expire?

It's up to you: you can set an expiry for the OpenAI service account key.

What breaks when the OpenAI service account key expires

Per OpenAI's error codes guide (https://developers.openai.com/api/docs/guides/error-codes): it documents a 401 "Incorrect API key provided" error for a key that is not correct (a revoked key cached locally is one cause) and a 401 "Invalid Authentication" error for a revoked key. The Python library's AuthenticationError covers a key that was "invalid, expired, or revoked". The docs do not name a separate error for an expired key, so expiry and revocation may look the same. You would notice it as every request using that key failing with a 401 at once; no expiry warning is documented.

Each credential

Project API key (sk-proj-...)

OpenAI recommends setting an expiration date when creating a project API key. Admins can enforce a maximum key lifetime at organization or project level; project limits cannot exceed the organization limit, and new keys must expire within the configured limit. Existing keys are not affected by new policies. The project API keys list endpoint (confirmed on the API reference) returns expires_at (Unix seconds, null if no expiry), last_used_at and a redacted_value only; the full secret is not returned. Listing requires an admin key. Keys can be restricted by admin policy to service-account keys or user-owned keys, or creation can be disabled.

OpenAI API docs

Project service account API key

OpenAI recommends a project service account for an application identity rather than an individual developer's key. When an organization policy sets a maximum lifetime, the initial service account key's expiration must be supplied and must not exceed that limit. Policy values were not published as a fixed number.

OpenAI API docs

Admin API key

Created in the organization admin keys page or via API. The create endpoint takes optional expires_in_seconds, minimum 1 and maximum 31536000 (365 days); omitting it creates a key that does not expire, so the default is no expiry. The secret value is only shown on create. Create and list responses include expires_at (nullable) and last_used_at. Admin keys authenticate the Usage/Costs and admin endpoints as Bearer tokens. No permission scopes are documented for admin keys. Treat as a root credential.

OpenAI API docs

OpenAI platform account login

Dashboard login at platform.openai.com. Owners manage members and keys; readers can make API requests but not manage members.

OpenAI API docs

Renewals and billing

Admin API Organization Costs endpoint (GET /v1/organization/costs) reports daily spend. group_by supports project_id, api_key_id, user_id, line_item, api_source; filters project_ids and api_key_ids. Requires an admin key (Bearer).

Where to find it in OpenAI API

What OpenAI API's docs don't say

We couldn't confirm these from official docs, so don't rely on them either way:

Rotating or replacing a OpenAI API key

The steps are the same for most providers: make the new key, deploy it everywhere the old one is used, check it works, then revoke the old one. Our guides walk through it:

Rotate an API keyWithout downtime, in the right order. A key leakedWhat to do in the first hour.

Sources

Related providers

Anthropic APIAI APIs Google Gemini API / AI StudioAI APIs OpenRouterAI APIs

Keep track of every OpenAI API key

StackHangar stores your OpenAI API keys in an encrypted vault, grouped by the product they belong to, warns you before they expire, and walks you through rotating them. We can't read your secrets.

Start free with 2 projectsHow the vault works