You create an OpenAI API key on the API key page of your OpenAI platform account, and OpenAI only shows you the full secret key once, at the moment you create it. As of Nov 2026 OpenAI's own safety rules are one key per person, an expiry date on every key, and never putting a key in a browser, a mobile app or your code.
An API key is the code that lets software talk to OpenAI's models on your account's behalf. If you're not sure what the API itself is for, start with my plain-English guide to the OpenAI API. This page is only about the key: getting it, storing it and not losing control of it.
Where your OpenAI API key lives
OpenAI's Help Center keeps this simple. You create and manage keys on the API key page. For security, a full secret key is only shown when you create it. If you lose it or didn't save it, you can't get it back: you create a new key and update your application to use the new one.
Deleting is just as blunt. You select the trash can icon next to a key, and deleted keys can't be used, so any app that relies on that key may stop working. Before you delete anything, find out what's using it. OpenAI's own reminder on that page is short: don't share your API key with anyone.
Creating and storing a key, step by step
- Sign in to your OpenAI platform account and open the API key page. The developer quickstart says to create the key in the dashboard before you do anything else.
- Create a new key, and give it an expiration date if the option is there. Project keys can be created with an expiry, after which requests from that key are rejected.
- Copy it straight away. You won't see the full key again.
- Store it as an environment variable, not in a document, an email or your code. OpenAI recommends the name OPENAI_API_KEY.
- Check your billing. New API accounts use prepaid billing, so you buy credits before using the API, and requests start returning a billing error when the credits run out.
- Set a monthly spend limit with hard enforcement, so a leaked key can't run up an open-ended bill.
The variable name OpenAI recommends
OPENAI_API_KEY
On Windows, OpenAI's safety article shows a setx command in the command prompt, or the Environment Variables screen under Advanced system settings. On a Mac, you add an export line for that variable to the .zshrc file. If that sentence made your eyes glaze over, that's fine: it's a two-minute job for whoever builds your integration, and the point is that the key lives on the computer or server, never inside the code you share. Each OpenAI SDK reads the key from that variable automatically.
Five mistakes OpenAI warns about
| Mistake | What OpenAI says | Do this instead |
|---|---|---|
| Sharing one key around the team | Sharing API keys is against the Terms of Use, and OpenAI doesn't support it | Invite people from the Members page; each person gets their own key on sign-in |
| Keys that never expire | Strongly recommends an expiry date and a regular rotation process | Create a replacement before expiry, switch your apps over, then revoke the old key |
| A key inside a website or mobile app | Malicious users can take it and make requests on your behalf, which may mean unexpected charges | Route requests through your own backend server |
| A key committed to a code repository | A common way keys get compromised; even private repositories can leak in a data breach | Use environment variables |
| No spend limit | Spend alerts alone don't stop API traffic | Set monthly spend limits and switch on hard enforcement |
The website one catches small businesses most. A developer wiring up a quick chatbot on your site can drop the key into the page itself. Anyone who looks at the page source can then use it. OpenAI's rule is clear: keys belong on a backend server you control.
Keys for a team: one each, with a lifetime
The team rule is the one most small businesses break, usually by pasting one key into a shared doc. Instead, invite each person from the Members page. They get their own key when they sign in, and you can assign permissions to individual keys. When someone leaves, you revoke their key without breaking everyone else's work.
Administrators can also enforce a maximum key lifetime at organisation or project level in Platform settings, so new keys can't stay valid forever. A project's limit can't be longer than the organisation's. For supported workloads, OpenAI suggests workload identity federation, where your system swaps an identity from a trusted provider for a short-lived access token, so there's no long-lived key to steal. For production apps, it also recommends a key management service, and IP allowlisting, which rejects requests from unknown addresses even when they carry a valid key.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
If you think a key has leaked
Don't wait. OpenAI says a compromised key gives someone access to your account quota without your consent, which can mean data loss, unexpected charges, a drained monthly quota and interrupted access. Rotate the key immediately from the API Keys page, update any apps in production with the new value, and review the Usage page to see whether the activity matches your team's work. If you belong to more than one organisation, say a company one and a personal one, make sure tracking is on and your default organisation is set, or you'll be looking at the wrong numbers. Then contact OpenAI through its Help Center.
What I'd tell a non-developer who's been handed a key
Treat it like the password to your bank's online portal, because in practice it's a card that spends your credits. I'd create a key with an expiry date and keep it out of the code, and I'd make sure it sits behind a spend limit from day one. Skip sharing one key around the team, however convenient it feels. If you're weighing up another provider, the same habits apply to a Claude API key from Anthropic, and my list of OpenAI API alternatives covers the other options.
If you're connecting an AI model to your business tools and want the keys handled safely, that's the kind of AI enablement I help with. I run AI training and workshops for teams, and help businesses with AI enablement and workflow automation, so the busywork runs itself and people get time back. Most of that work is with SaaS marketing teams and small businesses. Here's how we can work together.
Frequently asked questions
Where do I find my OpenAI API key?
On the API key page of your OpenAI platform account. You can create and manage keys there, but a full secret key is only shown once, when you create it.
I lost my OpenAI API key. Can I see it again?
No. OpenAI only shows the full key at creation. Create a new key, update your application to use it, then delete the old one.
Can my team share one OpenAI API key?
OpenAI says sharing API keys is against its Terms of Use and it doesn't support it. Invite each person from the Members page so they get their own key.
Where should I store my OpenAI API key?
In an environment variable, which OpenAI recommends naming OPENAI_API_KEY. Never in a browser, a mobile app or a code repository.
Does an OpenAI API key work without credits?
New API accounts use prepaid billing, so you buy credits before using the API. When they run out, requests return a billing error until you add more.
