How do you get an OpenAI API key, and keep it safe?

Creating the key

• Sign in to the OpenAI developer platform.
• Add billing. API usage is pay as you go. Plus does not include API credits; eligible Pro and Business plans can claim credits after linking an API organization.
• Create a project for your app, so its keys, limits and usage are separate.
• Generate a secret key in the project and copy it. It is shown only once.

Using it from your server

This example uses a reserved domain. Replace the host and model with the current endpoint and model ID from the provider's documentation before running it.

curl https://api.openai.example/v1/responses \
  -H "Authorization: Bearer $OPENAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model": "MODEL_NAME", "input": "Hello"}'

Replace MODEL_NAME with a current model from OpenAI's models page. The official SDKs read OPENAI_API_KEY from the environment.

Keeping it safe

• Keep the key on the server. OpenAI's own guidance is never to deploy it in client-side code.
• Use project keys with the narrowest permissions available, one project per app and environment.
• Set project budgets and usage alerts.
• Rate limit your endpoints that call the API, per user and per IP.
• Revoke and replace any key that appears in Git, screenshots or chats.

OpenAI and repository hosts scan public code for leaked keys and may disable them, but you are responsible for usage until then. Rotation is faster than waiting.

Common errors

• 401 invalid API key: wrong, revoked or missing key, or a key from another project.
• 429 rate limit or insufficient quota: either too many requests for your tier, or no remaining budget. The error body says which.
• 404 model not found: the model name is wrong, retired, or not available to your project.

In AI app builders and editors

Many tools let you bring your own OpenAI key. Store it in the tool's secret settings, and check that generated code calls OpenAI from a server function. A request from the browser to api.openai.com means the key is public.

What a scan can and cannot tell you

WebAuditOS does not currently detect API keys in your JavaScript. It checks related exposure on your site, such as wide-open CORS, HTML error pages with recognizable debug output and directory listings.

Search your built frontend for the sk- prefix before launch and review usage in the OpenAI dashboard.

If you find a key in your public bundle, rotate it before fixing the code. The old one may already be copied.

Short answers

Does ChatGPT Plus include API access? No. The API is billed separately.

Is there a free OpenAI API tier? Not generally. Check the pricing page for any current credits.

How do I find an old key? You cannot. Create a new one and revoke the old one.

Can I use my key in a browser extension or mobile app? Not safely. Route requests through your own backend.