Create an OpenAI project credential with a clear application purpose, test the Responses API and plan its rotation. Keep production access and billing controls visible to the project owner.

Before you start

OpenAI’s production guidance supports separating development and production projects and recommends protecting API keys outside source code. Official documentation.

Confirm the target project before making a key. Give the credential a purpose and an owner so its later removal does not depend on remembering which experiment created it.

Choose the project before creating the credential. Record whether it is for a disposable experiment, a staging application or a production service. Identify the person who owns the project settings and the person who operates the application. They may be different people, and a future access incident is easier to resolve when both responsibilities are visible.

Prepare a secret-free operating record with the application name, selected endpoint, intended model and rotation procedure. Avoid putting the secret into a shared document as a convenient handoff. If the application is deployed by another team, establish how protected configuration reaches that deployment before creating a credential that nobody knows how to install safely.

Step-by-step: create the key

  1. Open the developer dashboard from the official quickstart.
  2. Select the intended project and open its API-key controls.
  3. Create the credential with the permissions and expiry appropriate to your application.
  4. Copy the secret into your environment or secret store; record its purpose without the secret value.

Use the current dashboard flow linked by the provider. Official documentation.

Read the active organization and project in the dashboard before confirming creation. Inspect the permissions and expiry options offered for that credential. Use the narrow purpose required by the application and keep the key description understandable to another maintainer. A clear description helps later cleanup, but it does not replace the actual permissions and project controls.

Move the newly issued value directly into protected configuration. Keep screenshots focused on the navigation and controls, with the secret and account identifiers removed. If you cannot reproduce a documented console step because the account lacks permission, have the project owner inspect access. Do not create an unrelated project merely to obtain a button that hides the underlying ownership problem.

Set a spending limit / budget alerts

OpenAI documents alerts and hard spend limits. Decide which is appropriate and plan the application’s behavior when an enforced limit stops traffic. Official documentation.

Review the intended failure behavior before enabling an enforced cap. The application should know how to pause work, inform its operator and preserve unfinished tasks. An end user should not receive an instruction to repair the organization’s billing. Keep the internal diagnostic detail protected while providing a concise application message.

For a shared project, identify which services depend on the same spending control. A limit chosen for a small experiment can affect other traffic if ownership is unclear. Record who approved the control and how it can be reviewed. Test the paused state with the same care as a successful request so the first account limit does not become an unplanned outage exercise.

Verify the key: first call with cURL and Python

curl https://api.openai.com/v1/responses --max-time 30 -H "Authorization: Bearer $OPENAI_API_KEY" -H "Content-Type: application/json" -d '{"model":"gpt-5.6-luna","input":"Hello","store":false}'
import os
import sys
from openai import OpenAI, APIStatusError

model = os.environ.get("OPENAI_MODEL", "gpt-5.6-luna")
if "--bad-model" in sys.argv:
    model = "ai-api-hub-invalid-model"
client = OpenAI(api_key=os.environ["OPENAI_API_KEY"], timeout=30.0, max_retries=0)
try:
    result = client.responses.create(
        model=model,
        input="Explain the purpose of a model evaluation in a short sentence.",
        max_output_tokens=256,
        store=False,
    )
    print(result.output_text)
    print(result.usage.model_dump_json())
except APIStatusError as exc:
    print(f"HTTP {exc.status_code}")
    print(exc.response.text)
    raise SystemExit(1)

The output shape below is schematic and was not captured from a live request.

{"object":"response","output":[{"type":"message","content":[{"type":"output_text","text":"Example response"}]}]}

Use the cURL request to establish the minimal endpoint path, then use the Python program to establish the client-library path. Keep the model and task equivalent while comparing them. If one succeeds and the other fails, inspect the loaded environment, library version and request construction instead of immediately changing the credential.

Make the verification request from the environment that will actually run the application. A developer laptop and a scheduled worker may load different secret versions or project configuration. Preserve a redacted diagnostic record with the model, endpoint and observed result. Do not copy a complete production response into public troubleshooting material when it includes sensitive input or generated content.

Where to put the key

The script reads OPENAI_API_KEY in the server process. The Python tutorial shows the full Responses API example.

Load the credential in the process that calls the OpenAI endpoint. Keep it out of browser bundles, example repositories and downloadable configuration files. The sample requires the environment variable explicitly, which makes a missing setting visible before a request is attempted. Do not replace that failure with a hardcoded fallback secret.

Document how a configuration change reaches running workers. Verify the application after installing a replacement rather than assuming the secret store’s saved value proves every process has reloaded it. Keep separate records of the credential identity and its purpose, without the value itself. This makes rotation auditable while limiting unnecessary exposure.

Common rejections

Inspect the structured error code for credential, credit, spend and capacity problems before changing the key. Official documentation.

Use the OpenAI error guide to collect the right evidence.

Inspect the specific error code before deciding that the key is wrong. An exhausted credit balance, enforced project limit or unavailable model can reject a request even when the credential is valid. Replacing the secret repeatedly does not repair those conditions and can leave abandoned credentials in the dashboard.

Return to the smallest request that was known to work. If it succeeds, compare the added fields and model selection in the failing case. If it fails too, inspect the project and deployed environment. Keep the access investigation separate from prompt-quality evaluation so a billing error is not mistakenly recorded as a model failure.

Rotate and revoke

The production guide recommends creating a replacement, updating the application, verifying it and then revoking the retired credential. Official documentation.

Check deployed workers and scheduled jobs, not just the developer terminal, before retiring the old secret.

Use the AI API cost calculator to turn the model and workload you are considering into an estimate.

Inventory every consumer before retiring a credential: deployed services, scheduled scripts, development environments and automation settings. Create the replacement, update the intended consumers and verify a small authorized request from each important environment. Preserve a rollback decision while the old key is still valid, then revoke it once the migration checks pass.

After revocation, watch for forgotten consumers using the retired value. Update or stop them rather than restoring the old secret merely to remove noise from logs. If the key was exposed, review the account’s usage and remove the disclosed value from shared artifacts. Keep the incident record secret-free so it can be used to improve the process without repeating the exposure.

Last verified · Source ↗

Frequently asked questions

Can I put the key in browser JavaScript?
Keep the secret in protected application configuration; the provider recommends environment variables or a secret service. Official documentation.
Which project should own my test key?
Use the project that owns the experiment and keep it distinct from production if that is how your team manages access.
Should I configure key expiry?
OpenAI recommends expiry and regular rotation for project keys. Official documentation.
Why can a newly created key still fail?
Model access, credit state and spending controls can prevent an otherwise authenticated request. Official documentation.
Are the shown responses observed?
No. They illustrate the response structure; your authorized request supplies the real result.

Sources

Last verified · Source ↗