Key takeaways
- An OpenAI API key is a secret that authenticates your requests and bills usage to your OpenAI organisation or project.
- Create keys on the OpenAI platform's API keys page; ChatGPT subscriptions do not include API usage.
- Keys do not expire on their own, but you should rotate them, and leaked keys may be disabled.
- API data is not used to train OpenAI models by default and is kept for a limited period for abuse monitoring.
- The API is not itself an LLM; it is the interface to OpenAI's models, from GPT text models to image, audio and embedding models.
An OpenAI API key is a secret token that lets your own code call OpenAI's models through its API, with every request billed to your OpenAI account. You create keys on the OpenAI platform, keep them in environment variables, and use them with OpenAI's SDKs or plain HTTP. This page covers what keys are and look like, where to get one, expiry, what happens to your data, how the API works, which models it offers, whether the API is itself an LLM, who owns it, and, for comparison, how Gemini API keys work.
What are OpenAI API keys?
OpenAI API keys are secret credentials that identify your project when your code sends requests to OpenAI's API. Anyone with your key can make requests charged to your account, so keys must be kept private like passwords.
Keys belong to projects within an organisation, so you can separate keys for different apps, set spending limits and permissions per project, and revoke a key without affecting others. Never put a key in front-end JavaScript, a mobile app, a public GitHub repository or a screenshot. Call the API from your backend and keep the key in an environment variable or a secrets manager. If a key leaks, revoke it immediately in the dashboard and create a new one.
What does an OpenAI API key look like?
An OpenAI API key is a long random string beginning with sk-; newer project keys begin with sk-proj-. The full key is shown only once, when you create it, so copy it straight into a password manager or your .env file.
Also asked as: what does openai api key look like
The dashboard later shows only a masked version, so if you lose it, create a new key. In code, read it from the environment rather than pasting it in:
from openai import OpenAI
client = OpenAI() # reads OPENAI_API_KEY from the environment
Tools such as GitHub's secret scanning detect committed keys, and providers may disable keys found in public places, which is another reason to keep them out of code.
Where do I get an OpenAI API key?
Sign up on the OpenAI platform, add billing details or credits for your organisation, then open the API keys page and create a key for your project. A ChatGPT Plus or Pro subscription does not include API usage; the API is billed separately.
Also asked as: where to get openai api
Steps:
- Create or sign in to your account on the OpenAI platform.
- Set up billing and, ideally, a monthly spending limit.
- Create a project for your app.
- Generate an API key in that project and copy it once.
- Store it as
OPENAI_API_KEYin your environment.
Buy credits only from OpenAI's own platform. Websites selling "cheap OpenAI keys" are reselling stolen or shared keys, which breaks OpenAI's terms and can expose your data.
Do OpenAI API keys expire?
OpenAI API keys do not expire automatically; they work until you revoke them. However, a key can stop working if it is deleted, if the project or organisation is suspended, if billing fails, or if OpenAI disables a key detected as leaked.
Good practice is to rotate keys periodically and whenever someone with access leaves a project. Use separate keys for development and production, and for each service, so revoking one does not break everything. If your app suddenly gets authentication errors, check the key in the dashboard, your billing status and whether the key belongs to the right project. Monitor usage so unexpected spikes, a sign of a leaked key, are noticed quickly.
Does the OpenAI API store data?
OpenAI states that data sent through the API is not used to train its models by default. API inputs and outputs are retained for a limited period, typically up to 30 days, for abuse and misuse monitoring, unless you qualify for zero data retention.
Also asked as: does openai api store data
Some features store data by design: files you upload, assistants, conversation state and stored responses persist until you delete them or as configured. Enterprise customers can get stronger commitments, including zero data retention for eligible endpoints and data residency options. Before sending personal or sensitive data, read OpenAI's current enterprise privacy page and your organisation's policies, minimise what you send, and avoid including identity numbers or passwords in prompts.
How does the OpenAI API work?
Your code sends an HTTPS request with your API key, a model name and input such as messages or a prompt; OpenAI runs the model and returns the output, along with token usage that determines cost.
Also asked as: how does openai api work
The main pieces:
- Text generation: send input and instructions, get a response; stream it for responsive UIs.
- Tools: let the model call your functions, search the web or run code.
- Structured outputs: require JSON that matches a schema.
- Embeddings: turn text into vectors for search and RAG.
- Images and audio: generate images, transcribe speech, synthesise voice.
Requests are stateless unless you use features that store conversation state. Handle rate-limit and server errors with retries and backoff, which the official SDKs do automatically.
What models does the OpenAI API offer?
The OpenAI API offers families of models for different jobs: GPT models for text, reasoning and coding, smaller fast models for high-volume tasks, embedding models for search, image generation models, speech-to-text and text-to-speech models, and realtime models for voice.
Also asked as: what are the openai api models
Model names and versions change frequently, so check the models page for current options, context lengths and pricing. A practical approach: start with a mid-sized general model, measure quality on your task, then try a smaller model for cost or a reasoning model for hard cases. Pin a specific model version in production so behaviour does not change unexpectedly, and test before upgrading.
Is the OpenAI API an LLM?
No. The API is the interface, a web service, through which you access OpenAI's models, many of which are large language models. The LLM is the model running behind it; the API is how your software talks to it.
Also asked as: is openai api an llm
The distinction matters when designing systems. You can swap the model behind the same API call, use multiple providers through similar interfaces, or run an open-weight LLM locally behind an OpenAI-compatible API, as tools like Ollama and vLLM offer. Your application logic, such as retrieval, validation and tools, sits outside the model. In RAG.NextUpgrad, multi-provider fallback works precisely because the app talks to models through interchangeable interfaces.
Who owns the OpenAI API?
OpenAI owns and operates the OpenAI API. OpenAI is the company that develops the GPT models and ChatGPT. Microsoft is a major partner and investor and offers OpenAI models through its own Azure OpenAI Service, which is a separate product with Microsoft's terms.
Also asked as: who owns openai api
If your organisation uses Azure, the Azure version may be preferred for billing, compliance and regional hosting; the API shape is similar but authentication, endpoints and model availability differ. For individual developers and students, the OpenAI platform is the direct route. In both cases, the usage policies of the provider apply to your application.
How many Gemini API keys can I have?
You can create multiple Gemini API keys, typically within Google Cloud projects through Google AI Studio. Rate limits and quotas generally apply per project, not per key, so extra keys in one project do not give you more free usage.
Use multiple keys to separate environments or apps and to rotate keys safely, not to get around limits; doing that through many accounts or projects can break the terms of service. Restrict keys where possible, such as limiting which APIs a key can call, store them in environment variables, and delete unused keys. If you need higher limits, enable billing on the project, which moves it to higher usage tiers.
Sources
GenAI engineer and AI product builder with 2+ years shipping production-grade AI systems: RAG pipelines, fine-tuned LLMs, hybrid retrieval and multi-modal apps across vision, speech and OCR, architected end to end from ingestion to deployment. Leads engineering for SCULT INDIA's 14-member team, founded the 500+ member TechVerse Enclave community and has mentored 200+ students. Three hackathon first prizes: Changethon 2025 (IIT Roorkee), Product Genesis at Vividhotsava 2025 (CSJMU) and BYTEBATTLE (MeetKats).
Open to GenAI roles, hackathon judging, mentorship sessions and guest talks at colleges. For campus sessions the inviting institution covers the visit end to end: travel (a First AC train ticket for journeys up to five hours, a flight for anything longer), accommodation, meals, and pickup and drop; the honorarium and workshop fees are negotiable on WhatsApp or on the call, and requests are welcome from institutions that can cover the visit this way. Email pranjulrathour41@gmail.com.
