OpenAI API Key: How to Get, Find and Check It, Fix "Not Working" (401, 429 Quota, Spend Limits), and What to Do If It Leaks

To get an OpenAI API key, sign in at platform.openai.com, open API keys (platform.openai.com/api-keys), choose Create new secret key, pick the project and permissions, and copy the key straight away: it starts with sk-proj- and is shown only once. Creating keys is free, but real use needs prepaid credits on the API billing page, which is separate from any paid chat-app subscription. To check that a key works, call https://api.openai.com/v1/models with it: a list of models means it is valid, a 401 means it is wrong, revoked or disabled. When a key stops working, the error tells you why: 401 Incorrect API key provided (typo, deleted or leaked key), 429 Credit balance exhausted (add credits; older apps show "You exceeded your current quota"), 429 Project spend limit reached (your own budget cap), 401 IP not authorized (allowlist) or 403 Country, region, or territory not supported. And if a key leaks, delete it in the dashboard, create a new one, update your apps, and check usage: OpenAI disables keys it finds on the public internet automatically, which is often why a key "suddenly" stops working after a GitHub push. Below: every step with commands for Windows, Mac and Linux, permissions and project budgets, the full error table, and a leak checklist for OpenAI, Anthropic and Google keys.

Jake's weekend project worked on Friday and returned 401 on Saturday. He had not touched the key. He had, however, pushed the project to a public GitHub repository, .env file included, and an email from OpenAI was waiting in his inbox: the key had been found and disabled. Ethan's verdict was that the system had done him a favor, and that the next key would live somewhere safer.

Using OpenAI models in a coding tool or on AWS? The cards below cover the latest GPT models, OpenAI models on AWS, OpenCode, and how leaked cloud keys are handled.

How to get an OpenAI API key

1. Sign in at platform.openai.com with your OpenAI account (your existing OpenAI login works). New accounts create an organization and a default project automatically.
2. Open API keys: the key icon in the dashboard, or go straight to platform.openai.com/api-keys.
3. Choose Create new secret key. Give it a name you will recognize later, such as the app or tool that uses it ("invoice-bot laptop").
4. Pick the project the key belongs to. Usage and budgets are tracked per project, so one project per app keeps bills readable.
5. Set permissions: All (the default), Restricted, or Read only (see permissions).
6. Copy the key immediately and store it in a password manager or secrets store. You cannot view it again; if you lose it, create a new one.
7. Add credits under Settings, Billing if you plan to use the key for real work.

Keys look like sk-proj- followed by a long random string. Older keys that start with plain sk- were user keys from before projects existed; they still work if they were not deleted, but new keys are project keys.

Jake: "Can I just use my Plus subscription login in my script?"

Ethan: "No, the API is billed separately with its own key and credits. The subscription covers the chat app only."

OpenAI API login: signing in to the platform

The OpenAI API lives at platform.openai.com, a separate dashboard from the chat app, but it uses the same OpenAI account. You can sign in with an email and password, or with a Google, Microsoft or Apple account if that is how you created your OpenAI account. Use the same method every time: signing in with Google when you originally registered with an email address can create what looks like a second, empty account with no keys and no credits.

After signing in, check two things in the top-left corner before you create keys: the organization (you may belong to several, such as a personal one and your employer's) and the project. Keys, credits, usage and limits all belong to whichever organization and project are selected, so a key created in the wrong one will bill the wrong place or hit someone else's spend limit.

Locked out by multi-factor sign-in? If you lose your authenticator app and have no recovery code, contact OpenAI support through help.openai.com. Expect an identity check that can take a few days; once verified, support can issue a one-time email login, after which you must add a new multi-factor method. That recovery option works only once, so save your recovery code somewhere safe as soon as you turn multi-factor sign-in on, and add a second method such as a passkey.

Jake: "I logged in and all my keys are gone."

Ethan: "Check the organization switcher. They're probably in your personal org while you're looking at the company one."

How to find or see an existing API key

You cannot read back a full key after creating it. The API keys page shows each key's name, a short masked version such as sk-...Ab1c, the project, who created it, and when it was last used. That is enough to identify which key an app uses, but not to copy it. If you need the key and do not have it saved:

• Look where your app reads it: an environment variable (OPENAI_API_KEY), a .env file, your CI secrets, or your cloud secrets store.
• On Windows, run echo $env:OPENAI_API_KEY in PowerShell; on Mac and Linux, echo $OPENAI_API_KEY. Print only the first few characters if anyone can see your screen.
• If it is gone, create a new key and delete the old one once nothing uses it. The "last used" date tells you when that is safe.

How to check if an OpenAI API key works

The quickest test lists the models your key can use. It costs nothing because it does not run a model:

# Mac and Linux
curl https://api.openai.com/v1/models -H "Authorization: Bearer $OPENAI_API_KEY"

# Windows PowerShell
curl.exe https://api.openai.com/v1/models -H "Authorization: Bearer $env:OPENAI_API_KEY"

A JSON list of models means the key is valid. A 401 means the key is wrong, deleted or disabled; a 403 about your country means the request comes from an unsupported location. A valid key can still fail on real requests if your credit balance is empty, so follow up with one small request:

from openai import OpenAI

client = OpenAI()   # reads OPENAI_API_KEY from the environment
response = client.responses.create(
    model="gpt-6-astra",
    input="Reply with the single word: working",
)
print(response.output_text)

Jake: "The models list works, but my script still fails."

Ethan: "Then the key is fine and the account is not. Look at the 429 code: it is usually an empty credit balance."

To see what a key has spent, open the Usage page in the dashboard and filter by project or key; if you see spend on a key you have not used for days, treat it as leaked. Our GPT-6 Astra guide goes further with the Responses API.

How to set OPENAI_API_KEY on Windows, Mac and Linux

The official SDKs read the key from the OPENAI_API_KEY environment variable, so you never paste it into your code:

# Mac and Linux, current terminal
export OPENAI_API_KEY="sk-proj-..."
# make it permanent: add that line to ~/.zshrc or ~/.bashrc

# Windows PowerShell, current window only
$env:OPENAI_API_KEY = "sk-proj-..."

# Windows, permanent for your user (open a NEW terminal afterwards)
setx OPENAI_API_KEY "sk-proj-..."

The most common "my key does not work" on Windows is setx followed by a test in the same window: setx saves the value for new terminals only. Close the terminal (and your editor, if you run code from it) and open a fresh one.

Watch for OPENAI_BASE_URL too. Tools that use the OpenAI SDK for other providers (Amazon Bedrock, local servers, routers) set it to another address, and an OpenAI key sent there fails. Our Bedrock Mantle guide shows that setup from the other side. If your code talks to OpenAI directly, make sure OPENAI_BASE_URL is empty or set to https://api.openai.com/v1.

Jake: "I set the key, ran the script in VS Code, and it still says no key."

Ethan: "VS Code was open before you ran setx. Restart the editor, not just the terminal tab."

Using your key in code: Python, Node.js and curl

Keep the key in a .env file during development, load it into the environment, and let the SDK pick it up. The .env file holds one line:

OPENAI_API_KEY=sk-proj-...

And .gitignore gets .env on its own line before your first commit. In Python, python-dotenv loads it:

# pip install openai python-dotenv
from dotenv import load_dotenv
from openai import OpenAI

load_dotenv()          # reads .env into the environment
client = OpenAI()      # finds OPENAI_API_KEY there

response = client.responses.create(
    model="gpt-6-luna",
    input="Summarize what an API key is in one sentence.",
)
print(response.output_text)

In Node.js (version 20.6 or newer can load the file with a flag, so no extra package is needed):

// npm install openai      run with: node --env-file=.env app.mjs
import OpenAI from "openai";
const client = new OpenAI();   // reads process.env.OPENAI_API_KEY

const response = await client.responses.create({
  model: "gpt-6-luna",
  input: "Summarize what an API key is in one sentence.",
});
console.log(response.output_text);

And with plain curl, which is handy for testing a key from any machine:

curl https://api.openai.com/v1/responses \
  -H "Authorization: Bearer $OPENAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model": "gpt-6-luna", "input": "Say hello"}'

If you belong to several organizations or use an older user key, add the OpenAI-Organization and OpenAI-Project headers (or the organization and project options in the SDK) so the usage lands in the right place. Every response also carries an x-request-id header; log it, because support asks for it when you report a problem.

Using your OpenAI key in Cursor, VS Code and other apps

Many tools ask for your own OpenAI key ("bring your own key") and bill your account directly. The setup is similar everywhere: paste the key into the tool's settings, leave the base URL at its default for OpenAI, and pick a model your account can use. A few specifics:

• Cursor: Settings, Models, then the OpenAI API key field. Leave the base URL override off for an OpenAI key; if you do set one, use https://api.openai.com/v1 without a trailing slash. Recent versions dropped the separate Verify button, so check that OpenAI models appear and answer. If it fails silently, open Help, Toggle Developer Tools, and read the error in the Console or Network tab; it is almost always a wrong key, a wrong base URL, or a model your account cannot use. Some Cursor features run on Cursor's own models whatever key you enter.
• VS Code extensions (Continue, Cline, Roo Code and similar): each has its own provider settings; choose OpenAI and paste the key. Most can also read OPENAI_API_KEY from the environment, which saves pasting it into several places.
• Coding agents in the terminal such as OpenCode: add the key with the tool's login command so it stays on your machine; our OpenCode guide covers it.
• Automation tools (n8n, Make, Zapier): create an OpenAI credential once and reuse it across workflows; give it a key from a project with its own spend limit, because a looping workflow can burn credits quickly.
• Chat and role-play front ends that ask for your key: whatever you send is billed to you and subject to OpenAI's usage policies, so give them a dedicated key with a low cap.
• "OpenAI-compatible" APIs (OpenRouter, Amazon Bedrock, local servers): these use the OpenAI SDK format but their own keys and base URLs. An OpenAI key does not work there, and their keys do not work on api.openai.com.

Jake: "Cursor took my key but the model list is empty."

Ethan: "Check the credit balance first. A key with no credits looks valid but every model call fails."

Is the OpenAI API key free?

Creating keys is free and you can make as many as you need. Using them is billed per token from prepaid credits: you add a balance on the billing page, requests draw it down, and when it reaches zero the API stops with a 429 until you top up (or until auto-recharge adds more, if you turn it on). A first test request may work on a new account, but real applications need credits.

Three things people mix up:

• Chat-app subscriptions (Plus, Pro or Business) include no API credits; the API is a separate bill with its own balance, so you top it up even if you already pay for the app.
• The price depends on the model, per million input and output tokens; small models cost a fraction of the flagship ones. Our GPT-6.1 Sol pricing guide has current numbers for one family.
• Buying a key from someone else is buying a stolen or resold key that can be disabled at any moment, with no recourse. The only real key is one you create on your own account.

OpenAI API free tier, free trial and free credits

"Free OpenAI API key" is one of the most searched phrases about the API, so here is the straight picture as of October 2026:

• Free tier: every new account in a supported country starts in the Free usage tier, with a $100 monthly usage limit. It is meant for creating keys and trying the API; for real traffic you buy credits, which also moves you to a tier with published, higher rate limits.
• Free trial credits: the sign-up credits new accounts used to receive in the early years are gone, and the current pricing lists no trial grant. You buy credits to use the API for real.
• Students: the API pricing has no student discount. The practical student setup is a $5 top-up, the cheapest model that does the job and a hard spend limit; at Luna's prices, $5 buys roughly 50 million input tokens.
• Paid chat-app plans (Plus, Pro): no API credits are included, whatever the plan.
• The minimum to get going: $5 in credit purchases moves your organization to the Build tier and unlocks normal limits.

If you need something genuinely free for learning or a hobby project, look outside OpenAI:

1. Google's Gemini API free tier: Flash and Flash-Lite models, among others, are free in Google AI Studio with rate limits. The catch is that free-tier prompts and answers can be used to improve Google's products, so keep private data out.
2. Local models: run an open model on your own PC with Ollama or LM Studio, free and offline. Our Nemotron guide shows which open models fit which GPU.
3. Free model variants on routers: OpenRouter lists some open models with a :free variant, rate-limited and subject to change.
4. Cloud credits: new cloud accounts often come with trial credits that cover hosted models, such as OpenAI models on Amazon Bedrock; our GPT-6 on Bedrock guide shows that route.

Jake: "So 'free OpenAI API key' is a dead end?"

Ethan: "For OpenAI itself, yes beyond test calls. Five dollars and a spend cap is the honest free tier."

OpenAI API key generators, free key lists and "unlimited" GitHub keys

Search for a free key and you will find "OpenAI API key generator" sites, Reddit threads and GitHub repositories promising working keys. None of them are what they claim:

• Generators cannot work. A key is a random secret created by OpenAI's servers and tied to an account and project. A site cannot "generate" one that OpenAI will accept; at best it shows a fake string, at worst it asks you to download something or sign in, which is how accounts and machines get compromised.
• Keys posted on GitHub or Reddit are stolen from people who leaked them by mistake. OpenAI and GitHub's secret scanning find and disable them quickly, often within minutes, so lists of "free unlimited keys" are mostly dead. Using one that still works means spending someone else's money without permission.
• Bought keys from resellers are the same thing with a price tag: shared or stolen keys that stop when the owner or OpenAI notices.

The only key that keeps working is one you create on your own account. If your goal is to avoid cost, use the free options above rather than borrowed keys.

OpenAI API pricing: what a key actually costs to use

You pay per million tokens (a token is roughly three quarters of an English word), with separate prices for input, cached input (text the API has seen recently, such as a repeated system prompt) and output. Current list prices for the main text models:

Prices are for inputs up to 272K tokens; the Batch API halves all of them for jobs that can wait up to a day. A worked example makes the spread clear. A support bot handling 1,000 conversations a day, each about 1,500 input and 500 output tokens, uses 1.5 million input and 0.5 million output tokens daily:

• On gpt-6-luna: 1.5 × $0.10 + 0.5 × $0.50 = $0.40 a day, about $12 a month.
• On gpt-6.1-sol: 1.5 × $2.00 + 0.5 × $10.00 = $8 a day, about $240 a month.
• On gpt-6-astra: 1.5 × $10 + 0.5 × $50 = $40 a day, about $1,200 a month.

Same key, same code, a hundredfold difference. Start on the cheapest model that does the job, cache long system prompts, and move up only where quality demands it. Our GPT-6.1 Sol guide compares Sol's price on OpenAI and on Amazon Bedrock.

Usage tiers and rate limits on your key

Your organization's usage tier sets both a monthly usage ceiling and the rate limits every key in it shares. Tiers rise automatically as your total credit purchases grow:

Luna gets higher token limits at each tier (2M per minute on Build, up to 180M on Grow). Limits are measured as requests and tokens per minute (RPM, TPM) and sometimes per day, and you hit whichever runs out first. Each response tells you where you stand in its headers: x-ratelimit-remaining-requests, x-ratelimit-remaining-tokens and the matching x-ratelimit-reset-* values. To move up early, use Settings, Organization, Limits, Upgrade tier. Very large traffic should ramp gradually: past a million input tokens per minute, grow by no more than half again every 15 minutes.

OpenAI API key not working: every error and fix

Note that 429 covers four very different problems. Your code should read the error code (credit_balance_exhausted, project_spend_limit_exceeded, organization_spend_limit_exceeded, or a rate limit) rather than retrying every 429, because retries cannot fix an empty balance or a budget cap.

Jake: "My new key still says 401."

Ethan: "Then your app is still reading the old one. Check the .env file and open a new terminal."

"OpenAI API key not configured": missing-key errors in code and apps

Before any 401, there is the error where no key reaches the SDK at all. The wording tells you it never left your machine:

• Python: OpenAIError: The api_key client option must be set either by passing api_key to the client or by setting the OPENAI_API_KEY environment variable.
• Node.js: OpenAIError: The OPENAI_API_KEY environment variable is missing or empty; either provide it, or instantiate the OpenAI client with an apiKey option.
• Apps and plugins: messages such as "OpenAI API key not configured", "No API key found" or "Invalid OpenAI API key" in the settings screen.

The fixes follow from where the key should come from. Check that the variable name is exactly OPENAI_API_KEY (a typo such as OPEN_AI_API_KEY is common), that load_dotenv() runs before the client is created, that the .env file sits in the folder your program starts from, and that services such as Docker containers, systemd units, cron jobs and CI runners get the variable passed in explicitly, because they do not read your shell profile. In Docker, that means docker run -e OPENAI_API_KEY ... or an env_file entry in Compose.

Jake: "It works in my terminal but not in the cron job."

Ethan: "Cron starts with an almost empty environment. Load the key in the script or the job itself."

Does OpenAI disable your API key? Every reason a key dies

Yes, and it is the most common reason a key that "worked yesterday" suddenly returns 401. The causes:

1. It leaked publicly. Keys found on the public internet, in public repositories or inside apps in app stores are disabled immediately, and the owner gets an email. Search your inbox for a message from OpenAI about a leaked key.
2. Someone deleted it. Organization owners and project owners can delete any key in their scope; a teammate cleaning up "unused" keys is a common surprise. The audit log shows who did it if your organization has it turned on.
3. The project was archived, which disables every key in it.
4. Your access changed: a personal key stops when you leave or are removed from the organization, which is why servers should use service-account keys.
5. The account or organization was suspended for a billing problem or a usage-policy violation. Every key stops at once, and the dashboard or an email explains why.

A key that is valid but out of credits or over a spend limit is not disabled; it returns 429 instead of 401, and works again as soon as the balance or limit allows. The error code tells the two situations apart in seconds.

Jake: "Can I get the disabled key turned back on?"

Ethan: "No, and you wouldn't want to; it's public now. Make a new one and move on."

API key permissions: All, Restricted and Read only

Each key has a permission level. All (the default) can do anything the project allows. Read only can read across endpoints but not create anything. Restricted lets you choose per resource (None, Read, Write, or request-specific scopes), so a key for a chatbot can call models without being able to manage files or fine-tunes. Use the narrowest level that works: a leaked Read only key is an annoyance, a leaked All key is a bill.

For servers and CI, use a service account key in the project rather than a personal key, so the key keeps working when a team member leaves and is clearly tied to one system. Projects also support IP allowlists, which make a stolen key useless from anywhere else.

Spend limits and budgets: cap the damage

Projects and organizations can have monthly spend limits. When a project reaches its limit, requests billed to it stop with 429 Project spend limit reached until the month resets or you raise the cap; the organization limit works the same way one level up. Pair the hard limit with notification thresholds (for example at 90% and 95% of the budget) so you hear about unusual spend before it stops your app. Enforcement is not instant, so a fast runaway loop can overshoot a little; set the cap with that margin in mind.

The practical setup: one project per app, a monthly cap a little above normal use on each, an email alert below the cap, and auto-recharge off unless you watch it. That turns a leaked key from an open-ended bill into a known maximum.

Checking usage per key, and admin keys

The Usage page in the dashboard breaks spend down by day, project, model and API key, which answers "which key is costing money" without any code. Filter by key after a suspected leak, and by project when you split apps into projects. The Limits page under organization settings shows your tier, spend limits and current rate limits.

For automation, OpenAI offers Admin API keys, a separate kind of key for administration endpoints: listing and deleting project keys, managing members, and reading usage and costs programmatically. Use a standard key for model calls and an admin key only for those management jobs, and guard admin keys even more closely, since one can create and delete other keys. A small script with an admin key can, for example, list every key that has not been used in 90 days so you can delete them.

What to do if your OpenAI API key is leaked

Leaks happen through public repositories, .env files in shared folders, keys built into mobile or browser apps, screenshots, chat messages, and third-party services that store your key. In October 2026, the OpenCode Console breach exposed OpenAI, Anthropic and Google keys that users had saved in that service, and some saw charges within hours (our OpenCode guide has the details). The response is the same for any cause:

1. Delete the key on the API keys page. Deleting it in a third-party tool does not revoke it; only the provider's dashboard does.
2. Create a new key, scoped to one project, with Restricted permissions if the app allows it.
3. Update every place that used the old key: environment variables, .env files, CI secrets, servers, coding tools.
4. Check usage on the Usage page from the day of the leak, by project and model, for traffic you did not make.
5. Set a project spend limit and alerts if you had none.
6. Remove the key from history: deleting the file in a new commit leaves it in Git history, so rewrite history or treat the repository as permanently exposed (the key is dead anyway once deleted).
7. Contact OpenAI support about charges you did not make, with the dates and the key's masked name.

Often you do not need to discover the leak yourself: when OpenAI detects a key on the public internet or inside an app in an app store, it disables the key immediately and emails the owner. GitHub's secret scanning forwards OpenAI keys found in public commits for exactly this. If your key stopped working right after a push, check your inbox before anything else.

The same checklist applies to other providers' keys; only the place you revoke them changes:

For AWS access keys, which are the riskier kind, our leaked AWS key guide covers the first 30 minutes step by step.

How to keep API keys safe

• Environment variables or a secrets store, not source code. On AWS, Secrets Manager keeps keys out of code and images.
• Add .env to .gitignore before the first commit, and turn on GitHub push protection, which blocks commits that contain known key formats.
• Keep keys off the client: a key inside a browser app, mobile app or desktop installer can be extracted by anyone. Call OpenAI from your own server instead.
• One key per app or tool, so you can revoke one without breaking the rest and see which one spends money.
• Rotate on a schedule: create a new key, switch your apps, delete the old one.
• Turn on multi-factor sign-in for your OpenAI account; whoever controls the account controls every key in it.
• Think before saving keys in third-party dashboards: a hosted tool that stores your provider keys becomes one more place they can leak from, as the OpenCode Console case showed. Local tools that keep keys on your machine carry less of that risk.

Using OpenAI from a website or mobile app without exposing the key

A standard key in a web page or app bundle is public the moment you ship it. There are two safe patterns:

• Your own backend: the browser or app calls your server, your server adds the key and calls OpenAI, and you can add sign-in, per-user quotas and logging in between. This is the right default for chat, text and image features.
• Short-lived client secrets for realtime voice: for the Realtime API over WebRTC, your server uses its standard key to request an ephemeral client secret (POST /v1/realtime/client_secrets) and hands that to the browser, which connects directly. The secret expires quickly, so a copy left in the page is useless soon after.

Serverless functions (AWS Lambda behind API Gateway, Cloudflare Workers, Vercel functions) make the backend pattern cheap: a few lines that forward the request, with the key stored in the function's secret settings rather than in the front-end code.

OpenAI API key vs Azure OpenAI key

Azure OpenAI (in Microsoft Foundry) runs OpenAI models inside your Azure subscription, with its own keys that are not interchangeable with OpenAI's:

• Where the key comes from: your Azure OpenAI resource's Keys and Endpoint page, which shows two keys (so you can rotate one while the other stays in use) and the resource's endpoint URL.
• How it is used: requests go to your resource's endpoint, not api.openai.com, and the key works only there. Many teams use Microsoft Entra ID sign-in instead of keys altogether.
• Billing: usage is billed to your Azure subscription, so Azure credits (including a new Azure account's trial credit) can pay for it, which is the route people mean by "Azure OpenAI API key free".
• Errors: an OpenAI key sent to Azure, or an Azure key sent to OpenAI, fails with 401. Check the endpoint and key pair first.

The same split applies on AWS: OpenAI models on Amazon Bedrock use Bedrock API keys or IAM credentials and are billed to your AWS account, as our GPT-6 Astra guide shows.

Contacting OpenAI support about a key or a bill

OpenAI's support runs through help.openai.com, where a chat assistant handles common questions and can pass you to a person. To get a useful answer quickly, include:

1. Your organization ID (Settings, Organization) and the project name.
2. The key's masked name and creation date from the API keys page; never the full key.
3. The exact error and an x-request-id from a failing response.
4. For billing disputes: the dates, the amounts on the Usage page, and when you deleted the leaked key.

For outages rather than account problems, check the OpenAI status page first; a 500 or 503 during an incident is not something support can fix for one account.

Jake: "Support asked for a request ID. Where is that?"

Ethan: "In the response headers, x-request-id. Log it on every failed call and you'll always have one ready."

Frequently asked questions

Jake's new key lives in a project of its own with a $20 monthly cap, a Restricted permission set that only calls models, and a .gitignore line he now adds before writing any code. The repository history was rewritten too, although the old key had been dead since Saturday morning. The total damage was one lost afternoon, which is about the best outcome a leaked key gets.

Revision note. Written October 20, 2026. A key that stops working right after a push was usually doing its job.