How to Get OpenAI API Key

1. Sign In and Choose the Right Project

Open platform.openai.com and create an account or sign in. Complete the onboarding prompts shown to you. The OpenAI quickstart links directly to the API key dashboard.

Think of the account as your staff pass, the organization as the company, and the project as a room assigned to one application. The key is the credential your software uses to enter that room.

Choose the intended organization in the organization switcher. Select an existing project, or, as an organization owner, use the project menu's Create project option and complete its details. A named project such as website-test makes the purpose clearer. OpenAI's project guide documents these controls.

For company work, ask the owner to add you to the appropriate project. Avoid starting a client integration under a personal billing account simply because it is already open.

2. Create a Project API Key

In organization settings, select your project, open API Keys, and choose + Create new secret key. This creates a key associated with the selected project. Project key instructions.

For your own first test, use a user-owned project key. Give it a recognizable name if prompted, such as local-test. Choose Restricted permissions and enable the operations your app needs. All grants full access and is the default; Read Only limits the key to read operations. API key permissions. For the test below, allow creating Responses, the permission OpenAI calls api.responses.write. Response-writing permission.

Copy the secret immediately into secure storage. OpenAI displays the complete value only at creation. If you lose it, create a replacement; you cannot reveal the original again. Finding and managing API keys.

Set an expiration date and record who will replace the key. Organization policy may require an expiry or restrict which key types you can create. If an option is unavailable, ask the administrator about the policy. OpenAI production guidance. Use the API key expiry and rotation plan before a test becomes a running service.

When a Service-Account Key Is Better

For a deployed app or scheduled team workflow, I would use a service account, an identity for software rather than a person. An organization or project owner creates it under the selected project's Members → + Service account. Save the generated key immediately. Use a dedicated project: service accounts cannot be added directly to the Default project. Service-account setup.

Review its access under the project's API Keys settings after creation. The service-account creation dialog does not offer the same permission controls as a user-owned key. Permission differences. The operational payoff is clear ownership of the application credential when team members change.

3. Add API Billing and Set a Spend Limit

ChatGPT billing and API billing are separate. Paying for ChatGPT does not complete the API payment setup. Open the intended organization's API billing overview; an organization owner can manage its billing. OpenAI billing guidance.

New API accounts use prepaid billing. Select Add payment details, complete payment setup, choose the initial credit purchase, and confirm. Review Use auto-reload before checkout: OpenAI says it is enabled by default. Turn it off for a manual top-up experiment, or deliberately configure its threshold and monthly reload limit. A purchase can take a few minutes to appear. Prepaid setup.

For current model rates, use OpenAI's pricing page, with the site's OpenAI API pricing guide for app-budget context.

Enable Enforcement if You Want Requests to Stop

In Project settings → Limits → Spend → Edit spend limit, enter the Monthly spend limit, enable Enforce a hard limit, then save. You need permission to manage that project's settings. Add a spend alert below the cap so someone can respond before service stops. Spend-limit instructions.

Hard-limit enforcement has a delay, so recorded spend can slightly exceed the configured amount. An organization hard limit covers its projects together. A prepaid balance can also be exceeded during delayed cutoff, and manual purchases are outside the automatic reload limit. Hard-limit behavior, prepaid behavior.

For a production rollout, read the OpenAI API hard spend limits guide and choose who may raise the cap when it interrupts service.

4. Store the Key Where the App Can Use It Safely

Keep the key in a secret manager, a system designed to store credentials, or provide it to your server through an environment variable named OPENAI_API_KEY. An environment variable is a named setting the running program can read without embedding the secret in its source code. Production storage guidance.

Do not put a standard API secret in website JavaScript, a mobile app, a repository, a screenshot, or a support message. Browser and mobile code reaches users' devices; your server should hold the secret and make the request. Give teammates their own access instead of passing around one person's key. API key safety.

If a tool asks you to paste a key: use its documented credential field only after you are comfortable with the vendor receiving that credential. My recommendation is a dedicated project and restricted key for that integration, with a spend cap and an owner. A normal text box, chat message, or unfamiliar “key checker” is the wrong place to diagnose a connection. Ask the vendor which permissions it needs and where it stores the secret.

5. Test With One curl Request

Run this in Bash on your computer. curl is a command-line tool that sends a web request. The first lines prompt for the secret without displaying it or putting its literal value into the command you type; the environment variable lasts for that shell session.

read -r -s -p "OpenAI API key: " OPENAI_API_KEY
printf '\n'
export OPENAI_API_KEY

curl https://api.openai.com/v1/responses \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $OPENAI_API_KEY" \
  -d '{
    "model": "gpt-6-astra",
    "input": "Reply with a short greeting."
  }'

This uses the request structure and model in OpenAI's text-generation example. The Responses API is the endpoint receiving your input and returning the model's output. The authorization header carries the secret; the JSON body chooses the model and supplies the instruction. This is an API usage request, so billing and model access must be ready.

A successful response contains an output array with a message containing output_text content. Look for the greeting there. Do not assume the text is always the first array item. If you get an error object, use its message and code below. Response structure.

After the test, run unset OPENAI_API_KEY to clear this shell's variable when you no longer need it. For deployment, configure the secret in your hosting environment rather than rerunning a terminal prompt.

Key Not Working? Check These First

Read the error before creating another key. Several failures have nothing to do with the secret itself.

A 429 response can mean a spending or credit problem as well as a rate limit. Repeated retries cannot replenish credits or change a configured cap. OpenAI error codes, key permissions.

If Your API Key Leaks, Revoke It Immediately

Treat a secret pasted into a public repository, screenshot, or message as exposed. Deleting the visible copy cannot invalidate copies someone already obtained.

1. Revoke the exposed key. Open the API keys page in the correct project and delete it. Applications using it may stop until you replace it. Key deletion.
2. Create a replacement and update affected apps. Test the replacement, then check that deployed processes use it.
3. Review usage and billing. Investigate unexpected requests and contact OpenAI Support about suspected misuse. OpenAI recommends immediate rotation when a leak is suspected. Leak response guidance.
4. Fix the exposure. Remove the secret from code and logs, and correct the storage or sharing practice that leaked it. If the account itself may be compromised, change the password, sign out other sessions, and report unauthorized activity. Account recovery steps.

Five Places This Setup Pays Off

The benefit is an integration with a known owner and budget. These are practical ways a team could apply the setup, ranked by immediate usefulness.

A working key proves that a request can run. It does not prove that your prompts are reliable, that a vendor handles credentials well, or that an automation deserves access to customer data. Those remain product and operational decisions.

Two Useful Things to Build Around the Setup

The strongest opportunity is an embedded connection assistant for software that asks customers for an OpenAI key. DataForSEO estimates 1,000 monthly US searches for “how to get openai api key.” That is evidence of setup friction, not a forecast of paying customers. A tool vendor could buy or build a guided project checklist, secure credential field, explicit test button, and readable result. The smallest version should live inside the product that needs the connection. The catch: vendors can build it themselves, so the value must come from reducing their support burden and keeping instructions current.

An error explainer is a useful support feature, with weaker standalone demand. The same check estimates only 10 monthly US searches for “openai api key not working.” An automation vendor or implementation agency could offer a form accepting a redacted error code and message, then explain whether to fix credentials, credit, permissions, or traffic speed. Its first version needs a maintained decision table, not custody of the user's key. The catch is the small measured query volume and the fact that many tools already display these errors. I would attach it to onboarding rather than launch a separate paid product.

These are DataForSEO keyword-overview estimates for US English, checked for this guide. They measure searches, not unique users or purchase intent.

Your Monday move: pick one integration, name its owner, create its project, set its spend control, and save one successful test result with the secret removed. That is a useful handoff to whoever maintains it next.

If you want help taking that integration into production, AI production systems covers the operational work around it.