What Is an OpenAI API Key and How Does It Work?

An OpenAI API key is a secret credential that lets your code make authenticated requests to OpenAI's models — GPT-4, GPT-3.5, embeddings, image generation, and more — without a human logging into a website. You generate it once from your OpenAI account, paste it into your application or environment variables, and every request your code sends includes it as proof that the request belongs to your account and should be billed to you.

It's not the same thing as a ChatGPT login. ChatGPT is the consumer chat interface you use in a browser; the API key is for developers building software that talks directly to OpenAI's models programmatically — a backend service, a CLI tool, a Slack bot, an internal automation script. You can have a ChatGPT Plus subscription and no API key at all, or an API key and never touch ChatGPT's web interface. They're billed separately and serve different purposes.

What an OpenAI API key actually looks like

An OpenAI API key is a long string that starts with sk- (secret key), followed by a random alphanumeric sequence. You'll typically see it once, at creation time, in your OpenAI dashboard. After that it's masked — you can't view the full value again, only regenerate a new one if you lose it.

A typical request using the key looks like this:

curl https://api.openai.com/v1/chat/completions \
  -H "Authorization: Bearer sk-your-key-here" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "gpt-4o",
    "messages": [{"role": "user", "content": "Explain API keys in one sentence"}]
  }'

The Authorization: Bearer <key> header is the standard pattern most LLM APIs use, including OpenAI's. Whoever holds this string can make requests and generate charges on your account, which is why it's treated as a secret — same category as a database password or a private SSH key.

What the key controls

Once you have a valid API key, it governs several things:

• Authentication — proves the request is coming from an account in good standing
• Billing — usage (tokens in, tokens out, per model) is metered against the account tied to that key
• Rate limits — your account tier determines how many requests per minute you can make
• Access scope — in organizations with multiple projects, keys can be scoped to specific projects or given restricted permissions

If you're building a product on top of an LLM, the API key is effectively your product's connection to the model. Lose it, leak it, or hit your rate limit, and your app stops working until it's fixed.

Getting and using an OpenAI API key, briefly

Creating a key involves signing up for an OpenAI developer account, adding a payment method, and generating a key from the API keys section of the dashboard. From there, most people store it as an environment variable (OPENAI_API_KEY) rather than hardcoding it into source files, and load it at runtime in whatever language they're using.

const response = await fetch("https://api.openai.com/v1/chat/completions", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${process.env.OPENAI_API_KEY}`,
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    model: "gpt-4o",
    messages: [{ role: "user", content: "Summarize this in 3 bullets" }]
  })
});

Security practices worth following

• Never commit keys to version control. Add .env files to .gitignore before your first commit, not after.
• Use environment variables or a secrets manager, not hardcoded strings in source files.
• Rotate keys periodically, and immediately if one is ever exposed (pushed to a public repo, pasted in a support ticket, etc.).
• Scope keys per project or environment when the platform supports it, so a leaked staging key doesn't expose production billing.
• Set usage limits in your account dashboard so a bug or malicious use can't run up an unexpected bill.

These practices aren't specific to OpenAI — they apply to any provider issuing a secret bearer token, including Anthropic's Claude API and third-party gateways.

If you're already paying for Claude access

Not everyone building on LLMs starts with OpenAI. If your team already has Claude access through a subscription and you want programmatic API access — streaming responses, tool use, per-application keys, usage tracking across a team — without separately managing OpenAI billing and keys, SubToAPI turns that existing Claude access into a standard HTTPS API. You get sub_live_... application keys, a dashboard for usage and seats, and the same Authorization: Bearer request pattern developers already know from working with OpenAI's API. Plans start at Solo €9, with Team and Scale tiers for multiple seats — see /pricing for details, or jump into the /docs/quickstart to see the request format side by side with what you'd write for OpenAI.

The core concept — a secret key authenticating requests, tied to usage and billing — is the same regardless of which model provider is behind it. Understanding how OpenAI's key works means you already understand how most LLM API keys work.

questions

Is an OpenAI API key the same as a ChatGPT Plus subscription? No. ChatGPT Plus is a consumer subscription for the chat web app and has a flat monthly price. An OpenAI API key is for developers calling models programmatically, billed separately based on token usage.

What happens if my OpenAI API key gets leaked? Anyone with the key can make requests billed to your account. Revoke it immediately in your OpenAI dashboard, generate a new one, update it everywhere it's used, and check your usage logs for unexpected activity.

Do I need a credit card to get an OpenAI API key? Yes — OpenAI requires a valid payment method on file before API requests will succeed, since usage is billed per token rather than through a flat subscription like ChatGPT Plus.