Authentication

All OpenAI API calls use HTTP Bearer authentication. The API key is passed in the Authorization header.

API Key Types

Project-scoped keys (sk-proj-...) — Scoped to a single project. Recommended for production.
Legacy user keys (sk-...) — Access all projects the user belongs to.
Organization ID — Required when a user belongs to multiple organizations.

HTTP Headers

Never hard-code API keys in source code. Use environment variables, secret managers, or vault services. Project-scoped keys (sk-proj-...) are preferred because they limit blast radius if compromised.

Per-environment keys, per-tenant if needed

The minimum is one project per environment (dev / staging / prod) with one key each. That gives you per-environment rate limits, per-environment budgets, and per-environment dashboards. The key for prod has a tiny attack surface (only your production code reads it) so a leak from a dev laptop doesn't drain prod money.

For multi-tenant SaaS, a per-tenant key is overkill but a per-tenant ledger is mandatory — see the Production track. Keys are about isolation; ledgers are about attribution. They solve different problems.

Code

API key from environment·python

import os
from openai import OpenAI

# Option 1: Automatic (reads OPENAI_API_KEY env var)
client = OpenAI()

# Option 2: Explicit with org and project scoping
client = OpenAI(
    api_key=os.environ["OPENAI_API_KEY"],
    organization="org-XXXXXXXXXXXXXXXX",
    project="proj_XXXXXXXXXXXXXXXX",
)

Per-project key with org scoping·text

Authorization: Bearer sk-proj-...
OpenAI-Organization: org-XXXXXXXXXXXXXXXX
OpenAI-Project: proj_XXXXXXXXXXXXXXXX

API Key Types

HTTP Headers

Per-environment keys, per-tenant if needed

Code

External links

Exercise

Progress

Comments 0