Where can I find my OpenAI API key?
Go to platform.openai.com/api-keys, the API dashboard, and click Create new secret key. You cannot "find" an existing key — the full secret is displayed only at creation and is never shown again. If you lost it, delete the old key and create a new one. This is a developer account, separate from ChatGPT.
Why — the first-principles explanation
The framing of this question hides the answer. You're looking for a key you think is stored somewhere in your account, like a password you can reveal. It isn't there. OpenAI keeps only a hash — a one-way fingerprint that can verify a key you present but cannot reconstruct the key itself. The dashboard shows you a stub like `sk-...4ftY` and a creation date. That's all that survives. If OpenAI could show you the key again, so could anyone who breached the dashboard, and that's precisely the risk the design eliminates.
This is why "I lost my key" has exactly one solution: rotate it. Delete the old one, create a new one, paste the new one into your app. There is no recovery flow, no support ticket that retrieves it. That feels hostile the first time and correct every time after.
The second confusion is which account you're even in. ChatGPT and the API are separate products with separate billing. Your ChatGPT Plus subscription buys you nothing on the API side; API usage is metered pay-as-you-go and needs its own payment method and credits. People sign in at chat.openai.com, hunt through settings, find no keys, and conclude the feature is broken. It isn't — it lives at platform.openai.com/api-keys, the API dashboard, on the developer side of the house.
Once you have the key, how you handle it matters more than where you found it. A key is a bearer credential: whoever holds it is you, as far as the API is concerned, and can spend your money. It travels in an `Authorization: Bearer` header. The standard practice is to store it in an environment variable named `OPENAI_API_KEY` — every OpenAI SDK reads that variable automatically — rather than typing it into your source code, where it will eventually reach a public repository. That's not paranoia; automated scanners crawl GitHub for `sk-` prefixed strings within minutes of a push. Since April 2024, OpenAI has pushed users toward project-scoped keys, which limit what a leaked key can touch and let you kill one project's key without breaking everything else.
An example that makes it click
It's like a hotel key card, not a house key. When you check in, the desk programs a card and hands it to you. Lose it in the parking lot, and the clerk doesn't reach under the counter and pull out "your" card — there's no such thing. She kills the old card and prints a new one. The lock only knows how to check cards, not how to make copies of yours.
And here's the part that matters: that card doesn't have your name on it. Anyone who picks it up walks straight into your room. An API key works the same way — whoever holds it can run up your bill, and the API has no way to know it isn't you. So you don't tape it to your laptop lid, and you don't paste it into your code. You put it in an envelope the computer knows to check — an environment variable — and if it ever gets out, you go straight to the desk and get a new card.
How to do it
- Go to platform.openai.com/api-keys — this is the API dashboard, not ChatGPT. Sign in or create a developer account.
- Click 'Create new secret key'. Give it a name that says where it will be used, like 'invoice-bot-dev'.
- Scope it to a Project rather than to your user account unless you have a specific reason not to.
- Copy the full key immediately — the complete secret is shown only at this moment and never again.
- Paste it into a password manager or an environment file before closing the dialog.
- Set it as an environment variable: 'export OPENAI_API_KEY="your_key_here"' on macOS/Linux, or 'setx OPENAI_API_KEY "your_key_here"' in Windows PowerShell. The SDKs read it automatically.
- Add billing: the API is metered pay-as-you-go and is billed separately from any ChatGPT subscription.
- If you lost a key or it leaked, delete it in the dashboard and create a replacement — there is no recovery.
Key facts
- OpenAI API keys are created and managed in the API Dashboard at platform.openai.com/api-keys (as of 2026-07).
- The full secret key is displayed only at creation; OpenAI stores a hash, so a lost key must be replaced, not recovered.
- Keys are sent to the API in the 'Authorization: Bearer' header and are read automatically by OpenAI SDKs from the OPENAI_API_KEY environment variable.
- OpenAI API keys carry the 'sk-' prefix, which is what automated secret scanners search for in public code repositories.
- Since April 2024, user-level API keys have been deprecated in favor of project-scoped API keys.
- API access and billing are separate from ChatGPT subscriptions — a ChatGPT Plus plan does not include API credits.
▶ The 60-second explainer (script)
Where's your OpenAI API key? Here's the thing nobody tells you up front: you can't find it. It doesn't exist anywhere for you to look up. OpenAI only stores a hash of your key — a fingerprint that can check a key but can't rebuild one. So the dashboard shows you the last four characters and a date, and that's it. If you lost it, you don't recover it. You delete it and make a new one. That's not a bug, that's the security model — if they could show it to you, a breach could show it to anyone. So, the actual steps. Go to platform dot openai dot com slash api-keys. Note that's the platform site, not ChatGPT. That's mistake number one — people dig through ChatGPT settings and find nothing, because the API is a completely separate product with separate billing. Your ChatGPT Plus subscription buys you zero API credits. Click Create new secret key, scope it to a project, and copy it right then, in that dialog, because it will never appear again. Put it in your password manager. Then set it as an environment variable called OPENAI_API_KEY — every OpenAI SDK picks that up automatically, and it keeps the key out of your source code. Why does that matter? Your key starts with s-k dash. Bots crawl GitHub hunting for exactly that prefix, and they find leaked keys within minutes of a push. Whoever holds your key spends your money. Treat it like a hotel card that opens your room and has no name on it.
What authoritative sources say
People also ask
I lost my API key. How do I see it again?
You can't. OpenAI stores only a hash, so the full secret is unrecoverable after creation. Delete the old key in the dashboard and create a new one.
Why can't I find API keys in my ChatGPT account?
Because they're not there. The API is a separate developer product with separate billing, managed at platform.openai.com/api-keys. A ChatGPT subscription doesn't include API access.
Is the OpenAI API free?
No. It's metered pay-as-you-go and requires its own payment method or prepaid credits, independent of any ChatGPT plan. Costs depend on the model and token volume.
What do I do if my key leaked?
Delete it immediately in the dashboard and create a replacement. Assume it was used — check your usage dashboard for unexpected spend, since anyone holding the key can bill your account.
Should I use a project key or a user key?
Project-scoped keys, which OpenAI has favored since April 2024. They limit blast radius: you can revoke one project's key without breaking every other integration you run.