OpenAI API Authentication Failed

It means the OpenAI client was initialized without finding an API key in any of the locations it checks. The Python SDK checks in this order: (1) the api_key parameter passed to OpenAI(), (2) the OPENAI_API_KEY environment variable. If neither exists, you get this error. Most common cause: calling load_dotenv() after initializing the OpenAI client instead of before, or the .env file not existing in the working directory where the script runs.

Go to platform.openai.com/api-keys while logged in. If you created the key previously, you can only see the last 4 characters, not the full key. If you don't have the full key saved elsewhere (in your .env file or a password manager), you must create a new key. Click 'Create new secret key', give it a descriptive name, and copy the full key immediately when shown, OpenAI only displays it once at creation time.

Most likely the environment variable isn't loaded in Node.js. Ensure 'require("dotenv").config()' is the very first line of your entry file, before any imports that use 'process.env'. In ESM (import syntax) projects, dotenv must be configured differently: 'import * as dotenv from "dotenv"; dotenv.config()' or use the '--env-file' flag in Node 20+. Alternatively, check that your .env file is in the same directory where you run the node command.

Technically yes, but it's not recommended for production. Using one key across multiple apps means: you can't rotate it without updating all apps, you can't track which app is causing rate limit issues, and a breach exposes all apps. Best practice: create one API key per application or service. Keys are free to create (you pay for usage, not for the number of keys). This also enables per-app spending limits via the new Project Keys feature on platform.openai.com.

As of 2024, OpenAI has two key types: (1) Legacy API keys (sk-...) that are user-scoped and have access to all organizations the user belongs to, (2) Project API keys (sk-proj-...) that are scoped to a specific project within an organization, with granular permissions. New accounts get project keys by default. Project keys are more secure (least-privilege access) but require openai SDK >=1.0.0. Some third-party integrations built before 2024 may not support project keys, check their documentation.

Act immediately: (1) Go to platform.openai.com/api-keys and delete the leaked key right now, (2) Create a new key to replace it, (3) Update all applications with the new key, (4) Check platform.openai.com/billing for any suspicious usage that occurred between the leak and revocation, (5) If you see unexpected charges, contact OpenAI support immediately, they have a policy for addressing charges from key compromise. For future prevention: add .env to .gitignore, use GitHub secret scanning alerts, and never hardcode keys in source code.

OpenAI redacts the middle portion of your API key in error messages for security, you see only the first 5 and last 4 characters. This truncated view still helps you identify which key is failing by matching the visible prefix/suffix against your keys in platform.openai.com/api-keys (which shows the last 4 characters). If the suffix doesn't match any of your keys, the key no longer exists in your account and needs to be recreated.

In your GitHub repository: Settings → Secrets and variables → Actions → New repository secret. Name it OPENAI_API_KEY, paste your key as the value, click Add secret. In your workflow YAML: 'env: OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}' either at the job level or within the specific step that needs it. Never put the actual key value in the YAML file, always use the '${{ secrets.NAME }}' syntax. GitHub secrets are masked in logs automatically.

Almost always because environment variables aren't set in production. Your local .env file doesn't get deployed, it's in .gitignore. In production, set environment variables in your platform's dashboard: Vercel (Project Settings → Environment Variables), AWS (Lambda Configuration, EC2 Systems Manager Parameter Store, or Secrets Manager), Heroku (Settings → Config Vars), Railway (Variables tab), Render (Environment tab). After adding the variable, redeploy to ensure the new value is picked up.

Yes. Use the models list endpoint, which is free: 'curl https://api.openai.com/v1/models -H "Authorization: Bearer sk-yourkeyhere"'. A valid key returns a JSON list of models. An invalid key returns a 401 with AuthenticationError. In Python: 'client = OpenAI(api_key="sk-..."); models = client.models.list(); print("Key valid!")'. This call costs nothing and confirms the key is active before making real API calls. Verified April 2026.