# OpenAI key works in one project but fails in another: org and project key scoping
## The symptom
The same key works for inference but fails on management endpoints, or works in project A and fails in project B. Regenerating "fixes" it until someone copies the new key into the wrong place again.
## Confirm the cause
1. **Project-scoped key, wrong project.** Most keys are minted under one project. Calls selecting or defaulting to a different project fail. Check the key's project on the API keys page in the dashboard.
2. **Management endpoints need admin keys.** The organization plane (usage, projects, users) requires an admin key. A regular project key is rejected there while working fine for inference.
3. **Service accounts vs user keys.** Service account keys belong to the project, not a person, and survive when a human leaves. User keys can stop working when their owner departs.
4. **Stale scope headers.** SDKs send org/project headers when `OPENAI_ORG_ID` or `OPENAI_PROJECT_ID` are set. A stale env var pointing at the wrong project overrides the key's home and produces exactly this symptom. Unset them unless you deliberately select scope.
## The fix
Mint the key in the project that will use it, or use a service account key for shared automation. Keep admin keys in admin tooling, never in application code. If you select scope explicitly, do it deliberately and document why.
## Verify the fix
From the failing environment, call `GET /v1/models` and confirm 200, then call the previously failing endpoint. Confirm the env does not export stale `OPENAI_ORG_ID` or `OPENAI_PROJECT_ID` values.