OpenAI key hygiene: project-scoped keys, rotation, and keeping secrets server-side

TL;DR

Rotation is: create the new key, deploy it, verify traffic on the new key, then delete the old one. Deleting first is how you cause your own outage.

Steps

1. - Projects separated per environment; keys scoped per project and per integration.

• Rotation practiced on a schedule with a create-before-delete order.
• No long-lived keys in clients; ephemeral session secrets only.
• Keys in a secret manager, never in repos or logs.
• Quarterly audit; stale keys deleted.

When to use

You are seeing this: Create separate projects for dev, staging, and production. Use this skill when you run into "OpenAI key hygiene: project-scoped keys, rotation, and keeping secrets server-side".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

OpenAI's platform documents project-scoped API keys and project-level token limits; the rate limits guide documents x-ratelimit-limit-project-tokens. Verified live at https://developers.openai.com/api/docs/guides/rate-limits.