401 Unauthorized from the OpenAI API (invalid_api_key)

Filed under APIs, auth & CORS

Why this happens

An API key is a long secret password that identifies your account to OpenAI’s servers — 401 Unauthorized is the server saying “I do not accept this password.” It says nothing yet about whether your code is good; the request was turned away at the door.

The most common reasons, in the order worth checking:

• Wrong or damaged key: an old key, a key copied incompletely, or an environment variable — a named setting stored outside your code — carrying a stray space, line break, or surrounding quotes added during pasting.
• Key in client-side code: code that runs in the visitor’s browser cannot hide a key. Anyone can view it, so keys found there must be considered exposed — and a request straight from a browser may also fail or be blocked by design.
• Organisation or project mismatch: the key belongs to a different OpenAI organisation or project than the one your code, dashboard tab, or billing view is set to.
• Revoked or deleted key: a key you or a teammate rotated, deleted, or had automatically revoked after it was detected in a public place.
• Billing — with a twist: a missing payment method or used-up credits is a real account problem, but it usually surfaces as a 429 error with an insufficient_quota code, not a 401. If you see 401, fix the key first; if you see 429 insufficient_quota, go straight to the usage and billing pages. Checking both dashboards takes a minute and stops you fixing the wrong thing.

The fix, step by step

1. If the key was ever exposed, revoke it now. Exposed means pasted into a chat, committed to a public repo, shown in a screenshot, or shipped in browser code. In the OpenAI platform dashboard, delete that key immediately — before troubleshooting anything else. An exposed key can be used by strangers at your expense, so this outranks getting the app working again.
2. Verify what key your app is actually using. Find where the key comes from — usually an environment variable such as OPENAI_API_KEY — and check its shape without sharing it: does it start with the expected prefix, is it suspiciously short, are there spaces or quote characters stuck to either end in your hosting settings? Compare its first and last few characters only against the dashboard entry, never the whole key in a message or screenshot.
3. Regenerate the key in the correct project. In the platform dashboard, confirm at the top of the page that you are in the organisation and project your app is meant to use, then create a new secret key. Copy it once, carefully, from the creation screen — keys are shown in full only when created.
4. Store the new key server-side only. Put it in your local .env file and in your hosting provider’s environment settings, and make sure your code reads it on a server or backend route — a small piece of server code that calls OpenAI and returns only the answer to the browser:

   # .env — never commit this file to a public repo
   OPENAI_API_KEY=sk-...your-new-key-here...

   Then restart the app or redeploy, because running code keeps using the old value it started with.
5. Test the key directly with curl. curl is a command-line tool for making one simple web request. This test removes your whole app from the equation — though note your terminal history can record commands, so prefer a test that reads the key from the environment rather than pasting the key into the command itself:

   curl https://api.openai.com/v1/models \
     -H "Authorization: Bearer $OPENAI_API_KEY"

   A list of models back means the key works and your app’s setup is the remaining problem. Another 401 means the key, organisation, or project is still wrong — go back to step 3, not into your code.
6. Check usage and billing before you declare victory. Open the usage and billing pages in the dashboard: confirm a payment method is on file where required, that you have credit or quota available, and that usage matches what you expect. Unexpected usage is another reason to revoke keys and start fresh.

Give your AI this prompt

I am getting a 401 Unauthorized / invalid_api_key error from the OpenAI API. The exact error body is:
[paste the error message and code only — NEVER paste my actual API key into this chat]

Help me debug safely. Rules:
- Never ask me to paste a full API key anywhere, and remind me to revoke the key immediately if it has ever appeared in client-side code, a repo, a screenshot, or a chat.
- Walk me through checking, in order: (1) the environment variable name my code reads and whether its stored value could have stray spaces, quotes, or truncation — I will check the value privately and report only its length and first/last characters, (2) that the key belongs to the same organisation and project I am viewing billing for, (3) that the key has not been revoked or deleted, (4) that my usage and billing are in good standing — and explain why billing problems usually appear as 429 insufficient_quota rather than 401.
- Show me where the key should be read on a server-side route instead of browser code, using a placeholder value.
- Make ONE change at a time, tell me how to test it (including a curl test that reads the key from the environment), and wait for my result before the next change.
- Do not rewrite unrelated files.