How to rotate your OpenAI API key

Updated October 2026

Make the new key on OpenAI's dashboard, update every place the old one is used, then revoke the old key from Security settings. A revoked key fails instantly, so switch everything over before you revoke it.

Here's the manual process, from OpenAI's own docs.

The manual steps

1. Create a new secret key on the API keys page in your dashboard.
2. Copy it immediately. Like most providers, OpenAI shows the full value once, at creation.
3. Update every place the old key lives. Environment variables, CI secrets, any serverless function or script that calls OpenAI's API.
4. Revoke the old key in your account's Security settings. OpenAI's own safety guidance is direct about this, checked October 24, 2026: "If you believe an API key has been exposed, misused, or otherwise compromised, revoke it promptly and replace it with a new key." It directs you to "Security settings to view all API keys and revoke any compromised keys."

What breaks if you miss a place

A revoked OpenAI key stops working immediately for every call, whether it was a real completion or a basic request. OpenAI's error documentation describes an invalid or revoked key as returning an authentication error, "Incorrect API key provided" or "Invalid Authentication." Any server, script, or tool still holding the old key starts failing the moment you revoke it, with no overlap window like Stripe offers.

How to check the old key is actually dead, for free

Call GET https://api.openai.com/v1/models with the old key. This only lists models, it doesn't run a completion, so checking costs no tokens. A valid key returns a 200 with a list of models. A revoked or invalid key returns 401, per OpenAI's own API reference, checked October 24, 2026.

Or let Key Robot do it

This one's coming next. It's built and being tested right now, not just a line on a roadmap. OpenAI's own API has no endpoint that creates a personal, user-owned key, only keys tied to a service account can be created that way, which is part of why this one takes more work to get right before it ships.

Once it's live, Key Robot will run this the same way it already handles Neon and Resend: make the new key, confirm your app still works with it, then revoke the old one, from your own GitHub Actions, with the key locked in your browser the whole way and never stored on Key Robot's own server.

We don't ship an integration until it passes the same bar as the live ones. Our own test kit runs 8 checks on every service we support, and it already caught a bug in our own code where Kill it now kept a leaked secret working as a backup value. We fixed it before launch.

Why this one takes a little longer to build

Most providers in this series let a program create a brand new key on its own. OpenAI's API doesn't work that way for a personal, user-owned key, only a key tied to a service account can be made by API, which changes the shape of the automation underneath. That's not a reason to skip it, it's the reason it's being tested carefully before it ships, instead of rushed out half-working.

See how to rotate your Stripe key for the other provider where a person still has to click something, or the rotate hub for the full status of every service.