OpenAI Invalid API Key: Authentication Checks

TL;DR

For an OpenAI 401 reporting an incorrect API key, check the credential, runtime environment, and organization or project configuration. Diagnose 429 by its rate, balance, or usage-limit code, and read the specific reason for a 403.

Before running the Python examples, install the dependency in the same environment: python -m pip install requests.

Identify the error category

Response	What to inspect
401 with Incorrect API key	Complete value, typos, revocation, and account ownership
401 with another authentication reason	The stated membership, permission, or IP restriction
403	The response reason, including region or other access restrictions
429	Rate limits versus balance and organization or project usage limits

A sk- prefix alone does not prove a key is valid. The complete credential, destination, and account configuration must match.

Five runtime checks

1. Confirm whether the app calls OpenAI or a compatible platform; each platform requires its own credential.
2. Inspect OPENAI_API_KEY in the actual process, excluding empty values, placeholders, and incorrect copies.
3. Check environment-loading precedence; deployment variables may override the local .env.
4. Check revocation and the key's organization and project. If you set organization or project headers explicitly, verify that they match; do not add headers blindly.
5. Reload the runtime and make a read-only check. For persistent failures, record the response request ID and contact the account owner.

Local checks without exposing credentials

import os

name = "OPENAI_API_KEY"
key = os.environ.get(name, "")
print({
    "variable": name,
    "present": bool(key),
    "length": len(key),
    "has_whitespace": any(c.isspace() for c in key),
    "wrapped_in_quotes": len(key) >= 2 and key[0] == key[-1] and key[0] in (chr(34), chr(39)),
})

Avoid debug logs that print complete request headers. A hexadecimal dump of a key is still the complete credential and should not be pasted into a support ticket.

A read-only verification request

Run this on the server. It reads the model list without generating content. A restricted credential can still be denied list access; a non-200 result does not always mean the key itself is invalid.

import os
import re
import requests

key = os.environ.get("OPENAI_API_KEY", "")
if not key or any(ord(c) < 33 or ord(c) > 126 for c in key) or any(c in key for c in (chr(34), chr(39))):
    raise SystemExit("Check the key environment variable: empty, whitespace, control characters, or quotes")
try:
    response = requests.get(
        "https://api.openai.com/v1/models",
        headers={"Authorization": f"Bearer {key}"},
        timeout=30,
    )
except requests.RequestException as exc:
    raise SystemExit("Request failed: " + type(exc).__name__) from None
print("HTTP", response.status_code)
if response.ok:
    print("Model list received")
else:
    try:
        body = response.json()
        error = body.get("error", {})
        message = str(error.get("message") or body.get("message") or "")
        message = message.replace(key, "[REDACTED]")
        message = re.sub(r"sk-[A-Za-z0-9_*.-]+", "[REDACTED]", message)
        print("code:", error.get("code") or body.get("error_code"))
        print("type:", error.get("type"))
        print("message:", message)
        print("request_id:", error.get("request_id") or response.headers.get("x-request-id"))
    except ValueError:
        print("Non-JSON response; check the base URL and network path")

Checks when switching to HiAPI

When using HiAPI, select HIAPI_API_KEY, set the HiAPI base URL, and choose the endpoint documented by the model. Start with HiAPI authentication and the endpoint selection guide.

Each request must use credentials issued for its own platform. Do not send an OpenAI credential to HiAPI as an authentication test.

FAQ

Does the correct prefix prove the key works?

No. Verify the complete value, revocation status, and account configuration.

Should I add credits immediately after a 401?

First resolve the authentication reason in the response. Balance and usage-limit errors require their own code-specific handling.

Must every request include organization and project headers?

Do not add them blindly. Multi-organization or legacy-user-key setups may need an explicit context; headers you do send must match the credential.

Can a HiAPI key call OpenAI directly?

The keys are not interchangeable. Each platform manages its own credentials; match the destination and the key.

Continue with HiAPI key troubleshooting.