OpenAI API Keys in 2026: Expiry, Key Types and Workload Identity

Timeline (OpenAI changelog)

Usage tiers since 2026-10-06 (rate-limits guide)

The guide says an organization’s tier upgrades automatically as its total credit purchases reach each threshold. Spend alerts and hard spend limits are separate controls on the same page: a hard limit makes affected requests return a 429.

Before and after: a CI job (GitHub Actions)

Illustrative: composed from the GitHub Actions guide’s variable names and the token exchange reference’s fields. I have not run it against a real project, and the “before” is the common pattern, not something the docs show. The guide’s own SDK examples do the exchange for you; the last block just spells out what happens.

Before: a long-lived key stored as a repository secret

jobs:
  call-openai:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: node ./scripts/call-openai.js
        env:
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}

After: the job proves who it is (no OpenAI secret stored)

permissions:
  id-token: write
  contents: read
jobs:
  call-openai:
    runs-on: ubuntu-latest
    environment: production
    steps:
      - uses: actions/checkout@v4
      - run: node ./scripts/call-openai.js
        env:
          OPENAI_WIF_AUDIENCE: ${{ vars.OPENAI_WIF_AUDIENCE }}
          OPENAI_IDENTITY_PROVIDER_ID: ${{ vars.OPENAI_IDENTITY_PROVIDER_ID }}
          OPENAI_SERVICE_ACCOUNT_ID: ${{ vars.OPENAI_SERVICE_ACCOUNT_ID }}

What the exchange looks like on the wire (needs curl and jq)

AUD=$(jq -rn --arg audience "$OPENAI_WIF_AUDIENCE" '$audience | @uri')
JWT=$(curl -s -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
  "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=$AUD" | jq -r .value)

curl -s https://auth.openai.com/oauth/token \
  -H "Content-Type: application/json" \
  -d "{
    \"grant_type\": \"urn:ietf:params:oauth:grant-type:token-exchange\",
    \"subject_token_type\": \"urn:ietf:params:oauth:token-type:jwt\",
    \"subject_token\": \"$JWT\",
    \"identity_provider_id\": \"$OPENAI_IDENTITY_PROVIDER_ID\",
    \"service_account_id\": \"$OPENAI_SERVICE_ACCOUNT_ID\"
  }"
# response: access_token, expires_in, expires_at (no refresh token)

On the OpenAI side, the guide has you create a workload identity provider (issuer https://token.actions.githubusercontent.com, audience matching exactly what the workflow requests) and a service account mapping, with assertions such as repository, ref, environment and workflow_ref.

Before and after: a server workload (X.509)

Illustrative again, composed from the X.509 and Mutual TLS guides. The environment variable names are the guides’ own; the model id is a placeholder because the guides’ samples differ from page to page.

Before: a static key in an environment variable

export OPENAI_API_KEY="<static key from your secret manager>"

curl https://api.openai.com/v1/responses \
  -H "Authorization: Bearer $OPENAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model": "<model>", "input": "ping"}'

After: client certificate in, short-lived token out

export OPENAI_MTLS_CERT_CHAIN="/path/to/client-chain.pem"
export OPENAI_MTLS_KEY="/path/to/client-key.pem"
export OPENAI_IDENTITY_PROVIDER_ID="<provider id>"
export OPENAI_SERVICE_ACCOUNT_ID="<service account id>"

# 1. certificate in, short-lived bearer token out (keep access_token as OPENAI_WIF_ACCESS_TOKEN)
curl https://mtls.auth.openai.com/oauth/token \
  --cert "$OPENAI_MTLS_CERT_CHAIN" --key "$OPENAI_MTLS_KEY" \
  -H "Content-Type: application/json" \
  -d "{
    \"grant_type\": \"urn:ietf:params:oauth:grant-type:token-exchange\",
    \"subject_token_type\": \"urn:openai:params:oauth:token-type:x509\",
    \"identity_provider_id\": \"$OPENAI_IDENTITY_PROVIDER_ID\",
    \"service_account_id\": \"$OPENAI_SERVICE_ACCOUNT_ID\"
  }"

# 2. bearer token AND client certificate on every API call
curl https://mtls.api.openai.com/v1/responses \
  --cert "$OPENAI_MTLS_CERT_CHAIN" --key "$OPENAI_MTLS_KEY" \
  -H "Authorization: Bearer $OPENAI_WIF_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"model": "<model>", "input": "ping"}'