KeyKeeperOpenAI
How an agent gets a OpenAI key through KeyKeeper, what to choose on platform.openai.com, and how KeyKeeper verifies it.
| Template id | openai (also gpt, chatgpt, openai-api) |
|---|---|
| Field | openai-api-key → OPENAI_API_KEY · secret |
| Key looks like | shown once when created |
| Created at | platform.openai.com |
| Verified by KeyKeeper | GET https://api.openai.com/v1/models — lists the models this key can use |
| Template checked | 2026-09-15 |
What the agent does
keykeeper providers show openai
keykeeper save --provider openai --from-clipboard --create --purpose "what this task does"
keykeeper run -c openai -- <your command>--provider openai fills in the credential id and the field. The environment
variable is the one OpenAI's own tools read, so nothing has to be mapped.
What only you can do
Log in to platform.openai.com
Choose the project (keys are per project)
Billing must be set up before the key can be used
Copy the key, then approve the save in KeyKeeper's window.
What to choose
Create a key with Restricted permissions: only the capabilities the task needs (usually Model capabilities: Write). Not All.
The agent is told the same thing. It opens the page for you and says what to pick; it never logs in, passes 2FA or pays on your behalf.
What KeyKeeper checks
- Before writing: the value must look like a OpenAI key (shown once when created). A wrong paste is refused before anything is stored, and the agent is told why — without the value.
- After saving: KeyKeeper itself sends
GET https://api.openai.com/v1/modelswith the key in theAuthorizationheader (lists the models this key can use). The agent receives accepted, rejected or could not reach — never the value.
Rotation and expiry
OpenAI's public key guide does not promise one universal expiration policy. Record an expiry only when the project console shows one. Rotate or revoke at platform.openai.com.