OpenAI Adds Expiry Controls for Project API Keys
Administrators can cap newly created keys' lifetimes at organization or project level, making rotation a concrete production task.
Edited by Tyronne Panaino
OpenAI added expiration dates for newly created project API keys on September 10, 2026. Its release notes classify the change as generally available. Developers maintaining API integrations and administrators setting credential policy are the affected audience.
The change adds an explicit lifetime boundary: administrators can require new keys to expire within an organization- or project-level maximum. The API changelog places those settings in Platform settings and specifically describes newly created keys, not a blanket revocation of existing credentials.
Organization limits constrain project settings
OpenAI's production guidance says a project's maximum cannot exceed the organization's limit. This makes the organization setting a ceiling rather than a suggestion that each project can relax.
The distinction between a chosen expiry date and an enforced maximum matters. A developer can set the date for a new key; the administrator's limit constrains how long that key may remain valid. Neither statement should be stretched into a claim that every historical key has already acquired an expiry date.
Rotation needs a verified replacement
OpenAI recommends a regular rotation process: create a replacement before expiry, update the application, and revoke the old key after verifying the replacement works. It also recommends storing credentials through environment variables or secret-management services rather than exposing them in source code.
The practical implication is operational, not just administrative. A team evaluating a lifetime ceiling should ask who owns the replacement, how the running application receives it, and what evidence confirms the switch. Setting a deadline without answering those questions is not the same as completing rotation.
What to verify next
A useful next checkpoint is a controlled replacement in a test integration, followed by verification of the intended organization and project limits. This article has not tested a customer's account or deployed credential policy. Expiry controls should not be read as proof that a leaked key has been found or that an integration is secure.
Status
Confirmed official update. Internal confidence is medium: the release records and implementation guidance all come from OpenAI, without independent operational validation.
Sources
Update note: Reviewed against the official records in this release run; account-specific behavior remains untested.
Sources
- OpenAI — Release notes — official
- OpenAI API — Changelog — official
- OpenAI API — Production best practices — official
Drafted with AI assistance from source briefs; reviewed for citation completeness and label accuracy.