OpenAI Invalid API Key: Fix 401 Errors

TL;DR

For an OpenAI 401 reporting an incorrect API key, check the credential, runtime environment, and organization or project configuration. Diagnose 429 by its rate, balance, or usage-limit code, and read the specific reason for a 403.

Before running the Python examples, install the dependency in the same environment: python -m pip install requests.

Identify the error category

Response	What to inspect
401 with Incorrect API key	Complete value, typos, revocation, and account ownership
401 with another authentication reason	The stated membership, permission, or IP restriction
403	The response reason, including region or other access restrictions
429	Rate limits versus balance and organization or project usage limits

A sk- prefix alone does not prove a key is valid. The complete credential, destination, and account configuration must match.

Five runtime checks

Confirm whether the app calls OpenAI or a compatible platform; each platform requires its own credential.
Inspect OPENAI_API_KEY in the actual process, excluding empty values, placeholders, and incorrect copies.
Check environment-loading precedence; deployment variables may override the local .env.
Check revocation and the key's organization and project. If you set organization or project headers explicitly, verify that they match; do not add headers blindly.
Reload the runtime and make a read-only check. For persistent failures, record the response request ID and contact the account owner.

Local checks without exposing credentials

import os

name = "OPENAI_API_KEY"
key = os.environ.get(name, "")
print({
    "variable": name,
    "present": bool(key),
    "length": len(key),
    "has_whitespace": any(c.isspace() for c in key),
    "wrapped_in_quotes": len(key) >= 2 and key[0] == key[-1] and key[0] in (chr(34), chr(39)),
})

Avoid debug logs that print complete request headers. A hexadecimal dump of a key is still the complete credential and should not be pasted into a support ticket.

A read-only verification request

Run this on the server. It reads the model list without generating content. A restricted credential can still be denied list access; a non-200 result does not always mean the key itself is invalid.

import os
import re
import requests

key = os.environ.get("OPENAI_API_KEY", "")
if not key or any(ord(c) < 33 or ord(c) > 126 for c in key) or any(c in key for c in (chr(34), chr(39))):
    raise SystemExit("Check the key environment variable: empty, whitespace, control characters, or quotes")
try:
    response = requests.get(
        "https://api.openai.com/v1/models",
        headers={"Authorization": f"Bearer {key}"},
        timeout=30,
    )
except requests.RequestException as exc:
    raise SystemExit("Request failed: " + type(exc).__name__) from None
print("HTTP", response.status_code)
if response.ok:
    print("Model list received")
else:
    try:
        body = response.json()
        error = body.get("error", {})
        message = str(error.get("message") or body.get("message") or "")
        message = message.replace(key, "[REDACTED]")
        message = re.sub(r"sk-[A-Za-z0-9_*.-]+", "[REDACTED]", message)
        print("code:", error.get("code") or body.get("error_code"))
        print("type:", error.get("type"))
        print("message:", message)
        print("request_id:", error.get("request_id") or response.headers.get("x-request-id"))
    except ValueError:
        print("Non-JSON response; check the base URL and network path")

Checks when switching to HiAPI

When using HiAPI, select HIAPI_API_KEY, set the HiAPI base URL, and choose the endpoint documented by the model. Start with HiAPI authentication and the endpoint selection guide.

Each request must use credentials issued for its own platform. Do not send an OpenAI credential to HiAPI as an authentication test.