Connect OpenAI
Create an OpenAI API key and submit it to Init as a customer bearer credential.
Before you start
OpenAI uses customer credentials (bearer API key). There is no platform OAuth app for this provider.
Connection admin/user creates the key in OpenAI and submits it through Init Connect. Engine operator does not store a shared OpenAI client secret for Connect.
You need:
- An OpenAI account with permission to create API keys for the target organization and project.
- Access to Init Connect for the tenant that will own the connection.
Configure the provider
Create an API key (Connection admin/user)
- Sign in to the OpenAI platform and open API keys for the correct organization.
- Create a secret API key with the minimum project access required for the Init actions you will run (Responses, Moderations, Embeddings, Models as applicable).
- Copy the key once and store it in a secret manager. Do not commit it or paste it into tickets.
- Optionally note the organization ID and project ID if the key can access multiple orgs/projects and you need to pin requests.
There is no one-time Init platform app registration for OpenAI.
Connect to Init
Connection admin/user starts an OpenAI Connect session and submits only these contract fields:
| Field | Required | Notes |
|---|---|---|
api_key | Yes | Bearer secret from the OpenAI dashboard. |
organization_id | No | Sends OpenAI-Organization when set. |
project_id | No | Sends OpenAI-Project when set. |
Use inert placeholders in docs and screenshots only, such as example-token-not-valid. Never embed a real key.
Permissions
OpenAI authorization is key- and project-scoped rather than OAuth scope strings. Limit the key to the project that should be reachable from Init.
If you omit organization_id / project_id, OpenAI uses the defaults associated with the key. Set them when the key can address multiple organizations or projects and you need deterministic routing.
Verify the connection
- Complete Connect and confirm the connection is active.
- Run Init’s connection test or a safe read such as listing models.
- Success looks like a
200from OpenAI model/account reachability checks without authentication errors.
Rotate or revoke access
- Create a new API key in OpenAI.
- Reconnect in Init with the new
api_key(and the same optional org/project IDs if still required). - Revoke the previous key in the OpenAI dashboard after the new connection succeeds.
If a key is exposed, revoke it immediately in OpenAI, then reconnect with a replacement.
Troubleshooting
| Symptom | What to check |
|---|---|
401 / invalid API key | Key was copied incorrectly, revoked, or belongs to a different org. |
| Requests hit the wrong project | Set organization_id and/or project_id to the intended IDs. |
| Model or endpoint forbidden | Key or project lacks access to the model; adjust project limits in OpenAI. |
| Connect rejects the payload | Submit only api_key plus optional organization_id / project_id; no other fields. |