# Connect OpenAI

Canonical URL: https://docs.fuse.init.inc/integrations/openai/setup

Create an OpenAI API key and submit it to Init as a customer bearer credential.



## Before you start [#before-you-start]

OpenAI uses **customer credentials** (bearer API key). There is no platform OAuth app for this provider.

**Connection admin/user** creates the key in OpenAI and submits it through Init Connect. **Engine operator** does not store a shared OpenAI client secret for Connect.

You need:

* An OpenAI account with permission to create API keys for the target organization and project.
* Access to Init Connect for the tenant that will own the connection.

## Configure the provider [#configure-the-provider]

### Create an API key (**Connection admin/user**) [#create-an-api-key-connection-adminuser]

1. Sign in to the OpenAI platform and open API keys for the correct organization.
2. Create a secret API key with the minimum project access required for the Init actions you will run (Responses, Moderations, Embeddings, Models as applicable).
3. Copy the key once and store it in a secret manager. Do not commit it or paste it into tickets.
4. Optionally note the organization ID and project ID if the key can access multiple orgs/projects and you need to pin requests.

There is no one-time Init platform app registration for OpenAI.

## Connect to Init [#connect-to-init]

**Connection admin/user** starts an OpenAI Connect session and submits only these contract fields:

| Field             | Required | Notes                                    |
| ----------------- | -------- | ---------------------------------------- |
| `api_key`         | Yes      | Bearer secret from the OpenAI dashboard. |
| `organization_id` | No       | Sends `OpenAI-Organization` when set.    |
| `project_id`      | No       | Sends `OpenAI-Project` when set.         |

Use inert placeholders in docs and screenshots only, such as `example-token-not-valid`. Never embed a real key.

## Permissions [#permissions]

OpenAI authorization is key- and project-scoped rather than OAuth scope strings. Limit the key to the project that should be reachable from Init.

If you omit `organization_id` / `project_id`, OpenAI uses the defaults associated with the key. Set them when the key can address multiple organizations or projects and you need deterministic routing.

## Verify the connection [#verify-the-connection]

1. Complete Connect and confirm the connection is active.
2. Run Init’s connection test or a safe read such as listing models.
3. Success looks like a `200` from OpenAI model/account reachability checks without authentication errors.

## Rotate or revoke access [#rotate-or-revoke-access]

1. Create a new API key in OpenAI.
2. Reconnect in Init with the new `api_key` (and the same optional org/project IDs if still required).
3. Revoke the previous key in the OpenAI dashboard after the new connection succeeds.

If a key is exposed, revoke it immediately in OpenAI, then reconnect with a replacement.

## Troubleshooting [#troubleshooting]

| Symptom                        | What to check                                                                          |
| ------------------------------ | -------------------------------------------------------------------------------------- |
| `401` / invalid API key        | Key was copied incorrectly, revoked, or belongs to a different org.                    |
| Requests hit the wrong project | Set `organization_id` and/or `project_id` to the intended IDs.                         |
| Model or endpoint forbidden    | Key or project lacks access to the model; adjust project limits in OpenAI.             |
| Connect rejects the payload    | Submit only `api_key` plus optional `organization_id` / `project_id`; no other fields. |