Why am I getting 401 unauthorized on OpenAI API

You're getting a 401 error because the OpenAI API doesn't recognise your authentication credentials. This hits developers immediately after copying API keys, switching between projects, or when keys expire without warnin

Why am I getting 401 unauthorized on OpenAI API

You're getting a 401 error because the OpenAI API doesn't recognise your authentication credentials. This hits developers immediately after copying API keys, switching between projects, or when keys expire without warning.

What's actually happening

A 401 Unauthorized error means OpenAI's servers rejected your API key before even looking at your request. The full error typically reads: `{"error":{"message":"Incorrect API key provided","type":"invalid_request_error","code":"invalid_api_key"}}` or `{"error":{"message":"You didn't provide an API key","type":"invalid_request_error"}}`.

This happens in four specific situations. First, you've copied the key incorrectly — missing the `sk-` prefix, including extra spaces, or cutting off characters at the end. Second, you're using an old key that's been deleted or rotated in your OpenAI dashboard. Third, you're sending the key in the wrong format in your HTTP headers. Fourth, you've created a service account key but you're trying to use it with a personal project, or vice versa.

OpenAI changed how API keys work in early 2024. Legacy keys starting with `sk-` work across all projects. New project-specific keys look like `sk-proj-` and only work within their assigned project. If you created your key before February 2024, it's probably a legacy key. Anything after that is project-scoped.

How to fix it

1. Check your key format in the dashboard

Go to platform.openai.com/api-keys and log in. Look at your key list. If the key you're using shows "Revoked" or doesn't appear at all, it's dead. Click "Create new secret key", give it a name like "Production API", select the correct project from the dropdown, then copy the entire key including the `sk-` or `sk-proj-` prefix. You'll only see this once — OpenAI doesn't store or display it again.

2. Verify your code is sending it correctly

Your HTTP request needs the header `Authorization: Bearer YOUR_KEY_HERE`. In Python with the official library, that's `openai.api_key = "sk-..."`. In curl, it's `-H "Authorization: Bearer sk-..."`. Check for hidden characters — paste your key into a plain text editor to see if there are line breaks or spaces at the start or end.

3. Match your key to your project

If you're using a `sk-proj-` key, make sure it belongs to the project you're trying to access. In the dashboard under Settings → General, check which project you're currently viewing in the top-left dropdown. Create a new key specifically for that project if needed. Legacy `sk-` keys bypass this issue entirely.

4. Check for environment variable mistakes

If you're loading the key from `.env` or system environment variables, print it out temporarily: `console.log(process.env.OPENAI_API_KEY)` in Node, `print(os.getenv("OPENAI_API_KEY"))` in Python. You might see it's empty, cut off, or contains placeholder text. Make sure your `.env` file has no quotes around the key and no spaces after the equals sign: `OPENAI_API_KEY=sk-proj-abc123`.

If that doesn't work

Generate a completely fresh API key and test it immediately with a simple curl command: `curl https://api.openai.com/v1/models -H "Authorization: Bearer YOUR_NEW_KEY"`. If this returns a list of models, your key works and the problem is in your application code. If you still get 401, your account has an authentication problem.

Check if you've hit a different API error like 429 rate limiting or insufficient quota issues, which sometimes get confused with 401s. Log into platform.openai.com/usage to see if you have available credits. If your balance is $0.00 and you see "Quota exceeded" anywhere, you need to add payment details under Settings → Billing, even though the error code says 401.

For persistent authentication failures that survive fresh keys and correct formatting, you'll need to contact OpenAI support through help.openai.com. Include your organization ID (found under Settings → General), the exact error message, and the first 8 characters of the key that's failing.

Questions people actually ask

Q: Can a 401 error mean my API key was stolen?

A: No, stolen keys still work — they'd just rack up charges. A 401 means the key itself is invalid or improperly formatted. If you see unexpected charges, that's different.

Q: Do API keys expire automatically?

A: No. OpenAI keys work indefinitely until you manually revoke them. They don't expire based on time, but they stop working if you delete them or if your account gets restricted.

Q: Why does my key work in Postman but not in my code?

A: Postman might be adding the `Bearer` prefix automatically while your code isn't. Check your authorization header format exactly matches `Authorization: Bearer sk-...` with the space after Bearer.

What to remember

  • Copy the entire key including `sk-` or `sk-proj-` — missing even one character breaks authentication
  • Project-scoped keys only work within their specific project — check the dropdown in your dashboard
  • Test new keys immediately with a simple API call before integrating them into complex code
  • Print your environment variables during debugging — empty or malformed values cause silent 401s
  • Zero balance triggers quota errors that sometimes show as 401 — check platform.openai.com/usage first

---

*openai-support.com is an independent resource, not affiliated with OpenAI Inc.*

Related help