OpenAI 401 “Incorrect API Key Provided” — Complete Fix Guide

The most common silent cause of a 401 is an invisible trailing space or newline after the key in a .env file. The key looks correct visually but the SDK sends sk-abc123\n instead of sk-abc123.

Correct .env format (no quotes, no trailing whitespace):

# Correct
OPENAI_API_KEY=sk-proj-abc123...

# Wrong — quoted values with some parsers add the quotes to the value
OPENAI_API_KEY="sk-proj-abc123..."

# Wrong — trailing space will be included in the value
OPENAI_API_KEY=sk-proj-abc123... 

Verify what value your process actually sees at runtime:

# Python — print the key length and first/last 4 chars
import os
key = os.environ.get("OPENAI_API_KEY", "")
print(f"Length: {len(key)} | Start: {key[:8]} | End repr: {repr(key[-4:])}")

If repr(key[-4:]) shows '...\\n' or '... ', strip the key: key.strip().

The GET /v1/models endpoint is the cheapest way to test a key — it costs no tokens and returns your available models on success:

# Replace YOUR_KEY with the actual key value
curl https://api.openai.com/v1/models \
  -H "Authorization: Bearer YOUR_KEY"

# Expected 200 response (valid key):
# { "object": "list", "data": [ { "id": "gpt-4o", ... }, ... ] }

# Expected 401 response (invalid key):
# { "error": { "code": "invalid_api_key", ... } }

Same check in Python:

from openai import OpenAI
import os

client = OpenAI(api_key=os.environ["OPENAI_API_KEY"])
try:
    models = client.models.list()
    print(f"Key is valid. {len(models.data)} models available.")
except Exception as e:
    print(f"Key error: {e}")

If your account belongs to multiple organizations, or you are using a sk-proj- key, you may need to pass the Organization ID and Project ID explicitly. A mismatch produces a 401:

# Python SDK — pass org and project IDs explicitly
from openai import OpenAI
import os

client = OpenAI(
    api_key=os.environ["OPENAI_API_KEY"],
    organization=os.environ.get("OPENAI_ORG_ID"),   # org-...
    project=os.environ.get("OPENAI_PROJECT_ID"),     # proj_...
)

// Node.js SDK
import OpenAI from 'openai';

const client = new OpenAI({
  apiKey: process.env.OPENAI_API_KEY,
  organization: process.env.OPENAI_ORG_ID,
  project: process.env.OPENAI_PROJECT_ID,
});

• Find your Organization ID at platform.openai.com/settings/organization/general — it starts with org-.
• Find your Project ID at platform.openai.com/settings — select the project, the ID starts with proj_.
• A sk-proj- key only works within its own project. If you send a request with a proj_ ID that does not match the key’s project, you get a 401.

If a key was leaked or is no longer needed:

1. Go to platform.openai.com/api-keys and click Revoke on the compromised key. Revocation is instant.
2. Click Create new secret key and choose the correct project scope.
3. Update the key in your environment variables or secrets manager before deploying.
4. If the key was committed to git, use git-filter-repo to remove it from history and rotate immediately.