What is an OpenAI API key?
An OpenAI API key is a secret credential that authenticates requests to the OpenAI API. It identifies your account, authorizes the request, and ties any usage charges back to you. Because the key is effectively a password to spend on your account, it must be kept secret and should never be shipped inside a mobile app.
What an OpenAI API key does
When your code calls the OpenAI API, it sends the key so OpenAI can verify the request belongs to a real account and apply that account's permissions, rate limits, and billing. You create keys in the OpenAI platform dashboard, where you can also name them, set usage limits, and revoke them. A key is shown in full only once when created, so you copy it then and store it securely. Some accounts can scope keys to a project or restrict them, which limits what a single key can do if it is exposed.
Keeping your API key secure
The main risk with any API key is leakage. If a key ends up in a public repository, a shipped app binary, or client-side code, anyone who finds it can run requests billed to you. The safe pattern for a mobile or web app is to keep the key server-side: the app talks to a backend you control, and the backend holds the key and calls OpenAI. That way the secret never leaves your infrastructure. Store keys in environment variables or a secrets manager rather than in source code, set usage limits as a backstop, and rotate a key immediately if you suspect it leaked, which disables the old one and issues a replacement.
API keys, backends, and AppFlight
This client-versus-server split is exactly why secret keys do not belong in an app. AppFlight builds native Swift and SwiftUI apps and offers a one-click OpenAI integration that follows that rule: public client keys ship in the app, while a secret key like an OpenAI API key stays server-side in your own Supabase backend rather than embedded in the binary. The separate bring-your-own-AI keys that AppFlight uses to build the app, for Claude Code or Codex, run locally on your Mac and call your provider directly, and AppFlight does not proxy or read them.
FAQ
Where do you get an OpenAI API key?
You create one in your account on the OpenAI platform dashboard, under API keys. You copy the key when it is shown, since the full value is not displayed again, and store it somewhere secure such as a server environment variable or a secrets manager.
Can I put my OpenAI API key directly in my iOS app?
No, you should not. Anything shipped in an app binary can be extracted, and a leaked key lets others spend on your account. The standard pattern is to keep the key on a backend you control and have the app call your backend, which then calls OpenAI.
What happens if my OpenAI API key leaks?
Someone can make requests billed to your account until you revoke it. If a key is exposed, rotate it immediately in the dashboard, which disables the old key and issues a new one, and set usage limits to cap the damage.