How to create an OpenAI admin key (and what it can do)

Where: platform.openai.com/settings/organization/admin-keys. Click create, name it, copy the sk-admin-… value once — it is never shown again.

You need to be an organisation owner. If you're a member of someone else's org, an owner has to create it for you.

What it is for

An admin key is the credential for reading your own billing data programmatically. Without one, your options are the web dashboard and CSV exports.

It unlocks:

• Costs — daily spend, grouped by project or line item
• Usage — token counts by model, project, key or user, at minute/hour/day granularity
• Project and key management — list, create and delete API keys across the organisation
• Members — invite and manage users

It cannot make inference calls. That separation is deliberate: your production key can't read your billing data, and your billing key can't spend money on tokens.

Creating one

1. Go to platform.openai.com/settings/organization/admin-keys.
2. Create new admin key.
3. Name it after where it will actually live — ci-cost-export, tkn-ios, finance-dashboard. Naming it "admin key 2" is how you end up unable to revoke precisely later.
4. Copy the value. It is displayed exactly once.
5. Put it straight into a secret manager. Not a .env in the repo, not a note.

Using it

The header is the same as any OpenAI key — Authorization: Bearer — but the endpoints live under /v1/organization/.

export OPENAI_ADMIN_KEY="sk-admin-..."

# daily cost, most recent first
curl -s "https://api.openai.com/v1/organization/costs?start_time=1717200000&limit=31" \
  -H "Authorization: Bearer $OPENAI_ADMIN_KEY" | jq

# every project in the org
curl -s "https://api.openai.com/v1/organization/projects?limit=100" \
  -H "Authorization: Bearer $OPENAI_ADMIN_KEY" | jq '.data[] | {id, name}'

# the keys inside one project
curl -s "https://api.openai.com/v1/organization/projects/$PROJECT_ID/api_keys?limit=100" \
  -H "Authorization: Bearer $OPENAI_ADMIN_KEY" | jq '.data[] | {id, name, redacted_value}'

start_time is a Unix timestamp. More detail, including response shapes, in the OpenAI Costs endpoint explained.

The security tradeoff, stated plainly

An admin key is more powerful than the keys it manages. Anyone holding it can enumerate your projects, read your spend, and delete every API key in the organisation.

So:

• Never put it in the same place as your inference keys. Different secret store, different environment, different repository. Otherwise one leak escalates from "rotate a key" to "the whole organisation".
• Never ship it to a client. Not in a browser bundle, not in a mobile binary. See why you can't ship an API key in a mobile app.
• Name and rotate them. An unnamed admin key you're afraid to delete is worse than no key.
• One per consumer. So you can revoke one integration without breaking the others.

If a third-party tool asks for one, the question worth asking is where it stores it — that is the whole risk. Is it safe to give an app your admin key? walks through what a good answer looks like.

If you can't get one

Plenty of developers work in an organisation where they'll never be an owner. Your options:

• Ask an owner to create one scoped to your use and hold it in shared secret storage.
• Use the web dashboard and CSV export, and accept the manual step.
• Track spend at the source instead — for locally-run agents, session logs on disk carry token counts and need no credential at all.

What this unlocks

An admin key is the prerequisite for any tool that shows your real spend — including TKN, which uses exactly the endpoints above to put today's OpenAI number next to Anthropic, xAI and Gemini on one screen. TKN stores it in the iOS Keychain, device-only and behind Face ID, and never uploads it.

Sources

• OpenAI — Usage and Costs APIs cookbook
• OpenAI — Best practices for API key safety