How to secure your OpenAI API key in Python

The Problem

This is what most Python codebases look like today. The OPENAI_API_KEY key (sk-proj-...) lives directly in the process environment. If your repo, your CI logs, or your deployment config leaks — so does your key.

# main.py — real key lives in the process environment
import os
from openai import OpenAI

client = OpenAI(api_key=os.environ["OPENAI_API_KEY"])  # sk-proj-YOUR_REAL_KEY

def chat(messages: list[dict]) -> str:
    completion = client.chat.completions.create(
        model="gpt-4o",
        messages=messages,
    )
    return completion.choices[0].message.content

The Fix

Send the request to the KeyVault Edge proxy at https://proxy.keyvaultedge.com with the provider's usual path, your kvt_ token in X-KV-Token and the provider's base URL in X-KV-Target. The proxy refuses requests whose Origin isn't on the token's allowed hosts, then injects your real OPENAI_API_KEY, so it never sits in your app's environment.

# main.py — real key never in this process; KVE_TOKEN is host-bound
import os
import httpx

KVE_TOKEN = os.environ["KVE_TOKEN"]  # kvt_...

def chat(messages: list[dict]) -> str:
    response = httpx.post(
        "https://proxy.keyvaultedge.com/v1/chat/completions",
        headers={
            "X-KV-Token": os.environ["KVE_TOKEN"],  # kvt_... token
            "X-KV-Target": "https://api.openai.com",
            # Must match one of the token's allowed hosts
            "Origin": os.environ["APP_ORIGIN"],
            "Content-Type": "application/json",
        },
        json={
            "model": "gpt-4o",
            "messages": messages,
        },
        timeout=30.0,
    )
    response.raise_for_status()
    return response.json()["choices"][0]["message"]["content"]

Setup in 4 steps

# .env
KVE_TOKEN=kvt_...your_token
APP_ORIGIN=https://yourdomain.com  # one of the token's allowed hosts

# Or inject directly with python-dotenv
pip install python-dotenv httpx

What this protects, and what it doesn't

• Your real OPENAI_API_KEY stays at the edge, so it can't leak from your repo, logs, bundle or server environment.
• The kvt_ token is still a credential. A copied token can be replayed by anyone who can send the right headers, including a fake Origin from a server. The protection is that each token has its own rate limits, monthly cost cap and endpoint scope, and you can revoke it in one click without rotating the provider key.
• The cost cap is estimated from the usage the provider reports, so a request already in flight can overshoot it slightly.

More on layered defences in how to protect your OpenAI API key. Plans and limits are on the pricing page.

More OpenAI guides