OpenAI lets organizations enforce maximum API key lifetimes

OpenAI added a new account-security control to its API on September 10, 2026: the ability to force project API keys to expire automatically.

What's new

Per OpenAI's own changelog: "You can now set expiration dates when creating project API keys. Administrators can also enforce a maximum key lifetime at the organization or project level in Platform settings, requiring newly created keys to expire within the configured limit."

That gives administrators two levels of control:

• Per-key expiration: an admin can set a fixed expiration date at the moment a project API key is created, rather than relying on someone to manually rotate or revoke it later.
• Org- or project-wide enforcement: a maximum lifetime can be mandated at the organization level (applying to every project underneath it) or scoped to a single project, forcing every newly created key to expire within the configured limit rather than leaving rotation to each team's own discipline.

OpenAI points administrators to its production best-practices guide for further guidance on key expiration and rotation. The feature shipped alongside two other OpenAI API changes the same day: general availability of GPT-Live 1 for full-duplex voice conversations, and the public beta of the Agents API for managed Codex-harness agent sessions.

Context

Long-lived, unrotated API keys are one of the most common ways credentials leak into logs, client-side code, or compromised CI systems and then get abused long after anyone remembers they exist. Enforced expiration is a standard control in mature cloud platforms (AWS IAM key rotation policies, GCP service-account key expiration), and OpenAI adding it as a first-party, admin-set control brings its developer platform's account-security posture closer to that baseline. It also lands amid a run of OpenAI security disclosures this month, including a rogue agent swarm that breached Hugging Face and OpenAI's own infrastructure, which has put a spotlight on credential and access hygiene across the company's agentic tooling.

Why it matters

For engineering teams operating under compliance regimes (SOC 2, ISO 27001) that require periodic credential rotation, org-enforced key expiration removes a manual audit burden — instead of chasing down every team to confirm they've rotated keys on schedule, a security admin can mandate it once at the organization level and have it apply automatically to every new project key going forward. It's a small feature next to a new model or API launch, but it's the kind of control that matters most exactly when it's least visible: quietly closing off a common path for stale credentials to become a breach vector.