The OpenAI application programming interface (API) lets software connect to OpenAI models using secret credentials called API keys. Project owners can use this guide to manage keys, model access, spending controls, usage monitoring, and data security.
Note: If you requested one API key and are not a project owner, the Center for Media and Technology Solutions (CMTS) manages the key and limits for you. After your key is created, you will receive an email with the default limits and instructions for requesting changes. If you need multiple keys or advanced controls, use the project-management steps below.
Project Provisioning and Default Budget
CMTS configures your project using the monthly budget submitted with your request. Before making API calls, review the project’s spending controls.
Spend alerts notify you when spending reaches a threshold; they do not stop API requests. A hard spend limit stops affected requests when tracked spending reaches the configured amount. Enforcement is not instantaneous, so spending can slightly exceed the limit.
- Sign in to the OpenAI Platform and select your project.
-
Open Limits.
- Under Spend, select Edit spend limit.
- Enter the Monthly spend limit.
-
If you need an enforced cap, enable Enforce a hard limit.
Important: Enabling a hard limit can interrupt API requests. Confirm that this behavior is appropriate for your project before continuing.
- Select Save.
Set alerts below the limit to allow time to respond. If these controls are unavailable, contact CMTS.
Estimating Your API Budget
API costs depend on the model, input and output volume, and any additional tools or services used. Tokens are units used to measure model input and output; they are not the same as characters or words.
Start with a small set of representative requests using the OpenAI API quickstart. Compare the reported usage with OpenAI API pricing, then estimate costs for your expected request volume.
Include testing, retries, longer inputs, and growth in your estimate. Review actual spending regularly and adjust your alerts and limits as needed.
Managing Model Access
Allow only the models your project needs. Review the OpenAI models documentation, API pricing, and model deprecations before choosing models.
Model access controls determine which models a project can use. Key permissions control access to API operations. These controls serve different purposes. Streaming responses alone do not indicate that a model is expensive.
Rate Limits
Rate limits vary by model, organization, project, and usage tier. They can measure requests, tokens, images, or other usage over a specified period.
Review the limits shown for your project and models. During testing, send requests at a controlled rate and log request frequency without recording API keys or sensitive content.
If requests reach a rate limit, reduce the request rate and follow the retry guidance in OpenAI’s rate limit documentation.
Managing API Keys
As a project owner, you are responsible for provisioning and managing API keys for your team, research group, or course.
You will need to create an API key in order to start issuing requests.
Creating and Securing API Keys
Use a personal project key for your own development work. For deployed applications and automated jobs, use a project service account—an identity for software rather than a person. Do not distribute your personal key to other users.
- Sign in to the OpenAI Platform and select the intended project.
- Open API Keys.
- Select Create new secret key.
-
Choose the appropriate owner and enter a descriptive name.
-
Set an expiration date consistent with project policy. For a personal key, select Restricted and grant only the required permissions.
- Select Create secret key. The secret value appears.
- Store the secret value in your approved secret manager.
For a service-account key, review and restrict its permissions after creation.
If key creation or service-account options are unavailable, contact CMTS.
Store application keys in a secret manager and provide them to server-side software. Keep keys out of source control, browser code, mobile apps, logs, and screenshots.
Separating Access and Usage
Use separate credentials for different applications or deployments so you can attribute usage and revoke access independently. Creating another key does not create a separate project budget or rate limit. Contact CMTS if workloads need separate project controls.
If a key is exposed or used without authorization, revoke it immediately, replace it, update affected applications, and review usage. For routine rotation, test the replacement before revoking the previous key.
Monitoring Usage & Alerts
Review your project’s spending and API-key usage on the Usage page. Select the appropriate project, date range, and available filters.
Configure project spending alerts and review unexpected activity promptly. Separate keys help attribute usage; they do not provide independent project budgets.
You or the approving department remain financially responsible for project usage.
Budget Responsibility and Billing
- API usage costs are charged to your cost center on a quarterly basis via internal cost transfer.
- You are responsible for monitoring your usage and ensuring it aligns with your budget.
- Project owners are responsible for reviewing per-key usage and responding to unexpected activity.
Advanced Controls & Documentation
For advanced configuration, consult OpenAI’s API keys and service accounts guide and API Platform permissions documentation.
If you need help, contact CMTS at cmtshelp@jhu.edu or visit support.cmts.jhu.edu.
Frequently Asked Questions
Q: Can I set a project-wide limit?
A: Yes. Review the project’s monthly spend limit and whether hard-limit enforcement is enabled. Alerts alone do not stop requests. Contact CMTS if you cannot change the required settings.
Q: Who gets billed for usage?
A: Your cost center. Make sure your usage aligns with your approved budget.
Q: What if I need to add or remove users/students?
A: Contact CMTS to arrange the appropriate access. Do not distribute your personal API key. People making direct API requests should use their own authorized credentials; applications should use an appropriate service account.
Q: What if I want to delegate key management to a teaching assistant (TA) or co-principal investigator (co-PI)?
A: Assign only the project permissions needed for their responsibilities. Project-owner access includes broader administrative capabilities, so use it only when those capabilities are required. Contact CMTS for help arranging access.
Example Workflow
- Accept the project invitation sent to your university email address.
- Review the approved budget, spending alerts, and hard-limit setting.
- Configure appropriate credentials and permissions for individual development and automated applications.
- Run a small representative test and review usage before expanding deployment.
- Monitor spending regularly and reconcile it with the billing summary from CMTS.
Data Disclaimer
Before sending university data through the OpenAI API, confirm that the specific data and use case are approved under Johns Hopkins University (JHU) policy. An enterprise account does not by itself establish approval for every data type or integration.
Confirm that any connected software, storage, and external services are also approved to handle the data they receive. If approval is unclear, consult CMTS, IT Policy, or Research IT before proceeding.
Please refer to JHU Guidelines for Responsible Use of AI for general guidance on best practices around using AI tools or contact itpolicy@jhu.edu or Research IT RITServices@jh.edu if you are unsure about your particular use case or source data. Use of university data with OpenAI APIs is subject to university policy. For details, refer to