OpenAI project API keys can expire: set max lifetime and rotate secrets

UpdatedSeptember 15, 2026

OpenAI now lets you set an expiration when you create a project API key, and admins can enforce a maximum key lifetime at the organization or project level in Platform settings. That is a real production control — newly issued keys cannot stay valid forever once the policy is on.

This post is the builder checklist: turn on max lifetime, create keys with an expiry, rotate before cutover, and keep secrets out of agent-readable paths. It is not an Agents API, Vercel Sandbox, or Astra walkthrough — for those, see OpenAI Agents API: what you still own when the harness is hosted and OpenAI Agents on Vercel: own the Queue and Sandbox hosting seam.

This is an excerpt. Read the full post at otf-kit.dev/blog/openai-api-key-expiration — full-stack kits your AI coding agent can actually ship to production. Browse the kits →

#architecture #agents #ai-tools

Comments

Join the discussion

No comments yet. Be the first to comment.

More from this blog

Free SDK vs paid kit: when buying actually pays for itself at checkout

You already run the free SDK. Screens look decent. Components render the same on web and native. Then you open checkout for a full-stack kit and freeze — not because the product is unclear, but becaus

Sep 18, 20261 min read

Free SDK vs paid kit: when buying actually pays for itself at checkout

Keep unsigned users off product screens with one Expo Router root gate

If a product screen can mount before you know who is signed in, the file tree is doing the wrong job. The fix is not a Redirect at the top of every screen. It is a file convention that splits signed-o

Sep 18, 20261 min read

Keep unsigned users off product screens with one Expo Router root gate

Gemini Arena labels are not API pins: eval before you swap models

Gemini Arena can show a Flash-labeled model that feels stronger than the Flash you call from the API. Mid-September 2026 chatter about a Gemini 4 Pro-class checkpoint under an old Flash name is exactl

Sep 18, 20261 min read

Gemini Arena labels are not API pins: eval before you swap models

Harbor on Vercel Sandbox: parallel Terminal-Bench without your laptop

Harbor is the open-source eval harness behind Terminal-Bench. As of 17 September 2026, harbor run --env vercel places each trial in its own Firecracker microVM on Vercel Sandbox. That is the productio

Sep 18, 20261 min read

Harbor on Vercel Sandbox: parallel Terminal-Bench without your laptop

Install Expo Skills so Cursor and Claude Code follow official Expo patterns

Expo Skills are official, structured instruction files that teach AI agents how to build, deploy, and debug Expo and React Native apps with known-good patterns. Install them once in Cursor, Claude Cod

Sep 17, 20261 min read

Install Expo Skills so Cursor and Claude Code follow official Expo patterns

OTF — kits your AI coding agent can ship to production

606 posts

Engineering notes on shipping production apps with AI coding tools — Claude Code, Cursor, Codex, Lovable, Bolt — and the stack underneath: React Native, Expo, Next.js, Supabase. Honest takes on what works, what breaks, and the full-stack kits that get you to production faster. By OTF.

Command Palette

Comments

More from this blog