# OpenAI project API keys can expire: set max lifetime and rotate secrets

OpenAI now lets you set an expiration when you create a project API key, and admins can enforce a maximum key lifetime at the organization or project level in Platform settings. That is a real production control — newly issued keys cannot stay valid forever once the policy is on.

This post is the builder checklist: turn on max lifetime, create keys with an expiry, rotate before cutover, and keep secrets out of agent-readable paths. It is not an Agents API, Vercel Sandbox, or Astra walkthrough — for those, see [OpenAI Agents API: what you still own when the harness is hosted](/blog/openai-agents-api-owned-repo) and [OpenAI Agents on Vercel: own the Queue and Sandbox hosting seam](/blog/vercel-openai-agents-sandbox).

---

*This is an excerpt. Read the full post at [otf-kit.dev/blog/openai-api-key-expiration](https://otf-kit.dev/blog/openai-api-key-expiration) — full-stack kits your AI coding agent can actually ship to production. [Browse the kits →](https://otf-kit.dev)*