AI / Core OpenAI Codex Application Fundamentals Interview Questions
What are OpenAI's key API authentication and security concepts?
Proper authentication and security practices are fundamental to building production OpenAI applications. Mistakes here can lead to credential exposure, unexpected costs, or data breaches.
import os from openai import OpenAI # 1. NEVER hardcode API keys - use environment variables client = OpenAI( api_key=os.environ.get("OPENAI_API_KEY"), # required organization=os.environ.get("OPENAI_ORG_ID"), # optional project=os.environ.get("OPENAI_PROJECT_ID"), # optional ) # 2. Project API keys (recommended over user keys) # Create per-project keys at: platform.openai.com/api-keys # Scoped to a specific project - limits blast radius on leak # 3. Organisation structure for teams: # Organisation > Projects > API keys (per project) # Rate limits and costs tracked per project # 4. Service accounts (enterprise) # Use service account keys for production, not personal user keys # 5. IP allowlists (available in API settings) # Restrict which IPs can use an API key # 6. Codex CLI authentication options: # a) API key: OPENAI_API_KEY env var # b) ChatGPT sign-in: codex auth (auto-generates key for ChatGPT subscribers)
| Practice | Reason |
|---|---|
| Use environment variables | Never expose keys in code, logs, or repositories |
| Use project-scoped API keys | Limits blast radius if a key is leaked - only one project is affected |
| Rotate keys regularly | Limits exposure window from undetected leaks |
| Set spending limits | Prevents runaway costs from bugs or abuse |
| Enable IP allowlists | Prevents use from unexpected network locations |
| Use service accounts in prod | Personal user keys tied to employment - service accounts are stable |
OpenAI never charges for API key creation. Billing is based on tokens consumed. Set monthly spend limits in the organisation settings to prevent unexpected charges during development.
What is the most important security rule for managing OpenAI API keys in code?
What is the advantage of using project-scoped API keys over organisation-level user keys?
More Related questions...
