Error messages

Incorrect API key provided

Incorrect API key provided

This is the OpenAI API turning down the key in your request. In Python it surfaces as an AuthenticationError, with the body printed after it. This one is from an openai-python issue:

AuthenticationError: Error code: 401 - {'error': {'message': 'Incorrect API key provided: sk-qVL45***************************************D1Vi. You can find your API key at https://platform.openai.com/account/api-keys.', 'type': 'invalid_request_error', 'param': None, 'code': 'invalid_api_key'}}

It's a very common one, with 3,600 GitHub issues quoting "Incorrect API key provided" as of September 25, 2026, and 1,235 of them opened since June.

The masked key is the useful part

OpenAI echoes back the start and end of whatever key it got, with stars in between. Check those characters against the key you think you're using. That comparison sorts most cases in a few seconds.

If the ends don't match, something else supplied the key. The usual suspect is an OPENAI_API_KEY left in your shell profile or a .env file, since openai-python (we read 3.19.2) falls back to that variable when you don't pass api_key. An echo with an odd shape is a strong hint too. In one 2024 report it started with a 3, and an SDK maintainer pointed out that OpenAI keys start with sk-. The reporter had an Azure OpenAI key, which only works against their Azure endpoint.

If the ends do match, the key itself is the problem. OpenAI's error-code page lists a typo or extra space, a key from a different organization or project, a key that's been deleted or deactivated, or an old revoked key cached locally. Make a fresh key and replace it everywhere.

Keys that were never meant for OpenAI

The echoed key is sometimes a word. In a June 2026 Codex issue it read Incorrect API key provided: ollama. (someone had set up a local model, but requests were still going to api.openai.com). In another from August it was dummy., a placeholder Codex sent after its sign-in fell back. We didn't expect how often the rejected "key" turns out to be a placeholder, and in both cases the fix was to the address the request went to. If you see a word where a key should be, look at your base URL or provider setting.

Codex prints it in its own wrapper, unexpected status 401 Unauthorized: Incorrect API key provided: ..., followed by auth error code: invalid_api_key and the URL it called. Read that URL line for the same reason.

No key at all

If the request carried no key, the API uses a different, longer message with code set to null:

"message": "You didn't provide an API key. You need to provide your API key in an Authorization header using Bearer auth (i.e. Authorization: Bearer YOUR_KEY), or as the password field (with blank username) if you're accessing the API from your browser and are prompted for a username and password. You can obtain an API key from https://platform.openai.com/account/api-keys.",
"type": "invalid_request_error",
"param": null,
"code": null

You won't usually see that from openai-python. In 3.19.2 the client stops before sending anything and raises "Missing credentials. Please pass an `api_key`, `workload_identity`, `admin_api_key`, or set the `OPENAI_API_KEY` or `OPENAI_ADMIN_KEY` environment variable." It turns up from raw HTTP calls and third-party clients.

Retrying won't help

The SDK doesn't retry a 401 (it retries 408, 409, 429 and 5xx), and neither should you. OpenAI documents a few other 401s that look similar but need different fixes: "You must be a member of an organization to use the API" means your account left its organization, and "IP not authorized" means an IP allowlist on the project blocked you.