OpenAI API returns 401 'Incorrect API key provided' even though the key looks right: what are the causes (wrong org/project, revoked key, stray whitespace, cached old key) and how do I fix it?

Cause: A 401 with the message "Incorrect API key provided" means the API did not accept the credential you sent. OpenAI's error-code guide lists the usual reasons: a typo or extra whitespace/newline in the key, a key that belongs to a different organization or project than the one you are calling, a key that was deleted or deactivated, or an old revoked key that is still cached locally (shell profile, .env file, CI secret, container image). Fix (best first): 1. Print the length and the last 4 characters only (never the whole key) of the value your process actually sees, for example in Python: len(os.environ["OPENAI_API_KEY"]) and the final 4 characters. Look for a trailing newline or quotes copied from a dashboard or .env file, and strip them. 2. Check which source wins. Environment variables, a .env loader, a framework config file and a hard-coded argument can all supply a key; an old value in one of them silently overrides the new one. Restart the shell, process manager or container after changing it. 3. Make sure the key is for the organization and project you are billing. If you belong to several organizations, or use a legacy user key, send the OpenAI-Organization and OpenAI-Project headers (or set the equivalent client options) with the IDs from your dashboard settings. 4. If the key was deleted or you cannot confirm it, create a new key in the dashboard, store it in an environment variable or secret manager on the server, update every place that used the old one, and revoke the old key. Revoked keys stop working within a few seconds; other authentication changes can take up to about 15 minutes to propagate. 5. Send the key only as an HTTP Bearer token (Authorization: Bearer <key>) from server-side code. Do not put keys in browser or mobile client code, and do not paste them into tickets or chats; if a key has been exposed, rotate it. Verify: A trivial authenticated request (for example listing models with the official SDK) returns 200 instead of 401, and the same key works from the environment where the failing job runs, not just from your laptop. Sources: https://developers.openai.com/api/docs/guides/error-codes https://developers.openai.com/api/reference/overview