When a company buys the OpenAI API, what really needs confirmation is not "which card can pay" but four things: who owns the account, how quota is controlled, whether the data terms will pass review, and whether the invoice can be booked. Any one of these left to a verbal promise can cause rework later.
This article gives an executable procurement checklist: organization and project structure, prepaid credit and limits, compliance materials, contracts and invoices, and pre-launch acceptance items. Specific prices, models, and payment methods are subject to the official pages and the on-site model pricing; this article does not hard-code numbers.
Note: OpenAI and GPT are trademarks of their respective owners. This article is for technical procurement guidance only. Product terms, data policies, and prices may change; the signed contract and official pages take precedence.
1. Split the checklist into four blocks
| Module | Questions to confirm | Deliverables |
|---|---|---|
| Account and permissions | Who is the entity, who is the Owner, how keys are split by project | Organization chart, key register |
| Quota and billing | Prepaid or postpaid, limits, alerts | Budget sheet, alert configuration |
| Compliance and data | Whether data is retained or used for training, whether a DPA exists | Terms screenshots, DPA, security report |
| Contract and invoices | Contracting entity, currency, invoice type | Contract, invoice, payment receipt |
If any of the four blocks is not documented in writing, procurement is not complete. Compliance and invoices in particular often require one to two months of internal process, so start early.
2. Account and organization: do not use a personal account for company business
- Register with a company-domain email and bind the company entity; do not use a personal email to carry company business.
- Set at least two Owners in the organization and enable two-factor authentication so one person leaving cannot take over the account.
- Split environments into three layers — organization, project, and key: production, testing, and personal experiments separate; each project gets its own key.
- Keep keys only in server-side environment variables or a secrets manager; never in the front end, Git, or chat logs.
- Revoke keys immediately when staff leave, an outsourcing engagement ends, or a project is retired; audit keys quarterly.
Some models or enterprise features require organization verification, typically with company information and a domain email; the console prompts take precedence. Verification is not a one-time task; update it when entity information changes.
3. Quota and cost: set the limits first
The OpenAI API bills by usage and usually manages quota through prepaid balance plus usage tiers; the higher the usage, the higher the rate tier available, with official pages taking precedence. When procuring, do not ask only "what is the unit price"; confirm four things at the same time:
| Control | Recommended practice | Purpose |
|---|---|---|
| Prepaid balance | Top up only 1–2× one month's estimated usage | Avoid locking up large amounts of cash |
| Project budget | Set a separate cap per project | Prevent one experiment from sinking the whole group |
| Key quota | Split by environment and by service | Locate problems quickly |
| Usage alerts | Set at 50%, 80%, and overage levels | Intervene early instead of discovering it at month-end |
Retries also create new requests and consumption. On a 429 or 529, back off and retry rather than resending immediately; for operations that already have side effects, add idempotency first.
If you connect directly to OpenAI, verify the key, organization, and project with a minimal request once credit arrives. If you use a gateway, replace the domain with the gateway address; whether organization and project headers are supported depends on the gateway documentation:
export OPENAI_API_KEY="sk-your-key"
curl "https://api.openai.com/v1/models" \
-H "Authorization: Bearer $OPENAI_API_KEY" \
-H "OpenAI-Organization: org_your_org_id" \
-H "OpenAI-Project: proj_your_project_id"
The organization and project headers are used for billing attribution and permission boundaries. If you get a 401, first check whether the key is complete and has not been revoked; if you get a 403, check whether the key belongs to the current project and has permission for the target model.
4. Compliance and data: six questions to put in the purchase order
- Are API inputs and outputs used for model training by default? Are enterprise versions and zero data retention (ZDR) available on request?
- How long is data retained, where is it stored, and what is the deletion process?
- Can you obtain the subprocessor list, and are changes notified in advance?
- Can a data processing agreement (DPA) be signed? Can security questionnaires and independent audit reports be provided?
- How are data residency and cross-border transfers handled? Is a specific region available?
- How are security-incident notification deadlines, responsibility boundaries, and service levels written into the contract?
Do not rely on verbal explanations from sales; obtain materials that can be archived:
| Material | Purpose | Who to ask |
|---|---|---|
| DPA | Clarify data-processing responsibilities | Supplier legal or sales |
| Security audit report | Demonstrate controls | Supplier security team |
| Subprocessor list | Assess downstream risk | Official website or contract appendix |
| Data retention and deletion statement | Internal compliance review | Supplier documentation |
| SLA and support terms | Clarify outage responsibility | Contract |
Terms may differ by edition and region; the signed contract takes precedence. For scenarios involving customer data, contracts, code, and personal information, complete an internal security and legal review before integration.
5. Contract, payment, and invoices
| Item | OpenAI direct | Domestic AI gateway |
|---|---|---|
| Contracting entity | Overseas entity or online terms | Domestic company contract |
| Settlement currency | USD | RMB |
| Invoice | Billing documents provided per platform | Standard or special VAT invoice, per platform |
| Payment method | Overseas card or wire transfer | Corporate transfer or online payment |
| Best for | Teams with an overseas payment channel | Teams needing RMB invoices and unified multi-model billing |
Direct billing has a clear entity, but you handle exchange rates, cross-border payment, and invoices yourself; a gateway takes over RMB payment and invoicing at the cost of an extra service boundary. Before choosing, confirm three things: service level, refund rules, and data terms.
For enterprise payment, use corporate transfer and keep four documents: contract, order, payment receipt, and invoice. Do not mix personal transfers into company books, or reimbursement and reconciliation will both become painful.
6. Pre-launch acceptance checklist
- At least two organization Owners; two-factor authentication enabled.
- Production, test, and development keys separated; the register names an owner for each.
- Budget caps and usage alerts configured, with project-level consumption visible.
- One minimal request has succeeded in the target network environment.
- Handling for 401, 403, 429, and 529 is connected to monitoring.
- Data terms, DPA, and security reports archived.
- Contract, invoice, and payment receipt delivered to finance.
- A backup model or backup channel has been rehearsed, and the business accepts the degraded mode.
Put this checklist directly into the purchase order and tick each item. Verbal confirmation does not count; materials and configuration do.
7. FAQ
Can an enterprise account be registered with a personal email?
Technically it may be possible, but it is not recommended. Use a domain email and the company entity so the account can be recovered after someone leaves, and so company data is not held in a personal account and creates compliance problems.
Is OpenAI API data used for training by default?
API terms differ from consumer-product terms. API data is generally not used for training by default, but enterprise editions, zero data retention, and different regions may have different terms. The signed data processing agreement takes precedence; send sensitive data through compliance review first.
Direct connection or a gateway: which is less work?
With an overseas payment channel and a single model, direct connection is a shorter path; if you need RMB invoices, unified multi-model billing, and domestic payment, a gateway is less work. Specific costs and exchange rates are subject to model pricing.
Can unused prepaid balance be refunded?
Subject to the contract and platform terms. Unused balance, promotional credit, and consumed amounts follow different rules; write it into the purchase order before paying rather than asking when you no longer need the service.
Is a contract necessary if procurement volume is small?
As long as company data, reimbursement, or external services are involved, use a contract and corporate payment. Individuals can top up small amounts for learning, but do not let a personal account carry company business long-term.
Next steps
If you need RMB payment, unified billing, and invoices while calling OpenAI, Claude, and other models, start by registering for the ZSQH AI Gateway, verify one request with a small amount, then split keys by project. Model availability and prices are subject to model pricing.
Related reading:
