OpenAI API Setup Tutorial: Account, Key, Base URL, and First Call (2026)

Getting started with the OpenAI API takes only four things: an account you can sign in to, a working API key, a project with billing enabled, and the correct Base URL plus one successful call. It sounds simple, but what usually blocks new teams is not the code — it is the account structure, the payment method, and how the URL is assembled.

This article follows the actual order of operations: account and project, creating a key, topping up, installing the SDK, making a first call with the Responses API, reading usage, troubleshooting 401 and 429, and finally switching the Base URL to an OpenAI-compatible gateway. The examples focus on the Responses API; older tools that only support Chat Completions can follow the same approach with the endpoint swapped.

Note: OpenAI, ChatGPT, and GPT are trademarks of OpenAI. This article uses publicly documented API behavior as of October 2026. Model names, quotas, and prices are subject to model pricing and the official documentation.

1. What accounts, organizations, and projects each mean

The OpenAI platform has at least three layers, and mixing them up is the most common source of errors:

Account: the login credential that determines who can enter the console;
Organization: the unit that owns billing and usage; team collaboration is usually managed at the organization level;
Project: the isolation unit for keys, usage, and permissions; split projects by environment or business line.

A common misconception is treating a ChatGPT subscription as API credit. The two are separate: the subscription buys access to the chat product, while the API is billed separately per call. Before onboarding, confirm who owns the account, who pays, and who holds admin rights, so that key ownership does not get lost when staff change.

2. The order for creating an API key

Follow these steps in order and do not skip any:

Sign in to the API console with an admin account and confirm the current organization is correct.
Create or select a project under the organization, split by development / testing / production.
Open the project's API Keys page and create a new secret key.
Give the key a name that shows its purpose, such as "production-customer-bot".
Copy the full key immediately into a password manager or your deployment platform's secret manager.
Set project permissions, budgets, or quota limits as needed, then save.

The full key is usually shown only once at creation. It is normal for the page to show only the first and last few characters afterward; do not expect to copy it again. If it is lost, create a new key and disable the old one — do not try to recover it.

3. Top-up, billing, and quotas

Whether the API is prepaid or postpaid depends on the account type and region; follow what the console shows. Before enabling billing, check three things:

Whether the payment method supports your card or channel;
The billing cycle and how to obtain invoices;
Whether you can set budget alerts and hard limits per project.

Payment failures are a frequent problem during onboarding. If a card is declined, first check the billing address, cardholder name, and verification method, then contact the issuing bank; do not resubmit repeatedly in a short window, because some risk systems will lock the card. Teams using a gateway can usually top up in RMB; rates and crediting rules are subject to the pricing page. Prices change, and the page shown at checkout prevails.

4. Install the SDK and send your first curl request

First install the official Python SDK:

python3 -m pip install --upgrade openai
export OPENAI_API_KEY="sk-your-key"
export OPENAI_BASE_URL="https://api.openai.com/v1"
export OPENAI_MODEL="the model name copied from the pricing page or official docs"

Call the Responses API with curl to confirm the URL, key, and network all work:

curl -sS "$OPENAI_BASE_URL/responses" \
  -H "Authorization: Bearer $OPENAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "'"$OPENAI_MODEL"'",
    "input": "Explain what an API gateway is in one sentence."
  }'

Do not type the model name from memory; copy a currently available name from the pricing page or official documentation into the OPENAI_MODEL environment variable. A 200 with output in the response body means the path works; a 401 points to the key first, and a 404 points to the Base URL and model name.

5. Your first Python call

The following sends a minimal request with the Responses API and prints the text result:

import os
from openai import OpenAI

client = OpenAI(
    api_key=os.environ["OPENAI_API_KEY"],
    base_url=os.environ.get("OPENAI_BASE_URL", "https://api.openai.com/v1"),
)

resp = client.responses.create(
    model=os.environ["OPENAI_MODEL"],
    input="Describe the boundaries of your capabilities in three sentences.",
)

print(resp.output_text)

If your framework only supports Chat Completions, switch the call to client.chat.completions.create(...) and put the messages in messages. The two APIs use different request paths, and mixing them is the most common cause of 404s.

6. Reading usage and billing

The console's Usage page usually breaks consumption down by project, model, and time, and separates input from output. During onboarding, check it once a day, focusing on:

which project is consuming;
how much is input versus output;
whether there are abnormal failed retries;
whether budget alerts are working.

Keep the request ID from each response in your logs. When a billing dispute or incident occurs, the request ID is the first piece of evidence the provider can use to locate the problem. Teams should also record the mapping between users, feature modules, and request IDs on the application side; otherwise the bill shows only totals and cannot be attributed.

7. Troubleshooting 401 and 429

401 means the identity is not accepted. Check in order: does the request header include Bearer; does the key contain extra spaces or newlines; has the key been deleted or its project disabled; are you sending a gateway key to the official address. Before swapping keys, confirm where the request is actually going, or you may waste time.

429 has two meanings: rate limiting and insufficient balance. Look at the error code and response headers; do not slow everything down by default. insufficient_quota usually points to balance or quota and requires a top-up or a project limit change; only rate-related errors are suited to exponential backoff. Retries make sense only for 429, 5xx, and network errors — retrying 400, 401, 403, or 404 just wastes quota. For a fuller troubleshooting order, see OpenAI API error troubleshooting.

8. Official direct access versus a compatible gateway

Dimension	Official direct	OpenAI-compatible gateway
Endpoint	`https://api.openai.com/v1`	The gateway Base URL, usually also ending in `/v1`
Account and payment	Official account, official payment methods	Register on the gateway site; RMB top-ups and invoices supported
Network	Depends on the local network and cross-border links	Usually provides a domestically reachable entry point
Model coverage	OpenAI's own models	May also offer models from multiple vendors; see the pricing page
Billing	Official invoice	On-site balance and usage records
Incident handling	Through official support channels	The gateway investigates upstream; users keep request IDs
Best for	Teams that use only OpenAI and already have a compliant payment path	Domestic teams, multiple models, unified billing

Do not choose on unit price alone. Whether payment is smooth, who handles incidents, and whether models can be switched at any time all affect long-term cost. Prices change; the pricing page is the reference.

9. Switching to a compatible gateway: change only the Base URL

Migration is usually cheaper than expected, because a compatible gateway keeps the same request format. Order of operations:

Register on the gateway and create a key via the sign-up page.
Change OPENAI_BASE_URL to the gateway address, keeping /v1.
Replace the key with the gateway key; do not mix the two sets of keys.
Copy the model name from the gateway pricing page; do not reuse official names and hope for the best.
Call /v1/models and a minimal request first, then move production traffic.
Keep the official or a backup route as a fallback.

"OpenAI-compatible" means the request and response formats are compatible, not that every extended capability is identical. Whether advanced endpoints such as files, batch processing, and tool calling are supported must be checked item by item in the gateway documentation; do not assume everything is available. For details on compatibility scope, see the OpenAI-compatible API guide.

10. Key security and pre-launch checks

A leaked key translates directly into charges. The minimum requirements:

Store keys only in server-side environment variables or a secret manager; never in front-end code or committed to Git;
Split keys by environment; test and production must not share one;
Label each key with an owner and purpose, and disable it promptly when someone leaves or a project changes;
Never print full keys in logs; keep only the last four characters;
Rotate keys regularly and revoke immediately if you see abnormal calls.

Confirm each item before launch:

[ ] Account, organization, and project ownership are clear;
[ ] The payment method works and budget alerts are set;
[ ] Keys live in environment variables or a secret manager;
[ ] The Base URL contains only one /v1;
[ ] A minimal request returns 200 with normal content;
[ ] 429 backoff and 5xx retries are configured;
[ ] Usage logs include request ID, model, and latency;
[ ] The fallback route and key-revocation process have been rehearsed.

11. FAQ

Is an API key the same thing as a ChatGPT subscription?

No. The subscription and the API are billed separately, and API keys are created and managed only on the API platform. When filing team expenses, keep the two payments distinct.

Why can't I see the full key after creating it?

The full secret is usually displayed only once at creation; the platform retains only part of the characters for identification. If lost, create a new key and disable the old one.

Where exactly should the Base URL point?

Up to the domain plus /v1 — do not include /chat/completions or /responses. The path is appended by the SDK or the request itself; adding an extra segment causes a 404.

Can one key serve multiple projects?

Technically yes; from a management standpoint, no. Split keys by project or environment so you can control permissions, attribute usage, and limit the impact of a leak.

Do domestic teams have to use a gateway?

Not necessarily. It depends on payment channels, network quality, compliance requirements, and whether multiple models are needed. Teams that use only OpenAI and already have stable payment and network conditions can connect directly; teams that need RMB settlement and a unified entry point can assess migration using the OpenAI-compatible API guide.

Next steps

Get the minimal request working first, then connect your business. For RMB top-ups and a unified multi-model entry point, start by registering for the ZSQH AI Gateway; models and prices are subject to model pricing.