# API Key workaround: just make it a parameter

**URL:** <https://community.openai.com/t/api-key-workaround-just-make-it-a-parameter/580351>\
**Category:** GPT builders\
**Created:** [January 10, 2024, 4:58am UTC](https://community.openai.com/t/api-key-workaround-just-make-it-a-parameter/580351 "2024-01-10T04:58:44Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![james.kittock](https://sea2.discourse-cdn.com/openai1/user_avatar/community.openai.com/james.kittock/32/284104_2.png) [@james.kittock](https://community.openai.com/u/james.kittock)\
**Post date:** [January 10, 2024, 4:58am UTC](https://community.openai.com/t/api-key-workaround-just-make-it-a-parameter/580351/1 "2024-01-10T04:58:45Z")

</div>

In case this helps anyone else:

I was creating an Action to call the YouTube Data API, which expects an API key as a query parameter named “key”. No matter what I tried in the Authentication dialog and/or components securitySchemes in the OpenAPI spec, it never worked.

Finally, I gave up trying to “do it right” and just went ahead and added the key as a parameter, like this:

```auto
      parameters:
        - name: key
          in: query
          description: API key
          required: true
          schema: 
            type: string
            enum: [YOUR_API_KEY]

```

Now, I don’t think I should have to do a workaround like this, but it works while the implementation of the Action is seemingly buggy, so I’ll live with it. Would be nice to get it fixed though.

---

<div class="post-metadata">

**Author:** ![rayed\_studded](https://sea2.discourse-cdn.com/openai1/user_avatar/community.openai.com/rayed_studded/32/448621_2.png) [@rayed\_studded](https://community.openai.com/u/rayed_studded)\
**Post date:** [May 20, 2024, 9:59pm UTC](https://community.openai.com/t/api-key-workaround-just-make-it-a-parameter/580351/2 "2024-05-20T21:59:42Z")

</div>

This seems to expose the key to the user during the permissions request, have you been able to work around that?