Managing projects and api keys does not seem to work

[fennec.cooper]

Apologies if this belongs in another topic, but there doesn’t seem to be a section for Organisation management.

We are looking to migrate from using models with Azure to using OpenAI’s APIs directly but I am finding it difficult to pronounce OpenAI’s offering as production ready given the troubles we’re having managing projects and API keys on the platform dashboard.

I have a few gripes:

• ChatGPT and platform access require completely separate accounts to be made…we’ve done this, but why?
• As an org owner I can see the projects tab but members of projects/non-owners cannot…how are they meant to select a specific project at all given they also have the “Project” header in the sidebar as well
• When a project is selected it shows the id of the project in the URL but nothing else in UX shows which project is currently selected…
• Creating/deleting keys, projects, service accounts etc often results in an error until trying again, or even requiring navigating away and back to get it to work

But my primary issues are:

• If non-owners of the organisation create API keys, I can see them
• If I, as an owner, create an API key in a project regardless of whether I create it or do it via a service account non-owner members cannot see these entries
• As mentioned above, non-owner accounts have a “Project” section for the “currently selected project” but do not have “Projects” in their sidebar to even select a project - but they can manually visit organization/projects to do so
• Even if they manually select a project as above, they cannot see API keys created by an owner, even when done as a service account

Am I missing something here? How is an organisation meant to manage several projects? My backup solution is just to create the individual projects/service account api keys myself and hand them over to my devs but it would be nice for them to be able to see/manage all of that themselves.

I see there are top level roles for the org as well as per project roles…perhaps with some permission finagling I could get it so they could see the API keys of the project that they are members on, but do I really have to manually create a new role for every single project we build?

Thank you very much in advance for any help/info that anybody has on this; is anybody else managing a few large projects in an OAI Organisation account?

[vb]

Hi, and welcome to the community.

I have tried to address your questions above. If anything is unclear or you need more detail, feel free to ask.

1. Regarding the accounts:

ChatGPT and the OpenAI Platform can be used with a single account. I have been using both with the same account for years. It may be worth double-checking whether there was a typo in the email address during signup.

I also recently created a Platform account for a friend using their existing ChatGPT account. I am not aware of any separation beyond the different terms of service that apply to the respective use cases.

2. Regarding the visibility of projects:

Non-owner members can see all projects they are part of. For day-to-day use, switching between projects and organizations is done via the drop-down menus in the top navigation, indicated by the small arrow icons.

In the screenshot, “Developer Community Forum Org” is the organization name and “OAI-Devs” is the currently selected project. Both the organization and the project can be changed there. If a team member cannot see the projects they belong to, it is worth verifying that they are looking at the correct organization. Every Platform account is created with a personal organization and a default project. For actual work, I typically create separate organizations along with their associated projects.

Using the up and down arrows next to the organization and project selectors is not only convenient but also the primary way to change the current selection.

Looking into the API key visibility issues: this appears to be a bug. A project member should be able to view and manage all API keys within a project. I will escalate this to the team.

3. Regarding roles and permissions

While this can become complex fairly quickly, I suspect this would not be an issue if project members could see API keys created by owners. In general, organization-level roles are used to scope permissions and support auditing, while project members operate within the constraints defined at the organization level.

---

I will raise the API key visibility issue now, and thank you for calling it out here.

In the meantime, project members can create their own API keys, which are visible to organization owners. As a temporary workaround, this can also serve as a viable API key management approach, with project members creating keys and owners deciding how much centralized oversight is required.

[fennec.cooper]

Thank you so much for the warm welcome and for your assistance, it really is much appreciated!

1. This is interesting - it could be because I didn’t set up the original account(s) but was invited to them and then have subsequently invited members of my teams. I’ve just checked and the organisation ID differs between ChatGPT and OAI Platform. Should I expect that I can use the same organisation across both sides of the fence?

2. Aha, I think the issue here may be that I can’t see the same as you show in your screenshot; first of all when logging in (by selecting Login→API platform from openai.com) I am taken to https://platform.openai.com/docs/overview. Now, to get to settings there does not seem to be any UX that takes me there: {removed screenshot}.

   I’ve searched through in the inspector and couldn’t find any reference to “/settings”, in case I was missing something. So I’ve taken to going to https://platform.openai.com/settings/ manually, which redirects me to https://platform.openai.com/settings/organization/general.

   On that page, I do not see a project selection dropdown as you see, only one for the organisation:

   

   And none of my team members can see the project dropdown either. Am I in completely the wrong place for this? There doesn’t seem to be any natural flow from logging in to organisation settings that I could see at all, so perhaps it’s because I’m getting to settings manually.

3. Yes exactly, I’m more concerned that the owners role involves managing org/project members and billing - then it would be convenient for project members to be able to view projects/API keys that they are a part of.

Thank you for raising that as an issue, however I would prefer not to use the approach whereby team members create their own keys as they do not have the option to create keys as service accounts (whereas I have the UI to do that as an org owner). I like the idea of creating them as service accounts so that if individual team members are removed, it protects potentially production keys from being destroyed.

What I will do for now is create and manage the projects/service account api keys myself and just provide my developers with the keys (to immediately go into secrets storage).

(Apologies, but I’ve also had to remove additional screenshots and delinkify stuff as the forum won’t allow me to post it otherwise).

Have an amazing day!