# OpenAI Key - Strangers using my key!

**URL:** <https://community.openai.com/t/openai-key-strangers-using-my-key/1412813>\
**Category:** API\
**Created:** [November 4, 2026, 2:52pm UTC](https://community.openai.com/t/openai-key-strangers-using-my-key/1412813 "2026-11-04T14:52:33Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![anon30914191](https://avatars.discourse-cdn.com/v4/letter/a/e274bd/32.png) [@anon30914191](https://community.openai.com/u/anon30914191)\
**Post date:** [November 4, 2026, 2:52pm UTC](https://community.openai.com/t/openai-key-strangers-using-my-key/1412813/1 "2026-11-04T14:52:33Z")

</div>

![image](https://us1.discourse-cdn.com/openai1/original/4X/f/3/d/f3d64cdf85925d24d405c16ebccd0b16de4eccbe.png)

 ![image](https://us1.discourse-cdn.com/openai1/original/4X/5/0/6/5063b6e93f1bd04b67c78d2e06089bf4c553aff0.png)

My OpenAI API key has been stolen. I woke up today to find my credits used up and a series of strange requests. I never published the key anywhere other than in my project’s `.env` file.  
I would very much like to be reimbursed, given that I did not make these requests myself. I find it unacceptable that the company lacks security mechanisms to prevent this from happening.

---

<div class="post-metadata">

**Author:** ![merefield](https://sea2.discourse-cdn.com/openai1/user_avatar/community.openai.com/merefield/32/14812_2.png) [@merefield](https://community.openai.com/u/merefield)\
**Post date:** [November 4, 2026, 2:57pm UTC](https://community.openai.com/t/openai-key-strangers-using-my-key/1412813/2 "2026-11-04T14:57:29Z")

</div>

Welcome to the forum, and sorry to see if you have fallen victim to a key leak. However, that’s very unlikely to have happened within the OpenAI platform. You are responsible for the security of your key outside of the OpenAI platform.

Check your logs and also check for natural expiry of credits.

We cannot resolve your issue here as it is too sensitive, but please reach out to [support@openai.com](mailto:support@openai.com) and open a case.

And of course cycle your keys immediately.

---

<div class="post-metadata">

**Author:** ![OpenAI\_Support](https://sea2.discourse-cdn.com/openai1/user_avatar/community.openai.com/openai_support/32/561845_2.png) [@OpenAI\_Support](https://community.openai.com/u/OpenAI_Support)\
**Post date:** [November 6, 2026, 4:07pm UTC](https://community.openai.com/t/openai-key-strangers-using-my-key/1412813/3 "2026-11-06T16:07:22Z")

</div>

Hey [**anon30914191**](https://community.openai.com/u/anon30914191), that's definitely frustrating.

Along with [**merefield**](https://community.openai.com/u/merefield)'s suggestion to contact Support, I'd also recommend following OpenAI's best practices for securing your API keys going forward.

If you've already contacted Support, could you share your case number? I'll make sure it gets flagged to the appropriate team for review.

Avinash

---

<div class="post-metadata">

**Author:** ![OpenAI\_Support](https://sea2.discourse-cdn.com/openai1/user_avatar/community.openai.com/openai_support/32/561845_2.png) [@OpenAI\_Support](https://community.openai.com/u/OpenAI_Support)\
**Post date:** [November 6, 2026, 4:09pm UTC](https://community.openai.com/t/openai-key-strangers-using-my-key/1412813/4 "2026-11-06T16:09:58Z")

</div>

Here are a few [best practices](https://help.openai.com/en/articles/5112595-best-practices-for-api-key-safety?utm_source=chatgpt.com) worth following.