{"record":{"id":"c5d1db32f86cd061","repo":"openai/openai-python","slug":"missing-credentials-please-pass-an-api-key-wo","errorCode":null,"errorMessage":"Missing credentials. Please pass an `api_key`, `workload_identity`, `admin_api_key`, or set the `OPENAI_API_KEY` or `OPENAI_ADMIN_KEY` environment variable.","messagePattern":"Missing credentials\\. Please pass an `api_key`, `workload_identity`, `admin_api_key`, or set the `OPENAI_API_KEY` or `OPENAI_ADMIN_KEY` environment variable\\.","errorType":"exception","errorClass":"OpenAIError","httpStatus":null,"severity":"critical","filePath":"src/openai/_client.py","lineNumber":269,"sourceCode":"                self._api_key_provider: Callable[[], str] | None = api_key  # type: ignore[no-redef]\n            else:\n                self.api_key = api_key or \"\"\n                self._api_key_provider = None\n            self._workload_identity_auth = None\n\n        if admin_api_key is None and provider_runtime is None:\n            admin_api_key = os.environ.get(\"OPENAI_ADMIN_KEY\")\n        self.admin_api_key = admin_api_key if provider_runtime is None else None\n\n        if (\n            provider_runtime is None\n            and _enforce_credentials\n            and not self.api_key\n            and self._api_key_provider is None\n            and workload_identity is None\n            and self.admin_api_key is None\n        ):\n            raise OpenAIError(\n                \"Missing credentials. Please pass an `api_key`, `workload_identity`, `admin_api_key`, or set the `OPENAI_API_KEY` or `OPENAI_ADMIN_KEY` environment variable.\"\n            )\n\n        if organization is None and provider_runtime is None:\n            organization = os.environ.get(\"OPENAI_ORG_ID\")\n        self.organization = organization\n\n        if project is None and provider_runtime is None:\n            project = os.environ.get(\"OPENAI_PROJECT_ID\")\n        self.project = project\n\n        if webhook_secret is None:\n            webhook_secret = os.environ.get(\"OPENAI_WEBHOOK_SECRET\")\n        self.webhook_secret = webhook_secret\n\n        self.websocket_base_url = websocket_base_url\n\n        if is_x509_workload_identity(workload_identity):","sourceCodeStart":251,"sourceCodeEnd":287,"githubUrl":"https://github.com/openai/openai-python/blob/9917c6e28e66e90e1227b3d223c06a8c5441515a/src/openai/_client.py#L251-L287","documentation":"Client construction requires some credential: `api_key`, `workload_identity`, `admin_api_key`, an `OPENAI_API_KEY`/`OPENAI_ADMIN_KEY` env var, an api-key provider, or explicit header omission. When none is present and `_enforce_credentials` is on, this OpenAIError is raised.","triggerScenarios":"`OpenAI()` with no `OPENAI_API_KEY` in the environment; CI/secrets not loaded; `env_file` pointing to a missing `.env`; serverless deploys where env vars aren't propagated; also when the key is set to an empty string.","commonSituations":"Forgot to export the key in a new shell; `.env` not loaded because python-dotenv wasn't run; container secret mounted to a different var name; tests running without fixtures.","solutions":["Export the key: `export OPENAI_API_KEY=sk-...` (or pass `api_key=...`)","Load a `.env` file before constructing: `from dotenv import load_dotenv; load_dotenv()`","Verify with `python -c \"import os; print(bool(os.environ.get('OPENAI_API_KEY')))\"`","If intentional (custom auth), pass `default_headers={'Authorization': ...}` with explicit omission or an api-key provider"],"exampleFix":"# before\nclient = OpenAI()  # raises\n\n# after\nclient = OpenAI(api_key=os.environ['OPENAI_API_KEY'])","handlingStrategy":"validation","validationCode":"import os\nif not (os.environ.get('OPENAI_API_KEY') or os.environ.get('OPENAI_ADMIN_KEY')):\n    raise SystemExit('OPENAI_API_KEY is not set — check your secrets loading')","typeGuard":null,"tryCatchPattern":"try:\n    client = OpenAI()\nexcept OpenAIError as e:\n    if 'Missing credentials' in str(e):\n        raise SystemExit('Set OPENAI_API_KEY before running') from e\n    raise","preventionTips":["Load .env with python-dotenv at process start","Add a preflight credential check in CI and app startup","Never assume env vars propagate into containers — verify with a health check"],"tags":["auth","api-key","env-var","credentials","constructor"],"backgroundTag":"missing-api-key","analyzedSha":"9917c6e28e66e90e1227b3d223c06a8c5441515a","analyzedAt":"2026-08-28T11:46:34.183Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}