openai/openai-python · critical · OpenAIError

Missing credentials. Please pass an `api_key`, `workload_ide

Error message

Missing credentials. Please pass an `api_key`, `workload_identity`, `admin_api_key`, or set the `OPENAI_API_KEY` or `OPENAI_ADMIN_KEY` environment variable.

What it means

Client construction requires some credential: `api_key`, `workload_identity`, `admin_api_key`, an `OPENAI_API_KEY`/`OPENAI_ADMIN_KEY` env var, an api-key provider, or explicit header omission. When none is present and `_enforce_credentials` is on, this OpenAIError is raised.

Source

Thrown at src/openai/_client.py:269

                self._api_key_provider: Callable[[], str] | None = api_key  # type: ignore[no-redef]
            else:
                self.api_key = api_key or ""
                self._api_key_provider = None
            self._workload_identity_auth = None

        if admin_api_key is None and provider_runtime is None:
            admin_api_key = os.environ.get("OPENAI_ADMIN_KEY")
        self.admin_api_key = admin_api_key if provider_runtime is None else None

        if (
            provider_runtime is None
            and _enforce_credentials
            and not self.api_key
            and self._api_key_provider is None
            and workload_identity is None
            and self.admin_api_key is None
        ):
            raise OpenAIError(
                "Missing credentials. Please pass an `api_key`, `workload_identity`, `admin_api_key`, or set the `OPENAI_API_KEY` or `OPENAI_ADMIN_KEY` environment variable."
            )

        if organization is None and provider_runtime is None:
            organization = os.environ.get("OPENAI_ORG_ID")
        self.organization = organization

        if project is None and provider_runtime is None:
            project = os.environ.get("OPENAI_PROJECT_ID")
        self.project = project

        if webhook_secret is None:
            webhook_secret = os.environ.get("OPENAI_WEBHOOK_SECRET")
        self.webhook_secret = webhook_secret

        self.websocket_base_url = websocket_base_url

        if is_x509_workload_identity(workload_identity):

View on GitHub (pinned to 9917c6e28e)

Solutions

1. Export the key: `export OPENAI_API_KEY=sk-...` (or pass `api_key=...`)
2. Load a `.env` file before constructing: `from dotenv import load_dotenv; load_dotenv()`
3. Verify with `python -c "import os; print(bool(os.environ.get('OPENAI_API_KEY')))"`
4. If intentional (custom auth), pass `default_headers={'Authorization': ...}` with explicit omission or an api-key provider

Example fix

# before
client = OpenAI()  # raises

# after
client = OpenAI(api_key=os.environ['OPENAI_API_KEY'])

import os
if not (os.environ.get('OPENAI_API_KEY') or os.environ.get('OPENAI_ADMIN_KEY')):
    raise SystemExit('OPENAI_API_KEY is not set — check your secrets loading')

try:
    client = OpenAI()
except OpenAIError as e:
    if 'Missing credentials' in str(e):
        raise SystemExit('Set OPENAI_API_KEY before running') from e
    raise

When it happens

Trigger: `OpenAI()` with no `OPENAI_API_KEY` in the environment; CI/secrets not loaded; `env_file` pointing to a missing `.env`; serverless deploys where env vars aren't propagated; also when the key is set to an empty string.

Common situations: Forgot to export the key in a new shell; `.env` not loaded because python-dotenv wasn't run; container secret mounted to a different var name; tests running without fixtures.

Understand the failure class

Background: "API key is required" / "API key not found" / "No API key was set": the missing-api-key error family across 16 libraries — this error's family across 16 libraries.

Related errors

• The `api_key` and `workload_identity` arguments are mutually
• "Could not resolve authentication method. Expected either ap
• Could not find credentials for Bedrock. Set `AWS_BEARER_TOKE
• Could not find credentials for Bedrock. Pass a bearer creden
• Invalid `http_client` argument; Expected an instance of `htt

AI-assisted analysis of openai/openai-python@9917c6e28e (2026-08-28). Data as JSON: /api/errors/c5d1db32f86cd061. Report an issue: GitHub.