# Connect OpenAI

Costfluent reads your OpenAI API spend from the organization Costs API, with an Admin key you create
for it. One connection is one OpenAI organization, and the cost of every project in it.

## How Costfluent connects

Costfluent stores the Admin key encrypted and uses it for one call: the organization's daily costs.
OpenAI offers an Admin key no call that names its organization, so Costfluent identifies the
connection by the organization OpenAI's answer names, or, when it names none, by a fingerprint of
the key itself. The key is only ever used for that connection.

:::caution
Choose **Read only** when you create the key, where the OpenAI platform offers it. A key with full
permissions can also manage the organization's members, projects and keys.
:::

## Prerequisites

1. The Owner or Integration owner organization role in Costfluent.
2. An Admin key, which an Organization Owner creates on the OpenAI platform under the
   organization's **Admin keys**. It starts with `sk-admin-`. A project key (`sk-proj-`) cannot
   read cost.

## Connect

<Stepper>

1. Open **Settings**, then **Integrations**, select **OpenAI**, and open the **Connect** tab.
2. Select "Add Admin key" and paste the key into **Admin key**.
3. Select "Test connection" to see each check, or "Connect" to save.

</Stepper>

Costfluent reads one day of costs before storing anything, so a connection that saves can read your
cost. A connection with the same identity as an existing one is refused.

:::caution
Connect each organization once, with one key. When OpenAI does not name the organization, two keys
of one organization are two identities, and its spend would be counted twice.
:::

## Data and freshness

Connecting imports as far back as your plan's cost history allows, and at most six months
([Manage connections](/connect/manage-connections#how-it-behaves)), as long as OpenAI reports cost
that far back. Cost arrives by UTC day, in US dollars, as OpenAI reports it.

## Reporting dimensions

- **Account** is the project. Spend outside any project appears under the connection's identity.
- **Service** is `OpenAI`.
- **SKU** is OpenAI's line item, such as `gpt-4.1-mini-2025-04-14, input`, kept whole: OpenAI does
  not document its format, so Costfluent does not split it into model and operation.
- The billing account is the connection's identity, and the billing period is the calendar month.

## Update or disconnect

### After connecting

The **Manage** tab lists the connection by its **Organization ID**: the organization OpenAI named,
or `key:` and the key's fingerprint. Open the gear icon beside it to see whether the costs are still
readable, which workspaces the connection feeds, and which months have been imported. **Run
checks** runs the checks again on request.

### Rotating or removing access

When the connection is identified by the organization, select **Update credentials** on the
connection page and paste a new Admin key of the same organization; then revoke the old key. When
it is identified by the key's fingerprint, a new key is a new identity and is refused: remove the
connection and connect the new key instead.

To retire the connection, remove it in Costfluent and revoke its key on the OpenAI platform.
Removing it erases the cost it imported
([Remove a connection](/connect/manage-connections#remove-a-connection)).

## Troubleshooting

- **OpenAI refused this key.** The key is not an Admin key, or it was revoked. An Organization Owner
  creates Admin keys under the organization's settings.
- **OpenAI has no costs endpoint for this key's organization.** OpenAI answered that the Costs API
  does not exist for the organization. Check that the key belongs to an organization with API usage.
- **This key belongs to another organization.** Shown when updating credentials. Connect that
  organization, or that key, as a new connection.