Authentication

Include a Open AI Image API key in the HTTP Bearer header of every /v1 request.

Authorization: Bearer sk_sd_example

Create a key

Open Settings → API keys, give the key a recognizable name, and create it. You can view the full secret only once. After that, Open AI Image keeps only a secure hash and cannot recover the secret.

Keep keys on the server

Store the value as OPENAIIMAGE_API_KEY and inject it only into the server process that calls the API. Do not print it in application logs or error trackers.

Revoke and rotate

If a key may have leaked, revoke it immediately. Requests that use a revoked key return 401. To keep requests running during rotation, create the replacement before you revoke the old key.

Rate limits

Allow at least 1.5 seconds between task creation requests and 100 milliseconds between API requests from the same IP. If you exceed the limit, the API returns 429. Retry with exponential backoff and jitter. Start task polling with a 5 to 10 second interval.