# OpenAI API Key Leaked

**URL:** https://forum.weaviate.io/t/openai-api-key-leaked/10347
**Category:** Support
**Created:** [February 14, 2025, 9:17pm UTC](https://forum.weaviate.io/t/openai-api-key-leaked/10347 "2025-02-14T21:17:36Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![SomebodySysop](https://yyz1.discourse-cdn.com/flex027/user_avatar/forum.weaviate.io/somebodysysop/32/70_2.png) [@SomebodySysop](https://forum.weaviate.io/u/SomebodySysop)
#### Post date: [February 14, 2025, 9:17pm UTC](https://forum.weaviate.io/t/openai-api-key-leaked/10347/1 "2025-02-14T21:17:36Z")

</div>

### Description

### Server Setup Information

- Weaviate Server Version:
- Deployment Method: 
- Multi Node? Number of Running Nodes:
- Client Language and Version:
- Multitenancy?:

### Any additional Information

I just got a note that my OpenAI API key was leaked. As I use OpenAI for embedding as well as text-2vec, where do I go to enter the new key in Weaviate. Thanks!

---

<div class="post-metadata">

### Author: ![DudaNogueira](https://yyz1.discourse-cdn.com/flex027/user_avatar/forum.weaviate.io/dudanogueira/32/7846_2.png) [@DudaNogueira](https://forum.weaviate.io/u/DudaNogueira)
#### Post date: [February 14, 2025, 9:31pm UTC](https://forum.weaviate.io/t/openai-api-key-leaked/10347/2 "2025-02-14T21:31:27Z")

</div>

hi @SomebodySysop !!

There are two places that you can pass your API Keys to Weaviate.

1. At the client instantiation, as `header`:

```python
# Recommended: save sensitive data as environment variables
openai_key = os.getenv("OPENAI_APIKEY")
headers = {
    "X-OpenAI-Api-Key": openai_key,
}

```

or at the server level, providing the environment variable `OPENAI_APIKEY`

Let me know if that helps!

Thanks!

---

<div class="post-metadata">

### Author: ![SomebodySysop](https://yyz1.discourse-cdn.com/flex027/user_avatar/forum.weaviate.io/somebodysysop/32/70_2.png) [@SomebodySysop](https://forum.weaviate.io/u/SomebodySysop)
#### Post date: [February 14, 2025, 9:46pm UTC](https://forum.weaviate.io/t/openai-api-key-leaked/10347/3 "2025-02-14T21:46:15Z")

</div>

So the openai key is not stored anywhere in weaviate, but always sent dynamically with every query/embed request?

---

<div class="post-metadata">

### Author: ![DudaNogueira](https://yyz1.discourse-cdn.com/flex027/user_avatar/forum.weaviate.io/dudanogueira/32/7846_2.png) [@DudaNogueira](https://forum.weaviate.io/u/DudaNogueira)
#### Post date: [February 16, 2025, 11:08am UTC](https://forum.weaviate.io/t/openai-api-key-leaked/10347/4 "2025-02-16T11:08:06Z")

</div>

That’s correct. It is not stored in Weaviate itself.