Set Up Instructions

OpenAI

Connect your OpenAI organization to Ploy to automatically discover who has access to the OpenAI Platform — organization members, groups, projects, service accounts, and API keys — and to let Ploy manage that access for you: inviting and removing organization members, and adding or removing people from groups and projects.

What Ploy syncs

  • Organization members: every user in your OpenAI organization, with their name, email, organization role, and when they were added.

  • Groups: your organization's groups and which users belong to each one.

  • Projects: your organization's projects, along with each project's members and their project roles.

  • Service accounts: the non-human identities created inside each project, shown in Ploy as service account identities.

  • API keys: project API keys and organization Admin API keys. Keys owned by a user appear as API key identities linked to their creator; keys owned by a service account are attached to that service account as credentials. Ploy records each key's name and when it was last used, so unused keys are easy to spot.

  • ChatGPT: Ploy also records ChatGPT as an AI agent resource for your OpenAI organization, so AI tooling shows up in your access picture.

Data syncs periodically to keep Ploy up to date.

Before you begin

  • You need an organization on the OpenAI Platform (platform.openai.com).

  • Ploy connects using an Admin API key (it starts with sk-admin-). This is different from a normal project API key — a standard sk-... key will not work. Only Organization Owners can create Admin API keys, so if you don't have that role, ask an owner to create the key for you.

  • The Admin API key lets Ploy read your organization's users, groups, projects, service accounts, and API key metadata. Ploy never sees the secret values of your other API keys — OpenAI only exposes redacted values. The key also covers the writes Ploy can make on your behalf: inviting and removing organization members and changing group and project membership. Ploy has no access to your model usage, conversations, or billing beyond this administration surface.

Create an Admin API key in OpenAI

  1. Log in to the OpenAI Platform.

  2. Open your organization settings and go to the Admin keys page. You can go there directly: platform.openai.com/settings/organization/admin-keys. The Ploy setup wizard also links you straight to this page.

  3. Create a new Admin API key and give it a recognisable name, such as "Ploy".

  4. Copy the key — it starts with sk-admin-. Store it safely; OpenAI only shows it once.

Connect OpenAI to Ploy

  1. In Ploy, go to the Integrations page and select OpenAI.

  2. The first step, Generate an Admin API key in the OpenAI Platform, links you to the Admin Keys Page in the OpenAI console — use it if you haven't created your key yet.

  3. In Enter your Admin API Key here, paste your Admin API key (the field expects a key starting with sk-admin-). This field is required.

  4. Save the integration. Ploy tests the key against the OpenAI Admin API and, once it authenticates successfully, the connection is enabled and the first scan begins.

What Ploy can change in OpenAI

With the integration connected, Ploy can make the following changes when you (or a Ploy workflow) ask it to:

  • Invite a user to your OpenAI organization, with a chosen organization role (reader by default). If the person is already a member or already invited, Ploy treats that as success rather than failing.

  • Remove a user from your organization. If the person hasn't accepted their invitation yet, Ploy cancels the pending invitation instead.

  • Add or remove users from groups.

  • Add or remove users from projects, with a chosen project role (member by default).

Ploy makes no other changes to your OpenAI organization.

Troubleshooting

  • "Failed to authenticate with OpenAI Admin API. Ensure the key starts with sk-admin-." — the key you entered was rejected by OpenAI. Check that you pasted an Admin API key (sk-admin-...) rather than a standard project key (sk-...), that it was copied in full, and that it hasn't been revoked in the OpenAI console.

  • Scans stop working after previously succeeding — the Admin API key may have been deleted or revoked in OpenAI. Create a new Admin API key and re-enter it in the integration settings in Ploy.

  • Some users or projects are missing — data syncs periodically, so very recent changes in OpenAI may take a little while to appear. If something still looks wrong after the next sync, contact Ploy support.

Was this helpful?
Was this helpful?