OpenAI project keys can now expire, but the new lifetime cap applies only to keys made from now on

Since 10 September an OpenAI project key can carry an expiry date set when it is created. Administrators can also cap key lifetime for an organisation or project, and OpenAI’s changelog says the cap requires “newly created keys to expire within the configured limit.” Every key minted before the setting existed is untouched by it. The verdict: those old keys are the exposure, and the new setting does nothing about them.