OpenAI Platform

The Corma and OpenAI Platform integration brings your OpenAI API organization under Corma's identity governance and AI spend tracking, so IT, security and engineering leads know who can create keys, which projects each person reaches, and what each project costs. OpenAI Platform is the developer side of OpenAI: organizations, projects and API keys used to build models into products, billed on usage at a price per token.

Key takeaways

• OpenAI Platform access combines organization roles (Owner, Reader) with project roles such as Owner, Member or Viewer, so one person can hold different rights in each project.
• OpenAI service accounts are non-human identities owned by a project rather than by an employee, and they carry their own API keys.
• OpenAI advises reviewing whether a member's active API keys are in use before removing them, because removal may disrupt API access.

How is access organized on the OpenAI Platform?

OpenAI uses projects and roles to scope access, limits and usage. At organization level, members are Owners or Readers. Inside each project, they hold a project role such as Owner, Member or Viewer, and OpenAI also supports custom roles. A developer can create a personal API key scoped to a project, and a project can hold service accounts, which are non-human identities with their own keys.

The model is clean on paper and harder to keep clean after a year: test projects nobody closed, a contractor still Owner of a project, a personal key quietly used by a production service. OpenAI's own guidance is to review whether active API keys are in use before removing a member, which is why offboarding on this platform cannot be a blind deletion.

How Corma governs the OpenAI Platform

• Members and roles in one view: organization and project roles for every member, next to your other SaaS and AI tools.
• Non-human identities in scope: Corma's NHI discovery, on the PRO and Enterprise plans, covers service accounts and API tokens, so they enter the same reviews as human accounts. Learn more about non-human identity security.
• Offboarding with a human check: the IT workflow builder can hold an approval step, so a project owner moves production keys to a service account before the member is removed.
• AI spend by user and model: AI spend management tracks spend by time, user and model, with budgeting and forecasting.

Frequently asked questions

Is this the same page as the OpenAI or ChatGPT integration?

No. This page covers the API platform: organizations, projects, service accounts and keys. User access to OpenAI in general is covered on the OpenAI access management page, and ChatGPT seats on the ChatGPT licence management page.

Can OpenAI cap spend on its own?

Yes. OpenAI lets you set a hard spend limit for the organization or for an individual project, and requests beyond the limit are rejected, although enforcement is not instantaneous and recorded spend can slightly exceed it. Corma adds the view across all your AI tools, with spend broken down by user and model.

Where is Corma data hosted?

In France, on AWS infrastructure, with encryption in transit and at rest. Corma is ISO/IEC 27001:2022 certified and only requests the permissions it needs to manage access.

Want to see who holds the keys to your AI stack? Book a Corma demo.