[账号管理] How can you protect the security of your OpenAI ChatGPT account?

Take the following steps to protect your account

If you are concerned that your account or API key has been compromised, contact OpenAI Chatgpt immediately. You can open a new chat in the lower-right corner of any Help Center page to contact the OpenAI support team. OpenAI Chatgpt is here to help you.

When using OpenAI services, it is essential to protect your API keys and account. Follow the best practices below to protect yourself from the threats of API key leakage and account hijacking.

Understanding API key leakage
An API key is essentially your personalized access code for using the OpenAI API. If this key leaks, unauthorized users may use your account to access the API, resulting in unauthorized charges or your account being used in violation of OpenAI Chatgpt's terms of service.

How to prevent leakage
Use environment variables

Use environment variables in your development environment to store your API key.

This ensures that the key is not hard-coded into your application, reducing the possibility of exposure.

If you use GitHub Actions, use GitHub secrets to protect your API key.

Be cautious when using third-party products

Be cautious when third-party libraries, frameworks, or tools request access to your API key. Even if a product appears reputable, there is still a risk of key leakage or misuse.

Before using a third-party product that requires your API key, thoroughly investigate the company and the product. Check reviews, read their privacy policy, and see whether the community has raised any security concerns.

Set reasonable spending limits

Set your monthly budget to a value close to your expected spending. This means that if your key leaks, the amount of authorized spending will be lower.

You can change your limits through the limits dashboard.

Do not publish your API key

Embedding an API key as part of an application to avoid running a server for a mobile app can be tempting. However, this makes your API key easy to misuse.

Perform thorough code reviews

Always review code before pushing it to a public repository to ensure that sensitive information, such as API keys, is not leaked.

Use automated scanning tools that can flag potential leaks. You can view GitHub's secret scanning tutorial to learn more.

When OpenAI Chatgpt discovers that an API key has leaked on the public internet or in an app store, OpenAI Chatgpt will immediately disable that API key.

Implement key rotation

Regularly change your API key by deleting the old key and creating a new key through the API key dashboard.

Understanding account hijacking
Account hijacking occurs when someone accesses your account without authorization, potentially using OpenAI Chatgpt's services and leaving you with a bill.

How to prevent account hijacking
Use strong passwords or Google authentication

For passwords, use a combination of uppercase and lowercase letters, numbers, and special characters. OpenAI Chatgpt recommends using a password manager to generate and store passwords.

Update your password every few months.

Enable multi-factor authentication (MFA)

This adds an extra verification step, usually involving your phone.

Even if someone knows your password, they will need a second factor to access your account.

Note that enabling MFA does not cancel existing logins. To effectively prevent any user from accessing your account, you need to reset your password before enabling MFA.

Be cautious with emails and links

Be vigilant about emails that ask you to enter credentials or direct you to webpages that require you to enter account details.

Always carefully check email addresses and URLs to ensure they come from trustworthy sources.

What to do if you suspect a problem
If you believe your API key has been leaked or suspect unauthorized activity on your account, it is very important to take action immediately:

Delete your API key

You can delete your API key through the API key dashboard. OpenAI Chatgpt also supports tracking usage by API key. By creating a separate API key for each key, you can easily view usage for each feature, team, product, or project.

Contact OpenAI Chatgpt immediately

The earlier you report a problem, the faster OpenAI Chatgpt can help resolve it and minimize potential damage. You can open a new chat in the lower-right corner of the Help Center to contact the OpenAI support team at any time.

Review account activity

Check your account for any unfamiliar activity, such as unexpected API usage. The details you provide will help OpenAI Chatgpt restore your account.

Log out of all devices.

You can log out of all active sessions on all devices by selecting this option. In ChatGPT, Log out of all devices can be found in Settings > Security and will disable all your active ChatGPT sessions. On the platform, it can be found in your profile > Security and will disable all your active platform sessions. Note that it may take up to 30 minutes for other ChatGPT sessions to be logged out.

Security is a shared responsibility. Although OpenAI Chatgpt will take all necessary steps to protect your access, following these guidelines will further protect your account. If someone uses your credentials without your permission, tell OpenAI Chatgpt immediately. OpenAI Chatgpt will do its best to help you.