Step 3: Set Up Payment + Configure Budget Limits

Settings -> Billing -> Payment methods -> add a credit card. That part is trivial.

Right afterwards -- and this is the step that protects you from unpleasant surprises -- you configure Usage Limits. You will find them under Settings -> Billing -> Limits.

There are two limits:

The Soft Limit triggers an email warning when monthly usage exceeds the threshold. Set this to a number that still lets you sleep at night -- typically 50 to 100 euros for pilot projects.

The Hard Limit blocks API calls as soon as the threshold is reached. This is the real safety net. Set it to a value you could still survive if your code accidentally ran in a loop. For pilot projects, 200 to 500 euros per month is a sensible range.

A practical tip from our own experience: we once had a script that accidentally sent the same request to GPT-4 ten thousand times in a loop. Without a Hard Limit, the damage would have been several hundred euros. With the Hard Limit, the bleeding stopped at 50 euros and the rest were rejected. The Hard Limit is not optional.

Step 4: The Two Privacy Settings Everyone Forgets

Here come the two clicks that make the difference in a data protection review. Settings -> Organization -> Data Controls.

Setting A: "Allow our partners to use your data"

The default is off. Leave it off. If it happens to be on -- uncheck it.

Setting B: "Improve the model for everyone"

For the API, the default has been off since March 2023. Even so: check it once. For some accounts that were migrated from older ChatGPT sign-ins, it can be different. Uncheck it.

Together, these two settings form the "OpenAI does not reuse our data" guarantee. In a data protection audit, the auditor will ask about them specifically. Take a screenshot of both settings and file it in your data protection documentation.

Step 5: Generate the API Key (with Hygiene)

Settings -> API keys -> Create new secret key.

Three rules for API keys:

One key per application. Not "one key for everything." If you have a pre-qualification agent and a newsletter generator, that is two keys. If one is compromised, you only have to revoke that one.

Descriptive names. Not "Key 1." Try "fortuna-prequal-prod-2026-04." Six months from now, you will still know what runs where.

Never in the code. API keys belong in an environment variable or a secrets manager. A key accidentally pushed to GitHub will be abused in under 60 seconds -- we have watched this happen live more than once.

Step 6: First Test (3 Minutes)

Before dropping the key into your production system, run a smoke test in the terminal:

curl https://api.openai.com/v1/chat/completions \
  -H "Authorization: Bearer YOUR_KEY_HERE" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "gpt-4o-mini",
    "messages": [
      {"role": "user", "content": "Reply with OK"}
    ]
  }'

If the response contains a JSON structure with "OK," everything is configured correctly. If you get a 401, the key is wrong. If you get a 429, your organization has not been activated yet -- this can take 1 to 2 hours for new accounts.

What to Put in Your Data Protection Documentation

So you do not have to start from scratch in four weeks, here is a mini template for your DPIA entry:

That is your minimal DPIA scaffold. For standard cases, this is enough. Sensitive data requires the full DPIA and, depending on risk, consultation with the supervisory authority.

When OpenAI Direct Is Not Enough

You now have a fully functional setup. Even so, OpenAI direct is not the right path for every use case. Three situations in which you should move to Azure:

If you process health data, attorney-client information, or other data falling under the special categories of Art. 9 GDPR, US-based data processing is critical for you -- even with SCCs. The Azure setup guide shows how to run the same model in Sweden instead of Texas.

If your client explicitly requires "no US providers" -- which is common in government and research contexts -- Azure is not enough either. In that case, the local route with Ollama is the only option.

If your volume grows so high that token costs exceed the hardware investment, the local route also becomes worthwhile. Rule of thumb: economics tip over at around 3 million tokens per day.