OpenAI API for Education

The OpenAI API is available to the Columbia University community with education security and privacy. Users will have access to the latest OpenAI models in an environment capable of handling high-volume applications and large-scale data processing.

AI Coding with Codex

OpenAI Codex is an AI-powered software engineering agent designed to translate natural language into code, capable of reading, writing, and executing code across languages like Python, JavaScript, and Go. It serves as an intelligent coding partner to accelerate development, debug, and assist in managing software projects via a desktop or web interface.  

To learn more about Codex, click here.

Learn More

To deepen your understanding of the OpenAI API and enhance your skills through comprehensive training designed for all levels—from beginner to advanced—explore the OpenAI Academy. OpenAI Academy offers expertly curated modules, hands-on activities, and exclusive resources and events directly from OpenAI, empowering you to leverage the OpenAI API effectively and confidently.

Data Privacy

OpenAI API for Education is NOT approved for use with Sensitive Data as defined in the  Columbia University Data Classification Policy. For users at CUIMC, please refer to the AI and Generative Technology Use at CUIMC page for additional information regarding AI tools approved for use with Sensitive Data.

Updates

View the latest Model and Feature Updates here.

  • Data protection with enhanced security measures, ensuring privacy through robust encryption within a secure, walled garden environment.
  • Highest standards of compliance, the platform is GDPR-ready and HIPAA-compliant (BAA in place) to safeguard sensitive information at all times.
  • OpenAI does not use or train on conversations or any uploaded data.
  • OpenAI API meets SOC 2 standards, and all dialogues are safeguarded with encryption both during transmission (using TLS 1.2 or higher) and when stored (using AES 256).
  • Build AI features into your own apps and workflows using the OpenAI API.
    You control the interface and user experience.
  • Generate and edit images with OpenAI image models.
    Use it for graphics, diagrams, and visual assets.
  • Process and analyze your own content for real work.
    Example: summarize documents, extract key points, classify text for reports.
  • Work with multiple files and formats, based on your app design.
    Example: review PDFs, text files, and spreadsheets.
  • Create repeatable prompt-based workflows with the Responses API.
    Example: draft, review, and refine text in a consistent format.

Pricing:

We use the same pricing guide as OpenAI in regards to tokens. For more information about OpenAI's pricing for the API, check out their site here.

  • For more details about pricing per model, you can view that information here.
     

When requesting an OpenAI API key, you can set your budget amount, anywhere from $5 to $5,000. A departmental chart string is required when requesting an API key. If you are unsure where to find your chart string, reach out to your department or Finance team.

OpenAI API Token Best Practices:

  • Set a hard output cap every time. Use max_output_tokens. Don’t rely on defaults.
  • Preflight big prompts. Count input tokens first. If it’s too large, chunk or summarize before you call the model.
  • Log usage per request. Read the usage fields and alert when a request crosses your threshold.
  • Use the Tokenizer when writing prompts. Quick way to sanity-check size before you ship. Tokenizer

Python Example
from openai import OpenAI
client = OpenAI()

r = client.responses.create(
  model="gpt-5-mini",
  input="Summarize this in 5 bullets: ...",
  max_output_tokens=200,
)

print(r.usage)  # input_tokens / output_tokens / total_tokens

Office Hours

Office hours will be taking a break for the summer. Office hours will resume in September of 2026.

 

AI Consultation

We provide consultations to understand your needs and ensure our AI services align with your requirements. To discuss how our AI services can support your specific use cases and workflows, please request a consultation at [email protected].

Please do not use this email for general questions pertaining to our AI Services. For those questions, please email us at [email protected].

Guidelines for Using OpenAI’s API at Columbia University

OpenAI’s API platform supports generative AI features inside Columbia tools and workflows.
You can use it to build apps, automate tasks, and run AI services at scale.

These guidelines cover best practices and key responsibilities.
Also follow Columbia’s Generative AI Guidelines and all university privacy, security, and intellectual property policies.

  1. Be Careful Who You Share API Keys With

    Sharing API keys should be treated with caution, and that caution should also be communicated to those you share keys with. Risks of unauthorized use include budget theft, data insecurity, and lack of accountability.

     

  2. Use the API responsibly.
  • Validate outputs before you act on them. Example: Don’t auto-send emails, publish web content, or change records based only on model output.
  • Keep a human in the loop for high-impact work. Example: grading, HR decisions, disciplinary actions, clinical workflows, and official communications.
  • Design for reliability
    • Log prompts, responses, and errors in a secure way
    • Add guardrails like input validation, allowlists, and rate limits
    • Use test cases that reflect real scenarios in your unit
  • Respect intellectual property
    • Don’t paste copyrighted or licensed content unless you have rights to do so
    • Don’t assume model output is free of IP risk
       
  1. Data and Privacy
Handling Sensitive Data

Columbia’s OpenAI API access is covered under the same Education program controls as ChatGPT Education.

If your work involves PII, PHI, or research-sensitive data:

  • Follow the minimum necessary principle. Only send what the task needs.
  • De-identify whenever you can. Remove direct identifiers like names, MRNs, addresses, phone numbers, SSNs.
  • Follow Columbia’s Data Classification Policy. Match your use to the right data class and required controls.
  • Keep data flows explicit
    • Know what data your app sends to the API
    • Know what you store after the response returns
    • Set retention rules for logs and transcripts
CUIMC Users

Before using the API for PHI or other sensitive clinical data:

Account and Email Notes

  • Use your [email protected] email address for account and service updates tied to the Education program
  • If you do not receive emails to a [email protected] email, you can request Dual Affiliation here
     
Security Controls You Must Apply in Your App

The API is only part of the system. Your application also needs controls.

  • Secrets management
    • Store API keys in a secrets manager or environment variables
    • Never hard code keys in code, scripts, or shared docs
    • Never commit keys to GitHub or shared repositories
  • Access controls
    • Restrict who can use your internal tool
    • Use least-privilege permissions for systems that call the API
  • Logging hygiene
    • Don’t log sensitive data by default
    • If logging is required, redact identifiers and secure the logs
  • Data retention
    • Set clear retention windows for stored prompts, outputs, and telemetry
    • Delete data you no longer need
       
  1. Academic Integrity and Attribution

The API can generate text, code, images, summaries, and analyses. That creates the same integrity risks as chat tools.

  • Don’t use the API to bypass academic integrity rules
  • Don’t present AI-generated work as fully original when it is not
  • Disclose AI assistance when required by course, journal, or unit policy
    Example: “Drafted with AI assistance and reviewed by the author.”

If you build tools for students or faculty:

  • Make attribution easy
    Example: include an exportable “AI assistance” note or citation snippet.
     
  1. Ethical Use and Limitations

You are responsible for outcomes.

  • Expect errors and bias. Test for failure modes relevant to your use case.
  • Avoid automated decisions about people. Example: admissions screening, hiring rankings, performance reviews, patient triage. If you must support these areas, keep the API role advisory and require human review.
  • Use trusted sources for facts. Example: when summarizing policy, link back to the official policy text.
     
Questions to ask before you ship
  • What’s the worst realistic harm if the model is wrong?
  • What data leaves Columbia systems, and what stays?
  • Who can access logs, outputs, and stored prompts?
  • How will a user report issues or appeal a result?

FAQs

Click on the button at the top of this page that says "Request for OpenAI API Key." You will be redirected to fill out a Service Now form. 

Disclaimer: OpenAI API requests are subject to a 24-48 hour response time. Even if your request is approved, expect your API key to be sent within that 24-48 hour window

We monitor API budgets through the project name given in the request form. When you're requesting a new API key, select New project and provide a name for that project. If you need to add more funds to an existing project, then select Existing in the request form and provide the same project name.

Disclaimer: Request forms that choose Existing project and provide a new project name will be rejected. 

If you get a 401 error in your code, it is likely you have reached your budget limits. When this happens, we revoke your API key. Put in a new API request to add funds to this project. Remember to select Existing for the project and add the existing project name in the request form.

Under our contract with OpenAI, we have a signed BAA and we have HIPAA compliance. It is safe to enter PII and PHI information when using the API.

Start with a smaller, cheaper model for drafts and routine tasks. Move up only when you need better reasoning or higher accuracy.

Run a quick A/B test:

  • same prompt
  • same max output cap
  • compare quality and total tokens used

Store it in:

  • environment variables
  • a secrets manager

Don't put keys in:

  • source code
  • shared docs

Yes, we offer Codex through the API. You just need to request an API to use Codex. To learn more about Codex, click here.