Security · 2026-09-30 · 1:45

Your plan is now a key

Name: Your plan is now a key
Uploaded: 2026-09-30
Duration: 1 min 45 s
Description: Treat a shared plan token like any other long-lived credential: know which machines hold one, keep it out of repositories and images, and assume that today you can turn off the app but not one copy of the session. Convenience arrived before revocation did.

OpenAI's developer docs describe Sign in with ChatGPT: "Let users sign in with ChatGPT and use their ChatGPT plan for eligible AI requests in your app." Your subscription stops being something you use and becomes something you lend.

In favour

Real convenience, and scoped: plan usage is "an optional capability" and "does not grant access to their ChatGPT conversations or other account context". Users manage usage in ChatGPT settings.
It is not a free-for-all. Website sign-in is "currently available to selected commercial partners through a limited trial"; plan usage is documented for open-source and locally hosted apps, with an interest form for the rest.

Worth watching

The credential lives long. "Access tokens are valid for one hour"; refresh tokens last 30 days and "each successful refresh returns a replacement refresh token with a fresh 30-day lifetime", with "no fixed limit" on successive replacements while each stays valid. In practice that is an open-ended session for whoever holds the file.
For self-hosted machines the docs say credentials are copied to the VM over a channel such as SSH, and that "host-specific usage attribution and revocation of ChatGPT plan access for transferred sessions are not yet available". A host ID "is not an authentication credential", and for key-derived IDs "OpenAI does not verify possession of the private key".

Our takeTreat a shared plan token like any other long-lived credential: know which machines hold one, keep it out of repositories and images, and assume that today you can turn off the app but not one copy of the session. Convenience arrived before revocation did.

Source: Τεκμηρίωση προγραμματιστών OpenAI, «Sign in with ChatGPT»

← All Focus posts

AI-narrated · AI-generated content

Transcript

What happens when the plan you pay for becomes something another program can hold and spend? It sounds like a login button. An AI assistant maker lets people use their plan for eligible requests inside an app. It is an optional permission, separate from signing in. The good parts are real. It grants no access to your conversations or other account context. You manage usage and app-specific limits in your settings. It is also narrower than the hype. Website sign-in is currently a limited trial with selected commercial partners, and plan usage is documented for open-source and locally hosted apps. The plan turns into a key at the token. An access token lasts an hour. The refresh token lasts thirty days, and each refresh returns a replacement with a fresh thirty days. Each refresh brings a fresh 30 days, and successive replacements have no fixed limit while each token remains valid. For servers, the docs say to sign in on your laptop and copy the credentials across over a secure channel. Host-specific usage attribution and revocation are not yet available for transferred sessions. None of this is a flaw. It is the ordinary shape of a long-lived credential. So treat it like an API key. Set a per-app limit first, know where every copy lives, and check usage like a bank statement.