Skip to main content

​
Overview

nOps uses a workspace Admin key created in the Global Admin Console to bring ChatGPT Enterprise usage and credit spend into Inform. This is the surface where Codex usage lands when developers run Codex on a ChatGPT plan (seats and AI credits) rather than an API key. Credentials are stored securely and are not shown again after you connect.
This integration is for ChatGPT Enterprise workspaces only. If your organization uses OpenAI Platform (programmatic API usage on platform.openai.com), see OpenAI (Platform) instead — the two credential types are not interchangeable. An Admin key cannot be used for model inference, and a Platform Admin API key is rejected by the workspace endpoints.

​
Prerequisites

  • A ChatGPT Enterprise workspace eligible for Admin keys
  • A workspace admin or owner who can create Admin keys
  • nOps organization administrator access
Only admins and owners can connect, re-validate, or disconnect. Members see Admin Only on connectable cards.

​
Create an Admin key

  1. Sign in to the Global Admin Console at admin.openai.com.
  2. Open Credentials → Admin keys.
  3. Select Create new admin key and choose the workspace the key should access.
  4. Grant read access to the features in Admin key permissions below.
  5. Copy the key immediately and store it securely. It starts with sk-admin-.
One Admin key covers one workspace, and Admin keys cannot be used for model inference.

​
Admin key permissions

Grant these in Credentials → Admin keys. OpenAI’s console shows toggle names rather than scope strings; the scope column is here for support conversations and for reading refusal messages.
Grant at least one cost source. Costs and Codex analytics are an either-or: nOps prefers the Costs logs and reads Codex analytics only when Costs is unavailable. With both refused, no ChatGPT spend is ingested at all.

​
Why Costs is preferred over Codex analytics

Codex analytics reports Codex activity only. Measured against a workspace that had the Costs feed, Codex accounted for roughly a third of credit spend — so on the fallback the rest of a workspace’s ChatGPT usage never reaches the cost tables. The AI Optimization ChatGPT Enterprise slice and its model breakdown then show a Codex-only total, which reads as a complete one. Cost allocation, budgets, and forecasting read the same ingested spend, so their ChatGPT totals are incomplete too. Cost logs are the slowest of the ChatGPT feeds: OpenAI publishes them 3–5 hours behind the reporting hour, where the other log types target under 30 minutes. Recent hours filling in gradually is normal, not a broken connection.
Costs history starts when you grant it. OpenAI keeps only 30 days of cost logs and nOps cannot backfill, so every week spent on the Codex fallback is non-Codex spend that can never be recovered.
Two things to check when Costs is refused, because they look identical from the outside — while the permission is missing, OpenAI answers 400 Invalid event_type and the 404 that would reveal a wrong ID never fires:
  • The permission must be organization-level. Workspace-level compliance permissions look similar but return nothing for cost. This is the most common mistake here.
  • The Organization ID must be right. Costs is the only organization-scoped route, so a wrong org-… value fails even with the permission granted.
Group Management is optional and never affects spend. Without it, group names and sizes still load from the usage-limits routes; what is lost is who belongs to each group, so allocation groups have to be built by hand with Add group on the Cost Allocation tab.
Do not share the Admin key or commit it to source control. If it is lost or compromised, create a new key and connect again in nOps.

​
Find your workspace and organization IDs

Both are on chatgpt.com/admin:
  • Workspace ID — a UUID such as 123e4567-e89b-12d3-a456-426614174000. Required.
  • Organization ID — starts with org-. Required. Used for cost log ingestion.
These two are easy to mix up. The Workspace ID field rejects org-… values.

​
Connect in nOps

​
Where to open ChatGPT (Enterprise)

  • To connect for the first time — go to Settings → Integrations and click the ChatGPT (Enterprise) card.
  • To manage an existing connection — go to Settings → Account Status → Connected apps and click the ChatGPT (Enterprise) chip to re-validate or disconnect.

​
Connect steps

  1. Click the ChatGPT (Enterprise) card or chip.
  2. Enter a Key name and paste the Admin key.
  3. Enter the Workspace ID.
  4. Enter the Organization ID.
  5. Click Connect.

​
What nOps checks on connect

nOps makes four read-only calls, one per permission, and records the verdict of each. A missing Organization ID fails before any of them run. Only the seat and Codex checks decide whether the connection is created — either one alone connects, because either alone is useful. Cost logs and directory groups never block it: the organization-level Costs permission is commonly unavailable on a first attempt, and group sync is optional.
Connected does not mean complete. A key that passes both gating checks still connects with no cost logs, and nothing in the success message says so. Whenever a permission is refused, nOps names it — and what it turns off — on the connect modal and at AI Optimization → Seat Tracking, and marks the integration card as needing attention. Read that list before treating an onboarding as finished.
A check that could not complete — a timeout or a rate limit rather than a refusal — is reported as such, so a transient blip never reads as a missing permission. If both gating checks fail this way, the connection is simply retried, not broken. A partial result still connects, because either half is useful on its own. nOps then shows which permissions were refused, and what each one turns off, on the connect modal and on AI Optimization → Seat Tracking. Credentials are stored in AWS Secrets Manager, and only the last four characters of the key are retained for support.

​
Manage your connection

Use Re-validate to re-run all four checks against the stored credentials, or Disconnect to remove them. Action required means the checks stopped passing — usually a revoked key or a permission that was removed. Adding a permission later and re-validating is enough; you do not need to reconnect from scratch.

​
Troubleshooting

  • “Requires ChatGPT Enterprise” — the workspace is on ChatGPT Business, which does not expose these APIs. No permission change will help; this needs an Enterprise plan.
  • “That’s a Codex access token” — a token starting at- cannot read analytics. Create an Admin key instead.
  • “That’s a project key” — a key starting sk-proj- is a project key. Admin keys start sk-admin-.
  • “This credential can’t access the admin APIs” — the key was rejected by access enforcement. Confirm it is an Admin key from the Global Admin Console.
  • Missing scopes — nOps shows the scope name exactly as OpenAI reports it. Edit the key in Credentials → Admin keys and grant that feature, then Re-validate.
  • “Workspace ID not found for this key’s organization” — the Admin key and Workspace ID belong to different organizations. Confirm both on chatgpt.com/admin.
  • ChatGPT spend looks too low, or only Codex models appear — the key is on the Codex fallback because Compliance logging platform → Costs → Read is missing or the Organization ID is wrong. See Why Costs is preferred. Grant it promptly: only 30 days of cost logs exist and there is no backfill.
  • No ChatGPT spend at all — both cost sources are refused. Grant Costs → Read (preferred) or Codex analytics API → Read.
  • Sync from ChatGPT does nothing / groups have no members — the key lacks Group Management → Read. Group names and sizes still load without it; membership does not. Seat tracking and spend are unaffected.
  • No data — allow up to 24 hours after connect for usage data to populate in Inform. Cost logs lag a further 3–5 hours behind the hour they cover, so the most recent hours are expected to be incomplete.
  • Codex usage missing — Codex on ChatGPT credits appears here, while Codex on a Platform API key appears under OpenAI (Platform). If your developers use both, connect both integrations.

​
Security

Follow your organization’s key rotation policy. Update nOps before rotating keys in the Global Admin Console to avoid sync gaps.