Now on AppleNow on AndroidScan free

Leaked an API key? › Anthropic

Leaked Anthropic API key: what to do in the next 10 minutes

Last updated: November 5, 2026. Steps checked against Anthropic's own docs on November 5, 2026.

Short answer: Delete the leaked key on the Claude Console API keys page first (⋯ → Delete API key). Then create a new server-only key, check Usage and Logs, set spend limits, and contact Support if suspicious activity continues.

Which Anthropic keys are secret?

The next 10 minutes

Times are a rough guide. Do the first step before anything else.

1. Delete the leaked key (Minutes 0-2)

  • Open API keys in the Claude Console (platform.claude.com/settings/keys), open the ⋯ menu next to the leaked key and choose Delete API key. Anthropic recommends revoking a key right away if you suspect it was compromised.
  • Deleting is permanent: the key is archived (the Admin API shows its status as archived) and can't be used again.
  • If an Admin API key may also be exposed, delete it on the Admin keys page in the Console too.
  • If the key was pushed to a public GitHub repo, Anthropic is a GitHub secret scanning partner and may already have deactivated it and emailed you. Verify in the Console; don't rely on that alone.

2. Create a server-only replacement (Minutes 2-5)

  • Create a key on the same page and copy it now: the Console shows the full sk-ant- key only once.
  • Use a personal key for your own development, or a service account key for shared or production backends (workspace keys are legacy). You can set an expiration when you create the key (it can't be changed later) and turn on IP allowlisting to limit where the key works.
  • Store the key only in a secrets manager or a server-only environment variable, never in client JavaScript or client-bundled env vars such as VITE_ or NEXT_PUBLIC_, then redeploy. Anthropic says to call Claude from your own backend.

3. Check usage and cap spend (Minutes 5-8)

  • Review Logs (platform.claude.com/logs) and Usage (platform.claude.com/usage) for activity you don't recognize, and note the times and request IDs.
  • Set your own organization spend limit on the Billing page (platform.claude.com/settings/billing). For a workspace other than Default, set a workspace spend limit from the Workspaces page (Spend limits). Workspace rate limits are under Rate limits (platform.claude.com/usage/limits).

4. Contact Support and clean up (Minutes 8-10)

  • If suspicious activity continues, contact Support from the Claude Console Help Center (Get help → support messenger) with what you found, including times and request IDs. We can't promise how Support will handle any charges.
  • Rotate any other secrets stored alongside the leaked key in the same file or commit.
  • Remove the key from your frontend code, public files and git history, then re-check your live site.

Good to know

After the first 10 minutes

Move the code that needs the key to the server (an API route, serverless function or Supabase Edge Function), keep the key in a server-only environment variable, redeploy, and re-check your live site. The general plan, with a prompt you can paste into Lovable, Bolt, Cursor or Claude Code, is in I leaked an API key in my vibe-coded app. What do I do now?

What SniffPup checks, and what it doesn't

A free SniffPup scan reads only what your live site serves to the public: secret key patterns in HTML and same-origin JavaScript (masked in the report) and public files such as /.env and /.git/config. It never uses a key it finds. It can't see your repo, your server or Anthropic's logs, so the steps above are always on you. A clean report is not a guarantee of security.

Sources

Anthropic can change its dashboard and steps at any time. If something here doesn't match what you see, follow Anthropic's docs and tell us.

Other providers