I leaked an Anthropic API key: delete it and check usage
Short answer: in the Claude Console, open the API keys page (platform.claude.com/settings/keys), click the menu next to the key, select Delete API key, then create a new key on the same page. Afterwards review the Logs and Usage pages for activity you don't recognize, and put limits in place.
This is the Anthropic-specific page for the leaked-key playbook. It follows two of Anthropic’s help articles, read on 2026-11-01: What should I do if I suspect my API key has been compromised? and API key best practices.
Revoke the key
Anthropic’s article: “If you suspect that your API key may be compromised, we recommend revoking the key immediately. You can do so by logging into your Claude Console account, going to the API keys page (platform.claude.com/settings/keys), clicking the menu (i.e. the three horizontal dots) next to the key in question, and selecting ‘Delete API key.’” You can generate a new key with Create key on the same page; “make sure to save this key somewhere secure, such as a secrets management system and avoid keeping the key in version control.” If you still see suspicious activity, Anthropic’s article says to contact its Support team.
If you need to avoid downtime and there is no sign of abuse, create the new key first, deploy it, then delete the old one. If you see abuse, delete first.
Check what happened
Anthropic’s best-practices article recommends regularly reviewing the Logs page (platform.claude.com/logs) and the Usage page (platform.claude.com/usage) for your API keys in the Console. After a leak, go through both for the window since the key was exposed, looking for models, volumes or times you don’t recognize.
Put limits in place
The same article describes safeguards that bound the damage of a leaked key:
- Custom rate limit organizations: set spend limits on the Billing page (
platform.claude.com/settings/billing) and workspace rate limits on the Rate limits page. - Standard rate limit organizations: turn on and configure auto-reload on the Billing page, and “carefully consider auto-reload limits”: it ensures continuous service but also acts as a safeguard against unexpected high usage.
- Separate keys for different purposes: use different keys for development, testing and production, so “if your API Key is compromised, this allows you to quickly disable just that use case and limit any potential damage.”
- Rotate on a schedule (the article gives every 90 days as an example) by creating new keys and deactivating old ones.
Where the key usually ends up
The same article lists the most common cause of leaks as accidental exposure in public code repositories or third-party tools, which includes pasting a key into one. See what to do if a key went into an AI chat, and keep keys out of files that coding agents can read (why).
After the provider is fixed: every other copy
Replacing the key at Anthropic is half the job. The same value is usually also in other services, a CI variable, a teammate’s .env or another vault. With Dynv you can preview one operation that finds each copy it knows about (including the same value under another name) and replaces them together: pipe the new value in so it never lands in shell history, for example pbpaste | dynv rotate ANTHROPIC_API_KEY --leaked --stdin --dry-run, then run it again with --yes (the plan also suggests copies under other names, which you add with --also SERVICE:KEY). --leaked means “everywhere, no fallback, no stages; the old value stops working now”, which is what you want after a leak. Dynv only knows copies stored in Dynv; search repositories, CI and chat for the old value’s prefix yourself. The generic order of operations, with the evidence on how fast leaked keys are used, is in the 15-minute playbook.
Limits of this page
- We read Anthropic’s own documentation on 2026-11-01 (linked above) and did not exercise Anthropic’s console or API for this post. Console layouts and defaults change; follow Anthropic’s current instructions where they differ.
- If the key was in a repository, rotating it is the fix; cleaning Git history is housekeeping (how).
- If an AI chat or an agent saw the key, see what to do.
Facts last verified . Spotted an error? Tell us.