You pasted an API key into ChatGPT or Claude: what now?
Short answer: treat the key as exposed and replace it. Deleting the chat does not un-send it, and you cannot see where else the text went (logs, retention, shared links, screenshots, a coding agent's transcript). Replace the key, check its usage, then tidy up the chat. The rest of this page is about what providers document, which is less than you would like.
This is a short playbook, not a panic button. Whether an AI provider “trains on” or “keeps” what you typed depends on the product, plan and settings, so we quote documents we could read and say what we could not.
Do this first (five minutes)
- Replace the key at the provider and revoke the old one (create new, deploy, revoke, as in the 15-minute playbook). Do this before anything else; it makes the pasted copy worthless.
- Check usage of the old key for the window since you pasted it, and set a spend limit on the new one.
- Change every copy of the old value. With Dynv that is one previewed operation (walkthrough); it only covers copies inside Dynv, so search elsewhere too.
Then: the chat
- Delete the conversation if you like, but understand it is housekeeping. Anthropic’s consumer data page says deleting a conversation removes it from your chat history immediately and from its back-end storage “within 30 days” (Anthropic).
- Shared links, exports, screenshots and shared workspaces may hold copies. Remove shared links; ask teammates who saw it.
- If an AI coding agent handled the key, its session transcript may be stored locally or by the provider. Rotation is the control that does not depend on finding every copy.
What providers document (read 2026-11-01)
| Provider and product | What the page we read says | Link |
|---|---|---|
| Anthropic, consumer plans (Free, Pro, Max, and Claude Code on those plans) | Deleted chats are removed from back-end storage within 30 days. If you allow use of your chats to improve Claude, “we may retain your data in a de-identified format for up to 5 years”; if you turn that setting off, previous and new chats are not used for future training | privacy.claude.com |
| OpenAI API | “By default, abuse monitoring logs are generated for all API feature usage and retained for up to 30 days, unless longer retention is required by law” or to protect services; eligible customers can be approved for Zero Data Retention or Modified Abuse Monitoring | platform.openai.com |
| ChatGPT (consumer and business) | We could not load OpenAI’s help-center pages for ChatGPT data controls from our network, so we make no claim. Read their current data controls page yourself | help.openai.com |
Takeaways without over-reading: retention for a default consumer chat is measured in weeks at minimum, can be much longer if training use is allowed, and is different for API and business products. None of these pages promise that nobody could ever see your text, and none give you a way to verify deletion. That is why the first step is rotation.
Would a leaked key actually be found?
Possibly not, but you should not bet on it. The risk is not mainly “the model recites your key to a stranger”; it is a longer list of ordinary exposures: logs and support access, a compromised account (someone who takes over your chat account reads your history), a shared conversation link, a browser extension that reads pages, a teammate’s screen share. Any of those is enough, and rotation costs minutes.
Stop it happening again
- Don’t paste values; paste names. Ask the assistant about
STRIPE_KEY, notsk_live_.... For debugging output, redact first. - Give agents references, not secrets. Dynv’s MCP server returns variable names and masked values by default, so an agent can help with configuration without holding the key (setup, threat model). A value an agent sets still passes through its context, because the agent wrote it.
- Use short-lived, narrowly scoped keys for anything you might ever paste while debugging, with a spend cap.
- Turn on your Git host’s secret scanning and a pre-commit scanner, so the same mistake in code is caught (guide).
Limits
- We cannot tell you whether any particular provider has seen, kept or used your key; only the provider can.
- Retention terms change. Check the linked pages for your plan before relying on any number here.
- This page does not cover regulated data (customer records) pasted into chats, which may carry legal obligations beyond key rotation.
Facts last verified . Spotted an error? Tell us.