Protect your Anthropic API key from theft
Stolen Anthropic API key burned an indie app's credits · Security incident · X · @ThePurePath · Oct 2026
The builder behind PurePath says someone got hold of their Anthropic API key and ran up roughly $500 of model usage. A follow-up post says support called the credits non-refundable.
Lesson
Keep provider keys server-side only, set a hard monthly spend cap and rotate any key that may have been exposed. See our API key guide.
Fix prompt
Copy this into your own AI tool (Cursor, Lovable, Claude Code, Bolt…). It's general guidance written by us. Review what the AI suggests before applying it.
I'm a beginner and want to make sure my API keys are safe in my Anthropic API project. 1) Search the code for hardcoded keys or tokens and for secrets in variables that ship to the browser (NEXT_PUBLIC_, VITE_, REACT_APP_). List the file and line, but don't print the values. 2) For each one, tell me whether it's meant to be public (like a Supabase anon key) or secret. 3) For secret ones, show me how to move them to server-side env vars and call the provider through a server route. 4) Give me the steps to rotate each exposed key in the provider's dashboard and set a spending limit. 5) Make sure .env is in .gitignore and in my AI tool's ignore file. Don't change anything until I've approved your plan. Never ask me to paste API keys, passwords or .env contents; tell me where to check them myself.
Source: X ↗