Your Anthropic API key leaked — the response, step by step

Revoke first. Go to console.anthropic.com/settings/keys, find the key, and disable it. Then work down this page.

The shape of this incident is the same as the OpenAI version — what differs is the console, the key format, and the API.

1. Revoke

Console: console.anthropic.com/settings/keys. Identify the key by its label and last characters, and disable it.

API, with an admin key:

export ANTHROPIC_ADMIN_KEY="sk-ant-admin..."

# list active keys
curl -s "https://api.anthropic.com/v1/organizations/api_keys?status=active&limit=100" \
  -H "x-api-key: $ANTHROPIC_ADMIN_KEY" \
  -H "anthropic-version: 2023-06-01" | jq '.data[] | {id, name, partial_key_hint}'

# deactivate one
curl -s -X POST "https://api.anthropic.com/v1/organizations/api_keys/$KEY_ID" \
  -H "x-api-key: $ANTHROPIC_ADMIN_KEY" \
  -H "anthropic-version: 2023-06-01" \
  -H "content-type: application/json" \
  -d '{"status":"inactive"}'

partial_key_hint is how you match a key you found in a log or repository to the ID you need.

Note the pattern difference from OpenAI: Anthropic deactivates a key by status update rather than deleting it. The effect is the same — the credential stops working — and the record stays for audit.

2. Reissue and redeploy

Create a replacement in the console. Store it in a secret manager, deploy, verify.

If this is a planned rotation rather than an active leak, create and deploy the new key _before_ revoking the old one, wait for deployments to roll, then revoke. During a real compromise, don't — take the outage.

3. Check the cost report for abuse

Look at your organisation's usage and cost report for the exposure window and ask three questions:

• Is there spend on a day you weren't shipping?
• Is there usage of a model your code does not call? Stolen keys get pointed at the most capable model available, because that is what has resale value.
• Is there activity at hours you were asleep?

Any yes means treat it as confirmed abuse. More signals in how to tell if someone is using your API key.

4. Cap the account

• Remove or reduce any automatic credit top-up. An auto-refilling balance is what turns a capped loss into an uncapped one.
• Set a spend limit at the organisation level.
• Remove payment methods you don't need on file.

5. Purge the key from wherever it leaked

How to remove an API key from git history — and check the other usual suspects: notebook output cells, .env.example, client bundles, CI logs, Docker layers, screenshots.

6. Contact Anthropic

Report it through the console's support channel with the key ID and the exposure window. As with every provider, expect the account holder to be responsible for the usage. Ask anyway; don't wait on the answer.

Anthropic key formats

Worth being able to recognise on sight, because the type determines the blast radius:

An admin key is far more dangerous than an inference key. Keep it out of the same repository and the same environment as anything else — see is it safe to give an app your admin key?

Sources

• Anthropic Console — API keys
• Anthropic — Admin API documentation