What to do if your Anthropic API key leaked

The short version

• Anthropic’s help article says to revoke a compromised key by deleting it on the API keys page (menu next to the key → Delete API key), then create a replacement and store it in a secrets manager — not in version control.
• Disable is reversible (inactive); Delete is permanent (archived). After a suspected leak, delete it.
• If the leaked secret starts with sk-ant-admin01-, that is an Admin API key: delete it on the Admin keys page, not only the regular keys list.
• GitHub secret scanning can cause Anthropic to deactivate a key found in a public repository and email you. Do not wait for that email, and do not assume a leak elsewhere was caught.
• Then replace the key everywhere it was stored, clean the leak site, and review Usage and Logs for the exposure window.

1. Delete the key now

Anthropic’s compromised-key article (read 8 Nov 2026): log into the Claude Console, open platform.claude.com/settings/keys, click the three-dot menu next to the key, and select Delete API key. Create a new key with Create key on the same page. Copy it now — the Console does not show the full secret again.

If you see abuse, delete first, then create the replacement. If there is no sign of abuse and you need to avoid downtime, you can create and deploy the new key first, then delete the old one. Either way, do not leave a key you suspect is leaked in active status.

That disable-versus-delete split is in Anthropic’s authentication docs (read 8 Nov 2026). Organization admins can also change status with POST /v1/organizations/api_keys/{api_key_id} and status set to inactive or archived. That endpoint never returns the secret. The Admin API is unavailable for individual (non-organization) accounts — those accounts use the Console only.

Admin API keys are a separate list

A Console Admin API key starts with sk-ant-admin01- and is created on the Admin keys page. It can list and update other keys and read usage and cost. If that secret may have leaked, delete it there too — removing only a regular sk-ant-api... key does not disable an Admin key. See Anthropic’s Admin API keys page.

The GitHub email is not the whole job

Anthropic’s API key best practices describe a partnership with GitHub’s secret scanning: GitHub scans public repositories for Claude API keys, notifies Anthropic, Anthropic deactivates the exposed key, and you get an email. If you received that mail, the key is already deactivated — you still need to deploy a replacement and review usage. If the key leaked in a private repo, a gist, CI logs, a chat, a frontend bundle or a third-party tool, that partnership does not apply. Delete it yourself.

2. Replace it everywhere

• Hosting environment variables (Railway, Vercel, Fly and similar), CI secrets and local .env files.
• Any tool you pasted it into: AI coding assistants, automation platforms, proxies, shared notes.
• Redeploy so running instances pick up the new key. A deleted key stops working; leftover processes will start failing until they have the replacement.

After Railway’s 21 October 2026 disclosure, Railway published a walkthrough for unexpected Anthropic usage (read 8 Nov 2026) with the same order: delete the key, deploy the replacement, then review Usage, Cost and Logs.

3. Clean up where it leaked

• Git: deleting the file does not delete the key from history. Rotate first (the old value must already be useless), then rewrite history or treat that history as permanently exposed. Anthropic’s best-practices article suggests secret scanning in your provider and tools such as Gitleaks.
• Frontend: a key in browser code is public. Call the Claude API from your own back end. Anthropic’s authentication docs say the same.
• Logs, tickets and chat: redact entries and add a redaction rule for sk-ant- prefixes. Don’t paste keys into support tickets — Anthropic’s best-practices article asks you not to, even when writing to Anthropic.
• Vendor breach: rotate every secret that vendor stored, not only the Anthropic key.

4. Review usage by API key

Anthropic recommends regularly reviewing the Logs page and the Usage page. After a leak, go through both for the window since the key was exposed:

• Usage: compare the exposed key’s token volume and model mix with your normal traffic. A key that usually calls one model and suddenly shows another is a strong signal (Railway’s walkthrough describes grouping Usage by API key).
• Cost: spend attributed to that key and workspace during the exposure window.
• Logs: filter to the exposed key and look at request patterns, timings and error rates that don’t match your application.
• Members and workspace membership: people you did not invite.

If you find usage you did not generate, save the usage and cost data and contact Anthropic Support, as both Anthropic and Railway advise.

Organizations can pull the same breakdown from the Usage and Cost Analytics API (beta, read 8 Nov 2026). Filter with api_key_ids[] — that is the key’s apikey_... ID from List API Keys or the Console, never the secret itself. This API is for organization accounts (an Admin API key); it is unavailable for individual accounts.

# Replace the dates with your exposure window (UTC, ending_at is exclusive).
# Use an Admin API key, not the leaked secret.
curl --globoff "https://api.anthropic.com/v1/organizations/analytics/usage?\
starting_at=2026-11-01T00:00:00Z&\
ending_at=2026-11-08T00:00:00Z&\
api_key_ids[]=apikey_01Rj2N8SVvo6BePZj99NhmiT&\
group_by[]=model&\
time_bucket_width=1d" \
  -H "anthropic-version: 2026-10-21" \
  -H "anthropic-beta: analytics-usage-cost-2026-08-24" \
  -H "x-api-key: $ANTHROPIC_ADMIN_KEY"

Two freshness notes from the same docs: Analytics API data typically refreshes within 4 hours and can take up to 24 hours, so very recent abuse may not be in that response yet. The legacy Usage and Cost API (/v1/organizations/usage_report/messages, still supported) is documented as typically appearing within about 5 minutes. For individual requests, use the Console Logs page rather than waiting on a report.

5. Cap the damage next time

• Give each app or agent its own key, and prefer a key scoped to one workspace. Anthropic’s best-practices article says separate keys for development, testing and production so you can disable just that use case.
• Do not leave production keys in the Default Workspace: you cannot set a spend limit there. Move them to a workspace that has a monthly spend limit. See Anthropic Default Workspace limits and workspace spend limits via the API.
• Set an organization spend limit on the Billing page as well. Auto-reload replenishes credits when the balance is low; it is not a spend cap. See credit balance too low.
• When you create a replacement key, choose an expiration (presets include 3 hours, 1 day, 7 days or 30 days, or Never). Expiration limits how long a leaked credential stays usable; it is not a substitute for deleting a key you already suspect is leaked.
• If your organization has IP allowlisting (a beta under your agreement with Anthropic), turning it on limits where a leaked key works. Covered Messages API requests from an address outside the list return HTTP 403 permission_error with “Your IP address isn't in this organization's allowed range.” An allowlist does not limit how long the key stays valid. Changes can take up to 15 minutes. Anthropic recommends keeping “Allow admins to access this settings page from any IP address” selected so you don’t lock yourself out.
• For production workloads on a cloud identity you already trust, Anthropic’s authentication docs describe Workload Identity Federation: short-lived tokens instead of a long-lived sk-ant-api... string.

If someone uses Claude Code signed in with a Claude Console account, Anthropic mints a per-user API key in the Claude Code workspace. Treat a leaked Console-billed Claude Code key the same way: delete or disable it and review that workspace’s usage. KeyBark watches Anthropic organization API spend, not Claude.ai or Claude Code subscription credits.

Prefer a provider-by-provider checklist? Use the free leaked key response plan. Not sure whether your Anthropic (and OpenAI / OpenRouter) limit settings would actually stop a leaked key? The free AI key limit audit checks them in a few minutes (no sign-up, no key needed). Related: OpenAI API key leaked, runaway AI agent cost.

Where KeyBark fits (and where it doesn't)

KeyBark reads Anthropic organization cost from our servers about every 15 minutes during the beta (Admin cost report, including Default Workspace spend) and emails you when a daily or monthly dollar threshold you set is crossed, or when today's spend jumps above your 7-day average. About once a day it also searches public GitHub code for the key you connected (sending GitHub only a short fragment, never the whole key) and emails you a checklist if it appears. On paid plans an opt-in kill switch (beta) can disable a named key when a daily or monthly threshold is crossed — not when a leak alert fires.

Limits, honestly: KeyBark does not revoke or rotate keys for you, does not scan private repositories, git history, gists, paste sites or chats, and does not set Anthropic spend limits or IP allowlists. Leak watch is roughly daily, not a substitute for deleting a key you already know is exposed. Spend checks run on a schedule, so an alert can arrive after money has been spent. KeyBark is not a proxy and can't block a request. Delete the leaked key in the Claude Console first; KeyBark is a second line of warning on top.

FAQ

Sources (read 8 Nov 2026): Anthropic compromised-key help article, API key best practices, authentication, Admin API keys reference, workspaces, Usage and Cost Analytics API, IP allowlisting. Also Railway’s unexpected-Anthropic-usage note. KeyBark is not affiliated with Anthropic.