Tool setup
Keep your Claude API key secure
Your key spends real balance, so treat it like a credential. apiToken.sale gives you controls to limit blast radius if a key ever leaks.
·
Controls that limit risk
- Set a lifetime spending limit for the key.
- Choose an expiration date when temporary access should end automatically.
- Issue a separate, clearly named key per tool or environment.
- To replace a key, create the replacement, update the client, then revoke the old key.
See also: Claude API best practices
Basic hygiene
- Never commit keys to git or paste them into chats.
- Store keys in environment variables or a secret manager.
- Revoke and rotate immediately if a key is exposed.
Frequently asked questions
How do I limit damage if a key leaks?
Use a lifetime spending limit and expiration date, keep separate named keys per client, and revoke the exposed key immediately.
Where should I store my key?
In environment variables or a secret manager — never committed to git or shared in chats.
Start with Google or GitHub and get $10 of Claude usage at official prices — no card required.