---
title: Securing Your Claude API Key
description: "How to protect a Claude API key on apiToken.sale with a lifetime spending limit, optional expiration, separate named keys, prompt revocation, and safe secret storage."
url: https://apitoken.sale/docs/learn/claude-api-key-security
language: en
---

# Keep your Claude API key secure

Your key spends real balance, so treat it like a credential. apiToken.sale gives you controls to limit blast radius if a key ever leaks.

## Controls that limit risk

- Set a lifetime spending limit for the key.
- Choose an expiration date when temporary access should end automatically.
- Issue a separate, clearly named key per tool or environment.
- To replace a key, create the replacement, update the client, then revoke the old key.

## Basic hygiene

- Never commit keys to git or paste them into chats.
- Store keys in environment variables or a secret manager.
- Revoke and rotate immediately if a key is exposed.

## Frequently asked questions

### How do I limit damage if a key leaks?

Use a lifetime spending limit and expiration date, keep separate named keys per client, and revoke the exposed key immediately.

### Where should I store my key?

In environment variables or a secret manager — never committed to git or shared in chats.

---
Get a key: https://apitoken.sale/register
More guides: https://apitoken.sale/docs/learn