API keys

When your app talks to the Claude API, Supabase, or Stripe, it has to prove who it is. It does that with an API key. Let's see what that means and how to handle one safely.

What is an API key?

An API key is a long, random password that lets your app use a service. It's like a house key and a credit card rolled into one.

• Like a house key: whoever holds it can get in. The service doesn't know who is holding it.
• Like a credit card: every request is charged to your account.

Here is roughly what one looks like (this one is fake):

sk-ant-api03-Xy7fake9Qm2fakeLp4KEYw8Rnot-real-0000

Many secret keys start with sk-, which stands for "secret key." When you see that, treat it like cash.

Creating a key

Every provider has a dashboard page for keys. The menus change often, but the steps are almost always the same.

1. Log in to the provider's developer console (for example, the Anthropic Console for the Claude API).
2. Look for a page called "API keys," usually in settings.
3. Click "Create key" and give it a clear name, like my-app-local.
4. Copy the key right away. Most providers show it only once.
5. Paste it straight into your .env.local file. You'll learn how on the next page.

Revoking a key

Revoking means switching a key off forever. It's like changing your locks. The old key stops working immediately.

Revoke a key when:

• You accidentally pasted it into a public place, like GitHub, a screenshot, or a shared chat.
• You stopped using a project.
• You're not sure whether it was exposed. When in doubt, revoke and create a new one.

What happens if a key leaks?

Automated bots scan public code on GitHub around the clock. A leaked key can be found and used within minutes. People have woken up to large bills this way.

If it happens to you, don't panic. Follow these steps:

1. Revoke the leaked key in the provider's dashboard right away.
2. Create a new key and put it in your .env.local file and on your host.
3. Check your usage and billing page for strange activity.

Public keys vs secret keys

Some services give you two kinds of keys. Supabase and Stripe are good examples.

A public key is safe in the browser only because other protections do the real work. For Supabase, that protection is Row Level Security. Without it, the public key can expose your data.

Common mistakes

Pasting a key into a prompt

Wrong: "Here's my key sk-ant-api03-..., please add it to my code."
Right: "Read the Claude API key from the ANTHROPIC_API_KEY environment variable. I'll add the value myself."

• Using one key for every project. Create one key per project, so you can revoke one without breaking the others.
• Sharing screenshots with keys visible. Blur or crop them first.
• Using the Supabase service_role key in the frontend because "it fixed the error." It removes all your security.

What's next?

You know what keys are and why they matter. Next, let's learn where to keep them: in a .env file.