sk-ant-api03-…
Exposed Anthropic API Key? Here's how to detect and rotate it
A leaked Claude key (sk-ant-api03-…) bills Claude API usage to you. Scan free with Trust, then delete it in the Claude Console settings in seconds.
An Anthropic API key (starting with sk-ant-api03-) authenticates calls to the Claude API and bills them to your account. Whoever holds it can run Claude on your dime until you delete it. Keys are shown only at creation, so a leak means you replace, not recover.
What an attacker can do with a leaked Anthropic API Key
- Runs up Claude API charges on your account, potentially exhausting credits or spend limits.
- Consumes your rate limits, breaking or throttling your own production traffic.
- Uses your key through resale ‘proxy’ services, tying your account to abuse.
- Reads workspace/usage context the key is scoped to.
How Anthropic API Keys get exposed
- Committed to a public repo — Anthropic partners with GitHub secret scanning and auto-deactivates detected keys.
- Shipped in a client-side bundle or mobile app instead of staying server-side.
- Hardcoded in a script, notebook, or Dockerfile that got shared.
- Captured in logs, a screenshot, or a pasted snippet.
Scan your repo and live site for exposed Anthropic API Keys — free
Trust checks your code, git history, and shipped JavaScript. No signup, results in about a minute.
Run a free scan →How to rotate a leaked Anthropic API Key
- Sign in to the Claude Console and open Settings → API keys.
- Find the leaked key, click the ‘…’ menu next to it, and choose Delete API Key (revocation is instant).
- Click Create Key, name it, optionally set an expiration, and copy it once.
- Update your server environment/secrets manager with the new key and redeploy.
- Verify your app works on the new key.
- Review Usage/billing for anomalies; if it was in a public repo, confirm Anthropic's auto-disable email and still delete it manually.