Anthropic API Key in Client-Side Code: What to Do
Updated 2026-10-17
The same pattern as any LLM key: if ANTHROPIC_API_KEY or an sk-ant- value reaches the browser, anyone can use it. Some SDKs require an explicit opt-in flag to run in browsers precisely because of this risk.
Find it
Search your build output for sk-ant- and for the literal name ANTHROPIC_API_KEY. The name alone means server config is being bundled; a value means it is leaked.
Fix it
Delete the key in the Anthropic console, create a new one, and call the API only from server code with authentication and rate limits in front.
Checklist
- No sk-ant- values in client bundles
- SDK not configured for direct browser use with a real key
- Server route with auth + rate limit
- Old key deleted
Copy-paste fix prompt
Find all client-side Anthropic SDK usage, remove any browser-access flags and keys, create a server route that calls the Messages API with ANTHROPIC_API_KEY from the server environment, and require an authenticated session plus a per-user rate limit.FAQ
What if only the variable name appears, not the value?
That is a warning sign rather than a leak: some shared config module is bundled into client code. Split it so server-only config is never imported by client files.
Do I need to rotate if the key was only in a preview deploy?
Yes, if the preview was reachable from the internet. Rotation is cheap compared with abuse.
Check your deployed app in ~25 seconds
Free passive scan: leaked keys, Supabase exposure, public config files and headers.
Run a free scan