API keys
A key is a password that spends money. Everything awkward about them comes from that one fact.
“You can do stuff like API keys, which is technical, but don’t worry about it.” That is how it comes up in a lesson. It is one idea, and you learn it once.
Most people never need one. If you use Claude on the web, in Cowork or in Claude Code, your plan already covers it: the short answer is in the FAQ →
A key
A password that spends your money
An API key lets code you have built talk to Claude, and charges your account for it.
Anthropic compares it to a credit card number: whoever holds it spends on your behalf.
- Are you using Claude, or building something that uses Claude?
- Whose card sits behind this key?
- Would you email someone your bank card number?
You create one in the Claude Console, the developer platform at platform.claude.com. Usage is billed per use, and you buy credit before you spend it.
Separate
Your Claude plan is not API credit
Paid plans and the Console are two products with two bills.
Paying for Pro or Max puts no credit on a key, and a key does not unlock the chat.
- Is this Claude itself, or something you built?
- Does it need to run when you are not there?
- Has anyone told you a key is required, and said why?
Anthropic’s wording: a paid subscription “doesn’t include access to the Claude API or Console”. You do not need a company to open one.
Server side
Why a key can never sit in a web page
Anything the browser can read, your visitors can read.
View source on any live site and every line of its front-end code is there, in plain text.
- Which half of this runs on someone else’s computer?
- Does the key ever travel to the browser?
- Could you publish this file and not care?
So the key stays on a server. The page asks the server, the server adds the key and calls Claude, and only the answer comes back.
Four steps, and they never change
Do these once and the habit carries to every service you ever sign up to.
- 1
Create it in the Console. Sign in, open the API keys page, make one. It is shown to you exactly once.
- 2
Put it in a .env file. One line, no quotes, no spaces around the equals. Never in the code itself.
- 3
Check .gitignore lists .env before you push. Anthropic says you must add it, so nothing publishes it by accident.
- 4
Paste it nowhere else. Not a public post, an email, a support ticket, or a chat window.
Already out? Delete that key and create a new one. GitHub scans public repositories for Claude keys, and Anthropic switches off the ones it finds.
Two safe homes, and one long no
On your computer
while you build- A .env file, one line, nothing else.
- Listed in .gitignore, so it never ships.
Your host’s settings
once it is live- Added as an encrypted secret.
- Read by the server, never by the page.
Nowhere else
the whole list- Not in browser code or a public repo.
- Not in a chat, an email or a screenshot.
The same rule covers every service, not just Claude. A free weather key is low risk. A paid one is your card.
- A key: a password that spends your money.
- Separate: your Claude plan does not include API credit.
- Server side: the browser must never see it.
- .env and .gitignore: where it lives, and what stops it shipping.
This week: if you hold a key anywhere, open .gitignore and check .env is in it.
Build the project this page comes from: AI Building Course → Then put it online, key and all: Netlify →
Do it with someone. Everything here is free and you can run it alone. If you would rather work through it with me, one to one, book a free 30-minute chat. No pitch.