Back to blog
SecurityFebruary 12, 2026

API Key Safety for Claude Code

Best practices for keeping your API keys secure in development workflows.

Never Commit Keys to Git

Always use environment variables or .env files. Add .env and .env.local to your .gitignore.

Use Environment Variables

Instead of hardcoding keys:

export ANTHROPIC_AUTH_TOKEN="your-key-here"

Rotate Keys Regularly

If you suspect a key has been exposed, generate a new one from your dashboard immediately.

Limit Key Permissions

Use the key limits provided by EcomAgent to restrict request volume and prevent unexpected charges.