Guides
Sooner or later a coding agent asks for an API key. These guides say what happens when you paste one into the chat, and how to set up Resend, Stripe and Supabase so the agent can use a key it never sees: the narrowest key each one offers, offprompt to hand it over, and code that works.
- Claude Code
- Codex
- Cursor
- OpenAI
Claude asked for my API key. Is it safe to paste it?
A key pasted into an AI agent's chat stays in the transcript and goes to the model provider with each request. Let the agent ask for it without seeing it instead.
Read the guide- Resend
Send email with Resend without giving your agent the API key
Verify a domain, make a Resend key that can only send from it, and let your coding agent ask for RESEND_API_KEY with offprompt, so the key never enters the chat.
Read the guide- Stripe
Take Stripe payments in test mode without your agent seeing the secret key
Build Stripe Checkout with a coding agent while the secret key and webhook signing secret stay out of the chat: test keys, restricted keys and offprompt.
Read the guide- Supabase
Use Supabase with a coding agent without leaking the service_role key
Supabase's service_role and secret keys bypass Row Level Security. Keep them out of the agent's chat and the browser, and use them only in server code.
Read the guideIn the docs
- How to give Claude Code an API keyFour ways to get a key to an agent, and what each keeps out of the chat and the transcript.
- How to add API keys to Cursor without pasting them into chatCursor's agent asks with offprompt, you type the key on a local page, and only its name reaches the agent.
- How to keep secrets out of your AI agent's contextWhere secrets get into an agent's context, and how to keep each way closed.