Claude asked for my API key. Is it safe to paste it?

An agent such as Claude Code, Codex or Cursor works by sending the whole conversation to a model on every turn. Once a key is in the conversation, it goes along each time:

• The model provider receives it, with that request and every later one in the session, and keeps it for as long as its data policy keeps requests.
• The transcript keeps it. Coding agents save each session on your disk so you can resume it, and a hosted agent keeps it in your account. A summary made when the conversation is compacted can repeat it.
• The agent can echo it. Asked to make something work, it may write the key into a config file, a test, a script or a log line, and from there into a commit.

None of this can be taken back. A key that has been in a chat is best treated as exposed, and replaced.

offprompt is an MCP server, a tool the agent can call. When a task needs a key the project does not have, the agent calls offprompt's collect_secret tool with the key's name, why it needs it, and the file it goes in:

{
  "secrets": [{ "name": "OPENAI_API_KEY", "provider": "openai" }],
  "reason": "Each new support ticket gets a short summary from **OpenAI**, written by `lib/summarise.ts`.",
  "sink": { "kind": "dotenv", "path": ".env.local" }
}

1. A page opens in your browser, served from 127.0.0.1 on your own machine. It says which agent is asking, what for, and which file it will write.
2. You paste the key. The page checks it against what offprompt knows of the provider, such as an OpenAI project key starting with sk-proj-, and links to where the key is made.
3. offprompt writes the key to .env.local, and answers the agent with the key's name and a fingerprint of four emoji, which your page shows too:

From then on the project reads the key by name, as process.env.OPENAI_API_KEY. The agent never had the value, so it cannot repeat it.

When the agent runs in a cloud sandbox, such as Claude Code on the web or Codex cloud, it cannot open a page on your screen. It shows you a link instead, through a Cloudflare quick tunnel. You open it in your own browser, which encrypts the key to one only the sandbox holds before sending it, so the tunnel carries only ciphertext. See Cloud sandboxes.

In the project's folder, with Node 22 or later, run npx offprompt init. It finds Claude Code, Codex, Cursor and Pi on your machine and declares offprompt in each one's project config. Commit what it adds, and everyone on the project gets it.

To add it by hand instead, start it from npm in each agent's config:

{
  "mcpServers": {
    "offprompt": {
      "command": "npx",
      "args": ["-y", "offprompt", "mcp"],
      "timeout": 330000
    }
  }
}

{
  "mcpServers": {
    "offprompt": {
      "command": "npx",
      "args": ["-y", "offprompt", "mcp"]
    }
  }
}

[mcp_servers.offprompt]
command = "npx"
args = ["-y", "offprompt", "mcp"]
tool_timeout_sec = 330

Claude Code asks once before it starts a server a project declares, and Codex reads a project's config only in a project you trust. The timeouts give you time to type: Codex otherwise ends a tool call after 60 seconds. On Linux, init also passes Codex the variables offprompt needs to open your browser. Other agents, such as Cline, are in Agents.

Then ask for the task, not the key: “Send a welcome email with Resend when someone signs up.” The agent calls offprompt when it reaches the step that needs the key.

offprompt keeps the key out of the conversation, but the file is on disk and the agent could still open it. Every result offprompt returns tells the agent not to and lists the keys the file holds, so it has no reason to. To make sure, close its file tools to the file:

{
  "permissions": {
    "deny": ["Read(./.env)", "Read(./.env.local)"]
  }
}

In Cursor, list .env* in .cursorignore. Neither covers every shell command, so a script that prints the environment can still show the value. How to keep secrets out of your AI agent's context goes through each way in.

1. Make a new key at the provider, with no more access than the task needs.
2. Ask the agent to use the new key with offprompt, so it is written without entering the chat.
3. Delete or expire the old key, and check the provider's logs for requests you did not make.
4. Search the project, and its git history, for the old value, in case the agent wrote it anywhere.

Each sets up a key with only the access it needs, has the agent ask for it, and uses it in working code.

• Send email with Resend without giving your agent the API keyVerify a domain, make a Resend key that can only send from it, and let your coding agent ask for RESEND_API_KEY with offprompt, so the key never enters the chat.
  • Resend
• Take Stripe payments in test mode without your agent seeing the secret keyBuild Stripe Checkout with a coding agent while the secret key and webhook signing secret stay out of the chat: test keys, restricted keys and offprompt.
  • Stripe
• Use Supabase with a coding agent without leaking the service_role keySupabase's service_role and secret keys bypass Row Level Security. Keep them out of the agent's chat and the browser, and use them only in server code.
  • Supabase

In a project's folder, run the command below, then ask the agent for something that needs a key.

• Send email with Resend without giving your agent the API key
  • Resend
• Take Stripe payments in test mode without your agent seeing the secret key
  • Stripe
• Use Supabase with a coding agent without leaking the service_role key
  • Supabase

All guides