Anthropic API key (sk-ant-) is in the front-end code

What it means in plain English

A Claude API key starting with sk-ant- authenticates requests to Anthropic. The getting-started guide tells you to put that key in the ANTHROPIC_API_KEY environment variable and send it from your own request, not to paste it into the page. Anthropic also says browser apps should send API calls through a backend proxy. A key in the JavaScript bundle can be copied by anyone who opens the site.

Likely causes

• The page calls api.anthropic.com from the browser and puts the key in the x-api-key header.
• The key was stored in a public env var (VITE_ or NEXT_PUBLIC_) and the build baked it into the script.
• An admin key (sk-ant-admin) was used where a normal key was meant to go, and then shipped to the client.

How to fix it, step by step

1. Search the built JavaScript for sk-ant- and delete it from front-end code.
2. Add a server route that reads ANTHROPIC_API_KEY and calls the Claude API. The browser calls your route. Anthropic's data-retention guide says to route browser requests through a backend proxy.
3. Keep the variable off any prefix that exposes it to the client.
4. In the Claude Console, generate a replacement key under Account Settings, as the getting-started guide describes, and point the server environment at the new key. Stop using the key that was in the bundle, including an sk-ant-admin key if that was the one exposed.

How to check it worked

• The deployed scripts do not contain sk-ant-.
• A prompt still gets a reply, and the browser does not send x-api-key to api.anthropic.com.

A key that stays on the server can still return 429 or 529 once traffic picks up. See Anthropic or Gemini API 429 and overloaded errors.

Sources

• https://docs.anthropic.com/en/docs/initial-setup (opens in a new tab)
• https://docs.anthropic.com/en/api/getting-started (opens in a new tab)
• https://docs.anthropic.com/en/docs/build-with-claude/zero-data-retention (opens in a new tab)
• https://docs.anthropic.com/en/api/administration-api (opens in a new tab)