How to Securely Use Claude API Keys in Cursor and Windsurf

Quick answer: To get a Claude API key, sign in to the Anthropic Console, navigate to API Keys, and click Create Key. To use it securely in Cursor or Windsurf, store the key in the editor settings or a local .env file. Never hardcode keys in source code or commit them to GitHub.

By Daniel A · Kraftwire Software

2026-08-26 · 6 min read

While these tools make development faster, they also introduce new risks. If you accidentally commit your key to a public GitHub repository or bake it into a frontend build, attackers can drain your credits in minutes.

In SimplyScan's scans of 178 AI-built apps, 59 of those apps (33%) had at least one HIGH or CRITICAL severity issue. Exposed API keys are among the most common critical findings. This guide covers how to generate your key and, more importantly, how to keep it out of your source code.

How Do You Generate a Claude API Key in 2026?

Generating a key is a straightforward process through the Anthropic developer portal. As of August 2026, the process remains centered on the Console.

Navigate to the Anthropic Console (console.anthropic.com).
Create an account or sign in.
Go to the Settings or API Keys section.
Click Create Key.
Give your key a descriptive name (e.g., cursor-development-project-a).
Copy the key immediately. Anthropic will not show it to you again for security reasons.

If you are just starting, you might look for a free Claude API key. While Anthropic occasionally offers trial credits to new accounts, most production usage requires a paid plan with a credit balance.

How Do You Use a Claude API Key in Cursor?

Cursor is a popular fork of VS Code designed for vibe-coding. It allows you to use your own API key instead of a Cursor subscription.

Setting the Key in Cursor Settings

To add your key, open Cursor and navigate to Settings · Models. Toggle the Anthropic switch to "On" and paste your sk-ant-api03-... key into the input field. This stores the key locally in your editor's configuration.

Why You Should Avoid Hardcoding in Cursor Rules

Many developers use .cursorrules files to give the AI context. Never put your API key in a .cursorrules file or any file that is part of your repository. If you push that repository to GitHub, your key is compromised.

How Do You Securely Use API Keys in Windsurf?

Windsurf, the agentic IDE from Codeium, handles keys similarly to Cursor but with a heavy emphasis on "Flows." Because Windsurf agents can perform terminal actions, the risk of a "leaky" agent accidentally reading an .env file and printing it to a log is real.

Open the Windsurf configuration.
Locate the AI Provider settings.
Select Anthropic and enter your Claude API key.
Ensure your .gitignore is properly configured before the agent starts creating files.

For a deeper dive into the specific risks of this IDE, see our Windsurf security guide.

Why Is Hardcoding API Keys a Critical Risk?

When you hardcode a Claude API key directly into your App.js or main.py, you are creating a massive vulnerability. In SimplyScan's research, security issues (high) appeared in 20 apps (11%) out of 178 scanned. A significant portion of these high-severity flags are triggered by secrets found in plain text.

If your key is in the frontend code:

Anyone who visits your website can "View Source" and find it.
Automated bots crawl GitHub 24/7 looking for strings starting with sk-ant-.

How Do You Fix an Exposed Claude API Key?

If you realize you have committed your key to Git or deployed it to a public URL, you must act immediately.

Revoke the Key: Go to the Anthropic Console and delete the compromised key. This stops the bleeding instantly.
Generate a New Key: Create a fresh key for your project.
Update Environment Variables: Move the key to an .env file.
Clean Git History: Simply deleting the key from the file and committing again is not enough. The key remains in your Git history. You may need to use tools like BFG Repo-Cleaner or git filter-repo to scrub it entirely.

For more details on remediation, read our guide on how to remove secrets from git history.

What Are the Best Practices for API Key Security?

To avoid becoming a statistic in the next vibe-coding security audit, follow these three rules:

1. Use Environment Variables

Always store your CLAUDE_API_KEY in a .env file. This file should stay on your local machine and never be uploaded to your version control system.

2. Strict .gitignore Policies

Your .gitignore file must include .env, .env.local, and any other secret storage files. You can use our gitignore generator to create a robust template for your specific framework.

3. Use a Backend Proxy

Never call the Claude API directly from the browser. Instead, send the request to your own server (e.g., a Next.js API route or a Supabase Edge Function). Your server holds the API key securely and forwards the request to Anthropic. This keeps the key invisible to the end user. If you are using Supabase, ensure you follow the Supabase security checklist to protect your edge functions.

How Can You Detect Leaked Keys Automatically?

Manual checks are often insufficient when you are moving fast with AI agents. SimplyScan provides an automated way to check for these leaks.

SimplyScan is a free site health scanner that detects exposed API keys, missing security headers, and architecture security risks in about 30 seconds. It is specifically designed for apps built with tools like Cursor, Windsurf, and Lovable. One free scan grades 8 dimensions, including security and domain health, with no signup required.

By running a scan, you can verify that your Claude API key isn't accidentally exposed in your production build or public environment files. If you are building a SaaS, this should be a mandatory step before every launch.

Should You Use Claude Code or MCP Servers?

In 2026, the Model Context Protocol (MCP) has changed how we handle tool integration. Instead of giving every tool a raw API key, you can use an MCP server to act as a secure bridge. This allows you to centralize your authentication and monitor exactly how your Claude API key is being utilized by different agents.

Using the SimplyScan MCP server allows your AI agent to scan your own code for security flaws as you build, catching leaked keys before they ever reach a production environment.

Final Security Checklist

Key revoked if ever seen in a public commit.
.env added to .gitignore.
API calls routed through a secure backend.
Security headers implemented to prevent XSS (which could be used to steal session tokens).
Regular scans performed with a secret scanner.

Frequently asked questions

Can I get a Claude API key for free?

Yes, Anthropic often provides a small amount of free credits to new developer accounts to test models like Claude 3.5 Sonnet. However, once these credits are exhausted, you must add a payment method to continue using the API. Beware of third-party sites claiming to offer 'unlimited' free keys, as these are often scams or credential harvesters.

How do I add my Claude API key to Cursor?

In Cursor, go to Settings > Models and enter your key under the Anthropic section. This keeps the key in your local machine's configuration. Avoid placing the key in .cursorrules or project files, as these are frequently committed to version control, which would expose your key to anyone with access to the repository.

What should I do if my Claude API key is leaked?

If your key is exposed, revoke it immediately in the Anthropic Console to prevent further unauthorized charges. After revoking, generate a new key. If the key was committed to Git, you must not only delete it but also scrub your Git history using a tool like BFG Repo-Cleaner to ensure it cannot be recovered from previous commits.

What is the difference between a Claude API key and an OAuth token?

An API key is a long-lived credential used for server-to-server communication. OAuth tokens are typically short-lived and tied to specific user permissions. For local development in Cursor or Windsurf, API keys are the standard. For large-scale enterprise integrations where you are acting on behalf of other users, OAuth is the more secure and scalable choice.

How do I hide my Claude API key in a React or Next.js app?

The safest way to use Claude in a web app is to create a backend proxy. Your frontend sends a request to your own server (like a Vercel Function or Node.js backend), and the server adds the API key before calling Anthropic. This ensures the key is never sent to the user's browser, preventing it from being stolen via 'View Source' or network inspection.

Can I set spending limits on my Claude API key?

Yes, you can set usage limits in the Anthropic Console. You can define a monthly budget and receive alerts when you reach certain percentages of that budget. This is a critical safety net; even if your key is stolen, the attacker can only spend up to your predefined limit before the key is automatically disabled.