# Can you paste an API key or client data into Claude Code? Where secrets go instead

- URL: https://www.agentskillpacks.com/guides/keep-api-keys-and-client-data-out-of-ai
- Updated: 2026-10-21
- Book: Claude Code for Non-Programmers by İsmail Günaydın (https://www.agentskillpacks.com/books/claude-code-for-non-programmers)

## Short answer

Don't paste keys, passwords or client details into Claude Code. Claude Code saves every session as a plain text file on your computer, kept 30 days by default, and a key in a memory note gets read back into later sessions. Give Claude the name of a secret, never its value. Keys go in an environment variable, a git-ignored .env file or a sign-in through /mcp. Lock secret files with deny rules like Read(./.env). Client records stay in a folder outside the ones Claude works in. If a key leaks, change it the same day.

**Where each kind of secret goes when you work with Claude Code, from the book's safety chapters**

| What it is | Never put it in | Where it goes instead |
| --- | --- | --- |
| API keys and tokens | A prompt, CLAUDE.md, memory notes or a skill | A sign-in through /mcp, an environment variable or a git-ignored .env file |
| Your own passwords | Notes files, spreadsheets or memory notes | A password manager |
| Client records like tax files or bank details | Prompts, unless the job truly needs it, or GitHub | A folder outside Claude's working folders, with deny rules and an encrypted backup |
| The .env file itself | Git, or a folder Claude may read | Your ignore list, plus Read(./.env) in the deny list |
| A key that already leaked | Your to-do list for later | Revoked and replaced the same day |

## How to use the secrets table

Claude should know a secret's name, never its value. The table is that one idea, sorted by the kind of secret.

The left column is the thing. The middle column is every place people put it by accident. The right column is the safe home. Keys can be replaced in five minutes. A client's tax ID can't, because there is nothing to revoke. That is why client records get the strictest row.

The deny rules in the table are the lock. The [permissions page](https://code.claude.com/docs/en/permissions) shows the syntax, and the [security page](https://code.claude.com/docs/en/security) explains the guards Claude Code adds around them.

Know the gaps, too. A read deny rule covers Claude's own file tools and common commands that name a file. It doesn't cover a command that searches a whole folder. Deny rules stop accidents. They are not a vault. The stronger guard is keeping secrets out of the folders Claude works in at all.

## The key on your clipboard

The new email tool won't connect. The setup page gave you a long string of letters and numbers and called it an API key. Claude Code is open in the other window.

You copy the key. Your cursor sits in the prompt box.

_It's my own computer. What's the harm?_

Think of a treehouse password said out loud in class. Everyone heard it. The kid taking notes wrote it down with the date. The only fix is to change the password. A pasted key works the same way. It isn't said once and gone. It gets written down in the session file.

## Already pasted a key? Do this today

Most people searching this have already done it. That is fixable. Work in this order, because the first step is the only one that actually closes the leak.

1. **Revoke the old key at the service** and create a new one.
2. **Put the new one in the right place:** an environment variable or a git-ignored file. Never back where the old one leaked.
3. **Confirm the old key is dead.** Try it once, or check the service's key list.
4. **Clean up the copies.** The pasted key sits in the session transcript under the `projects` folder in your home `.claude` folder. The [sessions page](https://code.claude.com/docs/en/sessions) says you can delete a project's transcripts sooner than the 30-day sweep with `claude purge`. If you said "remember this" near the key, ask Claude to list its memory notes and remove any line that holds it.
5. **Write down the date** you did it.

Step 4 is tidying. Steps 1 to 3 are the fix. A deleted copy does not take the key back from anything that already read it.

## Check your plan's training setting

The other half of the question is what happens on Anthropic's side. The book's advice is to check this today, not later. On Free, Pro and Max plans, the data-usage page says your data, including Claude Code sessions, is used to train new models when the model-improvement setting is on. Team, Enterprise and API accounts are not used for training unless the customer opts in.

You can see and change the setting at claude.ai/settings/data-privacy-controls. If you handle client records, set it the way your clients would expect, and write down the date you checked. These terms change, so read the current page rather than trusting any summary, this one included.

## The secrets I found in my own folders

In September 2026, an audit by my assistant found a real-looking access token in two of my website projects. It wasn't in a .env file. It was in a config file for a code editor's connector, the kind of file nobody thinks of as secret. In one project it had been there since the very first commit.

In July 2026, an audit of another site found a credentials file sitting in the public website folder, and a sign-in secret pasted into a documentation file.

Deleting the file and scrubbing the history feel like the fix. They aren't. Anyone who saw the secret can still use it. A rotation that waits on a to-do list is a leak that is still open.

So I decided once. On July 13, 2026, I wrote one ignore policy for every project instead of choosing project by project. Environment files never go in. Token files never go in. If you hold client records, that folder goes on the list on day one.

## The chapters that lock the drawer

This is the problem [Claude Code for Non-Programmers](/books/claude-code-for-non-programmers) was written for. The book is independent and is not affiliated with Anthropic.

**Safety and Failure** opens with secrets: a search that finds them without printing them, the deny rules, a starter ignore file, a pre-share checklist and a separate checklist for client data. It also covers prompt injection, when a page Claude reads tries to give it orders.

**Permissions and Modes** explains why a deny rule wins in every mode.

**Connecting the World** shows how to connect other apps with a sign-in instead of a pasted key.

## Where this is in the book

- Safety and Failure
- Permissions and Modes
- Connecting the World

Kindle: https://www.amazon.com/dp/B0HN6WSTMG
Paperback: https://www.amazon.com/dp/B0HNKT2XHV

Links go to Amazon. I wrote this book and earn a royalty on every sale.

This book is independent and is not affiliated with or endorsed by Anthropic.

## Is the book for you?

- Yes, if A setup page just handed you an API key and Claude Code is open in the other window
- Yes, if You keep client records like tax files, ID numbers or bank details
- Yes, if You think you might already have pasted a key somewhere
- Skip it if You want legal advice on your profession's data rules; check those first
- Skip it if You need a security audit of a large company

## FAQ

### Does Claude Code save what I type?

Yes. Every session is saved as a plain text file in the projects folder inside your home .claude folder. Transcripts older than the cleanupPeriodDays setting are deleted, 30 days by default. That is a tidy-up, not a security feature.

### How do I stop Claude Code from reading my .env file?

Add a deny rule. Put Read(./.env) and Read(./secrets/**) in the deny list in ~/.claude/settings.json, then start a fresh session and ask it to read your .env file. It should refuse.

### How can Claude use an API key without seeing it?

Tell it the name, not the value. Say the key is in an environment variable called YOUR_API_KEY, and ask it to write the script so it reads the key from there, never prints it, never writes it to a file and never asks you to paste it.

### Does Anthropic train on my Claude Code sessions?

It depends on your plan and setting. The data-usage page says Free, Pro and Max data, including Claude Code sessions, is used for training when the model-improvement setting is on, with five-year retention, or 30 days with it off. Team, Enterprise and API plans are not trained on unless the customer opts in. These terms change, so check the page.

### What do I do if I leaked an API key?

Change it the same day. Revoke the old key at the service, make a new one, put it in an environment variable or a git-ignored file, check that the old one is dead, and write down the date. Deleting the file is not the fix, because anyone who saw the key can still use it.

### Where do I change whether Anthropic trains on my Claude Code sessions?

On a Free, Pro or Max plan, open claude.ai/settings/data-privacy-controls and look at the model-improvement setting. The book says data, including Claude Code sessions, is used for training when it is on. Team, Enterprise and API accounts are not trained on unless the customer opts in. Check the current page, since terms change.