9 min · +140 XP
API keys: what, where, how
Get a key, keep it in .env, and know what to do if it leaks.
By the end of this lesson
You will have a working Telegram bot key stored in a .env file that Git ignores.
When your tool orders from a service's menu, the service wants to know who is ordering: to count your use, apply your limits and bill you if the service is paid. So it gives you a key, a long string of letters and digits. Anyone who holds it is treated as you.
Where a key comes from
- 1Sign in to the service's website with your normal account.
- 2Find the section called API, Developers or Integrations. It is usually in Settings or in the menu under your name.
- 3Click the button to create a key (Create key, New token or similar).
- 4Copy the long string it shows. Some services show it only once, so keep the page open until the key is saved.
Where to keep it
The usual place is a file called .env in the project folder. Your tool reads the key from there, so it does not appear in the code. The file name .env must also be written in .gitignore, so that Git never saves it and it never reaches GitHub.
TELEGRAM_BOT_TOKEN=paste-your-token-here
WEATHER_API_KEY=paste-your-key-here“My tool will use a Telegram bot token. Create a .env file with a placeholder for it, add .env to .gitignore, and make the code read the token from .env. I will paste the token into the file myself, so open .env for me in a text editor.”
Claude prepares both files and opens .env. Replace the placeholder with your token, keep no spaces around =, and save. The token never goes into the chat.
›If you cannot find .env
Files whose names start with a dot are hidden in Finder and often in Explorer. You do not have to look for it: say "open .env in a text editor", and Claude opens it for you. Paste the key after =, with no spaces around it, and save the file.
Where a key must never be
- 1In the code itself, even "just for a test".
- 2In screenshots, screen recordings or videos.
- 3In messages and chats, including support chats and forums.
- 4On GitHub, even in a private repository.
Go to the service's site, delete (revoke) the key and create a new one; the old key stops working at once. Then put the new key into .env. If the key was ever pushed to GitHub, removing it in a later commit is not enough, because it stays in the history; revoking it is the only real fix.
“My key for [service] has leaked. Tell me step by step how to revoke it on the service's site and create a new one. Then open .env so I can paste the new key, and check that the tool works with it.”
Revoking happens on the service's site and is your step; Claude guides you and handles the rest.
Try it: a Telegram bot key
Your first key, in a few minutes (free)
0/6A budget tracker, a habit list or a game for children works without any keys. Keys appear only when your tool reaches out to another service. Before you connect a paid service to anything that runs often, ask Claude whether the free tier covers it.
Create a separate key per project with the narrowest permissions and a spending cap where the service offers one, so a leak is cheap and easy to revoke. Add a deny rule such as Read(./.env) in /permissions if Claude never needs to see the values. On a server, put secrets in environment variables or the platform's secret store, not in the repository. Turn on GitHub secret scanning and push protection for your repositories.
A safe practice terminal. You have a Telegram bot token and want your tool to send you messages.
1Ask Claude in your own words to prepare a .env file for the token (don't paste the token!)
You pushed your project to a public GitHub repository and then noticed the key in the code. You removed it in the next commit. Is the problem solved?
Facts checked against the official Claude Code docs October 24, 2026 · source
Author
Evgenii Arsentev
PhD · Chief Executive Officer, digital health