Giving an AI agent your API keys

Do not reuse your personal key. OpenAI states "The sharing of API keys is against the Terms of Use" (7), and a separate key per agent means you can revoke one without breaking everything else. OpenAI keys can be "Restricted: Choose scopes for specific resources or endpoints" (8); an Anthropic key covers "Either a single workspace or the workspaces where your role allows API use" (9), so a workspace per agent is the way to narrow it. Google Cloud's advice is the same: restrictions limit "the impact of a compromised API key" (10).

Give keys an end date. OpenAI "strongly recommend[s] creating keys with an expiration date and establishing a regular key rotation process" (11). Where the agent runs on a cloud platform that supports it, workload identity federation replaces stored keys with short-lived tokens, so "There are no static secrets to mint, store in CI, rotate, or leak" (12)(13).

A leaked model key is mostly a money problem. OpenAI recommends you "Set monthly spend limits for your organization or projects, and enable hard enforcement" (14), and adds that "Spend alerts alone don't stop API traffic" (3). Anthropic lets you "Cap monthly spending for a workspace" (15), with one catch: "You cannot set spend limits on the Default Workspace" (16), so put the agent's key in a workspace of its own.

The same applies to the machine. Some sandbox providers can stop a runaway agent at a fixed amount; the Hard spending cap page lists which.

The strongest pattern is a proxy that holds the key: "Programs receive a placeholder; the proxy substitutes the real value for allowed destinations" (4), which is how Codex cloud environments handle network secrets. Claude Code can do something similar for credentials it masks: "The command and anything it logs never hold the real credential, but its requests still authenticate" (17). It can also "strip credentials from the environments of the subprocesses Claude Code starts" (18), which "reduces what a prompt injection attack can read" (19), though "The Claude Code process keeps the credentials for its own API calls" (20).

Store the real keys properly: Anthropic says to "Store API keys in a secrets manager, rotate them periodically, and disable or delete any key you suspect has leaked" (21), and OpenAI says "Never commit your key to your repository" (22). If you build MCP servers, the MCP spec calls forwarding a client's token to another API "an anti-pattern" (23).

On a hosted machine, the provider decides how much of this you get. The table below shows which providers can store secrets, hide them from the agent, and issue limited keys.