Anthropic API key hygiene: server-side only, one key per environment, rotate on any exposure

TL;DR

Use separate keys per environment (development, staging, production). Every browser-callable path must go through your own backend endpoint instead.

Steps

1. The API key lives on the server: in your host's secret store, injected as an environment variable at deploy time, passed to the SDK client constructor. It never appears in frontend bundles, mobile apps, or client components.
2. The TypeScript SDK supports browser runtimes, which makes it easy to accidentally call the API from frontend code with the key attached. Do not. Every browser-callable path must go through your own backend endpoint instead.
3. In Next.js, the key must not use a public-prefixed variable name; public-prefixed variables are inlined into client JavaScript at build time.
4. Use separate keys per environment (development, staging, production). A leaked dev key then has a bounded blast radius, and rotation does not require touching production.
5. If a key is ever committed, pasted into a chat, or shipped to a client, treat it as compromised: rotate it immediately in the Anthropic Console and update the secret store. There is no "probably fine" for an exposed key.
6. Monitor usage per key. An unexpected spend spike is often the first signal that a key escaped its intended environment.
7. Failure modes this prevents: keys inlined into client bundles via public env vars; one shared key across all environments; slow rotation after an accidental commit.

When to use

You are seeing this: The API key lives on the server: in your host's secret store, injected as an environment variable at deploy time, passed to the SDK client constructor. Use this skill when you run into "Anthropic API key hygiene: server-side only, one key per environment, rotate on any exposure".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

The client-SDK docs list TypeScript support including browser runtimes, which is why the server-side-only rule needs stating explicitly. Verified live at https://docs.anthropic.com/en/api/client-sdks.