Leaked Anthropic Admin API Key: what to do in the first hour

• Automation scripts. A script that pulls usage reports or manages members, with the admin key written in place of an environment variable.
• Infrastructure-as-code. A Terraform or similar configuration that provisions workspaces and stores the admin key in a variable file.
• Shared dotfiles. An admin key exported in a shell profile that is later synced to a public repository.
• CI pipelines. A job that needs to read cost data, with the key printed in its logs or stored in a file artifact.
• Internal tools. A dashboard or reporting service that calls the Admin API from a browser or a publicly reachable server.

1. Revoke the admin key. Open the Admin keys area of the Claude Console, which only organization admins can reach. Find the key and delete it. Do this before you change anything else, because the key keeps working until you do.
2. Create a replacement only if an automated job depends on it. Give it a name that says what it does, store it in your secret manager, and limit the job to the access it needs.
3. Review the members. Open the organization’s member list and look for accounts you did not add, or roles that were changed. Remove anyone you cannot identify, and treat an unexpected admin as the most serious sign.
4. Review the workspaces. Check whether workspaces were created, renamed or given new settings since the exposure. Look at the spend limits too, and reset any that were loosened.
5. Review the API keys list. Look for standard API keys you did not create. Any key nobody can name an owner for should be deleted, and the others should be checked against the apps that use them.
6. Check the usage and cost views for the period since the exposure. Look for spikes, new models and traffic from unfamiliar sources. Figures can lag, so check again a few hours later.
7. Clean the repository. Remove the value from the files and look through the history for it. An old commit still contains the value after the file changes, so revocation is the real fix. See I accidentally pushed an API key to GitHub.

Not sure what else leaked? Run a free scan.

The admin keys are listed in the Claude Console under the organization settings, in the section for Admin keys. Only an organization admin can see that section. Find the key by its name and delete it. You may need to switch to the correct organization first, since each one keeps its own list. If you cannot find the key, check the other organizations you belong to, and check that the leaked value was not an ordinary API key, which lives in a different list. The exact menu labels can change, so if the page differs from this description, follow the Console’s own guidance for admin keys.

The rule is called “Anthropic Admin API Key”. It looks for the exact prefix sk-ant-admin01-, then exactly 93 letters, digits, underscores or hyphens, then the literal suffix AA, with word boundaries at both ends. Standard keys with the api03- prefix do not match this rule and are handled by the general Anthropic rule. The severity is critical, with the impact class for infrastructure and cloud access, because the reach is the whole organization. This type is not checked live: LeakWatch does not send any request to Anthropic with the admin key it finds, so the status it shows is based only on the pattern.