LLLanyard

Guides

Keep API keys out of Claude Code

Claude Code reads your project, runs commands and keeps a long conversation history. Any API key it can see, in a .env file, a shell variable or a script, can end up in its context, in a log or in a commit. The safest key is one Claude Code never holds.

If Claude Code uses an Anthropic API key

Store the real key in your OS keychain and give Claude Code a placeholder token instead. The token only works through LLLanyard's proxy on your own machine, which swaps in the real key on the way to Anthropic.

lllanyard add anthropic                                   # hidden prompt
lllanyard agent create claude-code --providers anthropic  # prints a placeholder token once
lllanyard start                                           # proxy on 127.0.0.1:3000

Then, in the shell you start Claude Code from:

export ANTHROPIC_BASE_URL=http://127.0.0.1:3000/anthropic
export ANTHROPIC_API_KEY=lly_…        # the placeholder token, not your key

If ANTHROPIC_AUTH_TOKEN is also set, unset it, as it can take precedence. If the placeholder leaks, it's useless anywhere else, and you can revoke it with lllanyard agent revoke claude-code. Rate limits and a kill switch stop a runaway loop.

If you sign in to Claude Code with a subscription

There's no API call to proxy, but Claude Code still runs your scripts, and those scripts need keys. Tell it to run them through LLLanyard rather than reading .env files:

lllanyard setup claude-code

This adds a short, marked section to ~/.claude/CLAUDE.md. From then on Claude Code runs scripts as lllanyard exec ./deploy.sh. LLLanyard reads the script, passes only the keys it uses for that one run, and redacts them from anything it prints, so they never reach the conversation.

Keys your scripts already use

Give each stored key the variable name your scripts expect, once:

lllanyard add openai --env-name OPENAI_API_KEY

Scripts keep reading OPENAI_API_KEY as before. The key just isn't in a file any more.

What this doesn't cover

A process running as your user can still ask the OS keychain directly. If you run agents you don't trust, run the proxy under another user or on another machine. The security model explains the limits.

More guides