Short answer: if you accidentally pasted an API key into ChatGPT, Claude, or a coding agent, rotate the key now. Create a replacement, move your apps to it, and revoke the old one. Deleting the chat is worth doing afterwards, but it does not make the old key safe again. Rotation is the only step that does.
What should I do first?
Rotate the key. Everything else on this page is cleanup.
A key you pasted into a chat now sits on the provider's servers, in your chat history on every signed-in device, and for coding agents in a transcript file on disk. You can't recall those copies. You can make them worthless.
- Create a new key in the dashboard of the service that issued it. Scope it as tightly as the service allows.
- Update whatever uses the key. Deployed apps, CI secrets, your local
.env. - Revoke the old key. Check that it fails.
# Example for an OpenAI key. A revoked key should fail with an authentication error.
curl -s -o /dev/null -w '%{http_code}\n' https://api.openai.com/v1/models \
-H "Authorization: Bearer $OLD_KEY"
If nothing in production uses the key, skip straight to step 3. For a password, change it and sign out other sessions if the service offers that.
Both vendors say this about their own keys. Anthropic's API key guidance says "If you suspect that your API key may be compromised, we recommend revoking the key immediately." OpenAI's key safety article describes the same order: create a replacement, update your applications, then revoke the old key once the new one works.
Do I need to rotate a key an AI tool has seen?
Yes, if the key can spend money, read data, or change anything.
We are not saying the vendor will misuse it, or that a model will repeat your key to someone else. We have no evidence for either and won't claim it. The practical risks are duller. A shared chat link. A screenshot in a bug report. A teammate on the same workspace. A laptop with the transcript still on disk. Rotation removes all of them at once, and it takes a few minutes.
The one case where you can relax is a key that was already dead or only ever worked against a local test service.
Does deleting the chat remove the key?
It removes it from your history right away. It does not remove every copy right away. These are the vendors' own statements, read on 2026-09-30.
| Tool | What the vendor says about deletion | Source |
|---|---|---|
| ChatGPT | Removed from your account view immediately. Scheduled for permanent deletion within 30 days, unless it was already de-identified and disassociated from your account or OpenAI must retain it longer for security or legal obligations | OpenAI Help Center |
| Claude (Free, Pro, Max) | Removed from your chat history immediately. Deleted from back-end storage within 30 days. Chats flagged for usage policy violations are kept longer, and law or disputes can require retention | Anthropic Privacy Center |
| Claude Code | Session transcripts are stored locally in plaintext under ~/.claude/projects/ for 30 days by default. The cleanupPeriodDays setting changes that |
Claude Code docs |
Two details from those pages matter here. OpenAI notes that archiving a chat does not delete it. Anthropic says a chat you delete "will not be used to train future models", though data already in a training run stays there.
Work and enterprise plans follow the retention policy your organization set, so ask your admin. For other assistants and agents, read the vendor's data retention page. We haven't read those, so we won't summarize them.
Delete the chat anyway. It keeps the key out of search, exports, and shared links. Do it after you rotate, not instead.
How do I check whether someone used the key?
Look at the issuing service's usage and logs for the window between the paste and the revocation.
- Usage and billing. Requests at odd hours, models or endpoints you don't call, a jump in spend.
- Audit logs, if the service has them. Look for keys, users, or webhooks created with the leaked key.
- Downstream resources. A leaked cloud key can create other credentials. Rotating the first key does not remove those.
Anthropic recommends reviewing logs and usage for your keys in the Console. OpenAI recommends monthly spend limits with hard enforcement, which caps what a leaked key can cost.
The checklist
- New key created, old key revoked, revocation tested
- Apps, CI secrets, and local
.envfiles updated - Usage and logs reviewed for the exposure window
- Chat deleted, and any shared link to it removed
- For coding agents, the local transcript deleted if you don't need the session
- Tickets, docs, commits, and screenshots checked for the same key
How do I stop pasting keys into chats?
Most pastes happen for one of two reasons. You wanted help with a file that had a key in it, or an agent needed a credential to do its job.
For the first, redact before you paste. Replace the value with sk-REDACTED and the question still works.
For the second, hand over a link in place of the value. This is what we built Evergist for. It would not have stopped today's paste, and it does nothing for a key already in a chat. It replaces the step where a credential has to travel from one person or agent to another.
Person to agent. Create a one-view note in the browser at evergist.com and give the agent the link with an instruction like this:
npx -y evergist read "https://evergist.com/g/<id>#<key>" > .env.local
The value goes from the note into a file. The CLI decrypts on the agent's machine and the redirect keeps the text out of the tool output. The link stays in the transcript, but the note was deleted on that first read, so the link opens nothing.
Be clear about the limit. The agent can still read .env.local, and if it prints the file, the key is back in the transcript. A one-view link keeps the handoff out of chat history. It does not hide the secret from the agent that uses it. Giving Claude Code an API key safely covers that setup in full.
Agent or script to person. When an agent generates a credential, have it create the note and print only the link:
printf '%s' "$NEW_KEY" | npx -y evergist create --views 1 --expires 1h --json
The agent guide has the MCP server and skill file for this, and sharing secrets from the terminal has more CLI patterns. For the general case, see how AI agents can share secrets.
Evergist is not a vault. Notes hold text up to 512 KiB and last 30 days at most. Keys that apps read at runtime belong in environment variables or a secrets manager. When the recipient is a person outside your team, see how to share sensitive information securely with a client or contractor.
Questions
Is it safe to paste an API key into ChatGPT?
No. Treat it like pasting the key into any other hosted service. The chat stays saved to your account until you delete it. If the assistant only needs the shape of your config, redact the value first.
I pasted a password into Claude. What do I do?
Change the password at the service it belongs to, then delete the conversation. Anthropic says a deleted conversation leaves your history immediately and its back-end storage within 30 days. If you reuse that password anywhere else, change it there too.
Does redirecting the read to a file keep the key out of the transcript?
Yes, until the agent reads or prints the file. Redirecting evergist read to a file keeps the value out of the tool output. An agent that later runs cat .env.local puts it in the transcript. Tell the agent not to print the file, and rotate keys on a schedule either way.