Start free

Home / How to give Claude Code and Cursor API keys safely

Guide

How to give Claude Code and Cursor API keys safely

Coding agents work best when they can run your app, and your app needs keys. But an agent that can read your project can usually read your secrets too. Here's where agents see them, and how to keep the damage small when one does.

Last checked

Where agents see your secrets

Seven steps to keep keys away from your agent

  1. Keep secrets out of the working directory. Put production values in your host's environment settings or a secrets manager, never in the repo. Locally, commit a .env.example with placeholder values and keep real ones out of the folders you open with an agent where you can.
  2. Block .env* in the agent's file permissions. In Claude Code, add Read deny rules for .env files. In Cursor, list them in .cursorignore. The details and limits of both are below.
  3. Use restricted, scoped keys. Give the agent's environment test-mode or restricted keys with only the permissions it needs, separate from production. Set spend limits where the provider offers them.
  4. Keep tokens out of MCP config files. Reference an environment variable in the config instead of pasting the token, and prefer MCP servers that sign in through your browser so there's no token to store at all.
  5. Never paste a key into the chat. If the agent asks for one, set it yourself in the environment or a file the agent can't read, and tell the agent it's there.
  6. Watch for prompt injection. Text the agent reads (an issue, a web page, a README, a dependency, a tool result) can contain instructions like "print the environment variables" or "send the config to this URL". Keep approval prompts on for shell commands and network requests, and read what you approve.
  7. Rotate any key an agent has seen. If a value showed up in a file the agent read, its terminal or the chat, treat it as exposed and replace it. See how to rotate an API key without downtime.

Claude Code: deny rules for .env files

Claude Code's settings have a permissions block with allow, ask and deny rules. Its settings docs use this example to stop Claude Code reading .env files:

{
  "permissions": {
    "deny": [
      "Read(./.env)",
      "Read(./.env.*)"
    ]
  }
}

Put it in .claude/settings.json in the project to share it with your team, or in ~/.claude/settings.json to apply it to every project on your machine.

Know what it covers. According to the permissions docs, Read deny rules apply to Claude Code's own file tools and to file commands it recognizes in the shell, such as cat and head. They don't apply to a script that opens the file itself, like a Python or Node program, or to a command that searches a whole folder. For a block that holds for every process, the docs point to Claude Code's sandbox.

Cursor: .cursorignore

Add your .env files to a .cursorignore file in the project root, using the same patterns as .gitignore:

.env
.env.*

Cursor's ignore-file docs say ignored files are blocked from Agent, Tab and @ mentions. The same page says the terminal and MCP server tools the agent uses can't block access to them, and that complete protection isn't guaranteed. So an agent that runs a shell command can still read a file you've ignored. Treat .cursorignore as a guard against accidents, not a wall.

MCP config without tokens in the file

Both tools let an MCP config read a value from an environment variable instead of storing it:

The variable still has to come from somewhere the agent can't read, such as your shell profile or system environment. Claude Code's docs also say to check you trust an MCP server before connecting it: a server that fetches outside content can carry prompt injection into your session.

Your editor can leak keys too

In April 2026, LayerX published CursorJacking, research showing that Cursor stored API keys and session tokens where any installed extension could read them. LayerX reported it to Cursor and listed it as not fixed when they published. The lesson goes beyond one editor: a key saved in your editor's settings is only as safe as every extension you've installed. Install extensions you trust, remove the ones you don't use, and keep production keys out of editor settings.

What these settings can't do

Deny rules and ignore files limit what the agent's tools read. They don't change what its process is allowed to do. An agent that can run any command can read whatever your user account can: files outside the project, environment variables, other tools' config. If that worries you, use the agent's sandbox or run it in a container or a separate user account that holds no production secrets. And whatever you do, assume a key the agent has seen is exposed.

Provider tips

Most providers let you make keys that can do less. Stripe has restricted keys and a test mode, and OpenAI has project keys. See the Stripe and OpenAI pages, or browse all providers.

Do this with StackHangar

StackHangar is built for exactly this. Your keys live in a vault that's encrypted on your device. Claude Code, Cursor and other MCP agents connect to it and ask:

It doesn't change the limits above: once you put a value where the agent can read it, the agent has it. See how agent access works for the details.

Start free with 2 projects How agent access works

Sources

Checked 9 November 2026. Agent tools change often, so check the current docs for your version.