Keep Your Relay API Key Out of Git: A 5-Minute Checklist

Your relay API key is a password. If it ends up in a public GitHub repo, anyone can spend your credit. Here's a short checklist to keep it out.

Claude Code: put it in your user settings

Don't write the key into a file inside a project. Put it in your user-level file, ~/.claude/settings.json, which lives in your home folder and not in any repo:

{
  "env": {
    "ANTHROPIC_BASE_URL": "https://<relay base url>",
    "ANTHROPIC_AUTH_TOKEN": "<your key>"
  }
}

{
  "env": {
    "ANTHROPIC_BASE_URL": "https://<relay base url>",
    "ANTHROPIC_AUTH_TOKEN": "<your key>"
  }
}

Or export both variables in your shell profile. Either way, the key stays out of your project folders.

Codex: point at a variable name

In ~/.codex/config.toml, use env_key = "RELAY_API_KEY". That stores only the variable's name. The key itself lives in your environment, so the config file is safe to look at or share.

Before every commit

1. Run git status and read the file list. Anything named .env, settings.json or config.toml deserves a second look.
2. Add .env to .gitignore.
3. Search your changes for the key: git diff --staged | grep -i "token\|key".

If a key already leaked

Treat it as gone. Sign in to the relay, create a new key if the site allows it, and stop using the old one. If the site has no key reset, change your password there and check the balance for anything you didn't spend.

One more rule

A relay sees every prompt and file you send. Keep company code and customer data out of it, whatever you do with the key.

Need a key to start with? Tested relays with free sign-up credit are listed at jliushi.github.io/ai-relay.