I Gave Claude Code a Static API Key. Then I Took It Back.
I got Claude Code talking to my self-hosted gateway in about fifteen minutes. Mint a scoped API key, export ANTHROPIC_BASE_URL and ANTHROPIC_AUTH_TOKEN, done. It worked immediately, which should have been my first warning — security problems that work immediately are the ones that stick around. The key I minted was budget-capped and scoped to a few models, not the master key to the kingdom. Bounded risk, technically. But it lived in plaintext in ~/.claude/settings.json, which meant anyone who could read a file on my machine — a compromised dependency, a misconfigured backup, a cat fat-fingered into the wrong Slack channel — now had a usable credential for as long as I forgot to revoke it. I noted the risk, decided it was acceptable for now, and moved on with my life, the way you do with a smoke detector that’s beeping every ninety seconds and you just haven’t gotten around to the battery yet. ...