Revoking a Compromised Key While Claude Code Is Mid-Run: Draining, Swapping and Resuming

Introduction

If you suspect your API key has been compromised while Claude Code is in the middle of a long-running task, you need a plan that avoids losing progress and prevents further unauthorized use. This guide walks you through the operational sequence: detect, drain, swap, and resume.

1. Detect and Confirm the Compromise

First, confirm that the key is actually compromised. Signs include:

• Unexpected API usage or charges in your dashboard.
• Requests from unfamiliar IPs or user agents (if logs are available).
• Leaked key in a public repository or shared document.

Once confirmed, act quickly but methodically.

2. Understand the Risks of Immediate Revocation

Revoking a key immediately will cause any in-flight requests to fail. For Claude Code, which may be in the middle of generating a response or executing a multi-step plan, this could mean lost work and a corrupted session state. Instead, follow a draining approach: let existing requests complete while preventing new ones from using the compromised key.

3. Drain In-Flight Requests

Draining means allowing active requests to finish before disabling the key. How you drain depends on your setup:

• If you control the client: Modify your application to stop sending new requests with the compromised key, but let ongoing requests complete. For Claude Code, you might pause new task initiations while allowing the current one to finish.
• Use our aggregator's key management: Our platform allows you to disable a key for new requests while keeping it active for a grace period. Check the dashboard for a "drain" or "deactivate after current requests" option. If unavailable, you can manually monitor and revoke after the session ends.

Monitor the session until it reaches a safe stopping point (e.g., completes the current code generation or reaches a checkpoint).

4. Swap in a New Key

Once the in-flight requests have completed, revoke the compromised key and generate a new one. With our aggregator:

• Go to the API key management section.
• Revoke the compromised key.
• Create a new key with the same permissions (or stricter, if needed).
• Update your environment variables or configuration to use the new key.

If Claude Code supports hot-reloading of credentials, apply the new key without restarting the session. Otherwise, you may need to restart Claude Code, but ensure you've saved any progress.

5. Resume the Session

After swapping keys, resume the Claude Code session. If the session was interrupted, you can often continue from the last checkpoint or replay the context. Our aggregator's API is stateless, so as long as you provide the same conversation history, the new key will work seamlessly.

6. Verify and Monitor

• Confirm that the new key works by sending a test request.
• Monitor usage for any signs of unauthorized activity with the old key (it should be revoked and inactive).
• Review your key management practices to prevent future compromises.

Best Practices for Key Rotation

• Use short-lived keys where possible.
• Implement key rotation policies.
• Store keys securely (e.g., environment variables, secrets managers).
• Enable logging and alerts for unusual usage.

Conclusion

Rotating a compromised key mid-run requires careful coordination to avoid disrupting active sessions. By draining requests, swapping keys, and resuming, you can maintain productivity while securing your account. Our aggregator provides the tools to manage keys efficiently, so you can focus on coding.