# Set ANTHROPIC_API_KEY in a project .env, add .env to .gitignore
Best practice: never commit API keys to Git
API keys in Git history are a serious security risk — even deleted keys can be found in history. Use a .env file, add it to .gitignore, and load with dotenv. For CI/CD, use GitHub Secrets or your platform's secret management.
Looking for more? Search all 7,657 commands — works offline, in English or Spanish, and fixes typos.