burnkeys — zsh
~ $ burnkeys --about

Find the keys that leaked. And the ones that quietly died.

Burnkeys finds every API key in your projects, checks each one with its provider, and swaps in new keys everywhere they live. It never prints a secret. Free, open source, runs on your machine.

Get it on GitHub Install in 30 seconds
~ $
~ $ cat STORY.md

# Built the week every secret had to be rotated by hand

When our hosting provider was breached, every key we had stored there had to be replaced: Anthropic, OpenRouter, ElevenLabs, Firebase, Apple, X, and more. It took two hours of hunting for settings pages, and at one point the new Firebase key got deleted instead of the old one.

The worst part came after. On a different site, an Anthropic key had stopped working weeks earlier. Nobody had noticed, not even the AI assistant editing that code every day. Email had broken the same way, and we only found out when messages stopped arriving.

So we built the tool we wanted that night.

~ $ burnkeys --help

Usage: burnkeys <command> [path]

scan
Find every key in every .env file across your projects. Shows the provider, where each key is used, and the page where it's rotated.
verify
Ask each provider one question: does this key still work? You get ✓ or ✕, nothing else.
replace
Copy the new key from the provider's site and press Enter. Burnkeys checks it works, backs up your files, and writes it everywhere the old one lived.
push
Update the same variable on Vercel and redeploy, so the live site gets the new key too.
~ $ cat SECURITY.md

# A tool that handles your keys should never see more than it needs

- Runs on your machine. No account, no server, no telemetry.

- Talks only to the key's own provider. An Anthropic key goes to Anthropic, over HTTPS, to ask if it works. Only the status code is read.

- Never prints a secret. Keys appear as short one-way fingerprints, and every line of output is scrubbed.

- Refuses to make it worse. A new key that doesn't work is never written. Files are backed up first. Keys shared across projects get flagged.

- Zero dependencies, open source. Nothing hidden to hijack. Read every line.

~/code/shop $ claude

> here's the key, can you add it to the env? sk-ant-…

Burnkeys blocked this message: it contains a secret (Anthropic, fp:517b10ab). It was not sent.

The Burnkeys plugin for Claude Code blocks any message with an API key before it's sent. When you open a project with a dead key, it tells you, and so does Claude, in its first reply.

~ $ # install (needs Node.js 22+, no other dependencies)
git clone https://github.com/Claudewebsites/burnkeys cd burnkeys node bin/burnkeys.js scan ~/code # what keys do I have, and where? node bin/burnkeys.js verify ~/code # which ones still work? # Claude Code plugin /plugin marketplace add Claudewebsites/burnkeys /plugin install burnkeys@burnkeys
~ $ burnkeys providers

Anthropic, OpenAI, OpenRouter, ElevenLabs, Fish Audio, Resend, Stripe, PayPal, GitHub, Vercel, Cloudflare R2, Firebase, Apple APNs, X, CJdropshipping, Cloudways, and your own secrets.

Live checks: Anthropic, OpenRouter. More coming.

~ $