Find the keys that leaked. And the ones that quietly died.

# Built the week every secret had to be rotated by hand

When our hosting provider was breached, every key we had stored there had to be replaced: Anthropic, OpenRouter, ElevenLabs, Firebase, Apple, X, and more. It took two hours of hunting for settings pages, and at one point the new Firebase key got deleted instead of the old one.

The worst part came after. On a different site, an Anthropic key had stopped working weeks earlier. Nobody had noticed, not even the AI assistant editing that code every day. Email had broken the same way, and we only found out when messages stopped arriving.

So we built the tool we wanted that night.

Usage: burnkeys <command> [path]

scan

Find every key in every .env file across your projects. Shows the provider, where each key is used, and the page where it's rotated.

verify

Ask each provider one question: does this key still work? You get ✓ or ✕, nothing else.

replace

Copy the new key from the provider's site and press Enter. Burnkeys checks it works, backs up your files, and writes it everywhere the old one lived.

push

Update the same variable on Vercel and redeploy, so the live site gets the new key too.

mcp

Let Cursor, Codex or Claude Desktop ask which keys work, are dead or leaked. They see statuses, never a key.

# Every way a key goes wrong, watched

- It died. Revoked, expired or deleted. Burnkeys asks the provider directly.

- It leaked into git. Every commit of every project is searched, even keys deleted later. Public repositories come first.

- Your platform got breached. When a service like Railway reports a breach, you see which keys were likely stored there (keys in projects deployed on it, added before the breach).

- One key, many projects. Each shared key is listed with every project that uses it.

- It comes in parts. X needs three keys, PayPal two, Apple a .p8 file, Firebase a JSON file. Burnkeys collects every part and writes them together.

- Checked while you sleep. [Pro] Background checks even when Burnkeys is closed, and an email when something needs fixing.

Starting something new? Pick the services it needs and a folder, and the project starts with a .env that already has every key, ignored by git. Open it in Claude Code with one click and build without stopping to hunt for keys.

# A tool that handles your keys should never see more than it needs

- Runs on your machine. Your keys never leave your Mac. The optional account holds only your email and plan.

- Talks only to the key's own provider. An Anthropic key goes to Anthropic, over HTTPS, to ask if it works. Only the status code is read.

- Never prints a secret. Keys appear as short one-way fingerprints, and every line of output is scrubbed.

- Refuses to make it worse. A new key that doesn't work is never written. Files are backed up first. Keys shared across projects get flagged.

- Saved in your Keychain. New keys go to the macOS Keychain. The app and CLI use no third-party packages and send no telemetry.

> here's the key, can you add it to the env? sk-ant-…

The Burnkeys plugin for Claude Code installs from the app in one click. It blocks any message with an API key before it's sent. When you open a project with a dead key, it tells you, and so does Claude, in its first reply.

Download Burnkeys for Mac: one window, every project, every key. Apple silicon or Intel, macOS 13.5+. Signed by the developer and notarized by Apple.

Terminal only? brew install claudewebsites/burnkeys/burnkeys

Windows is next. Follow @burnkeys_ on X to hear first.

Anthropic, OpenAI, OpenRouter, ElevenLabs, Fish Audio, Resend, Stripe, PayPal, GitHub, Vercel, Cloudflare R2, Firebase, Apple APNs, X, CJdropshipping, Cloudways, and your own secrets.

Live checks: Anthropic, OpenAI, OpenRouter, Stripe, Clerk, Resend, ElevenLabs, Fish Audio, GitHub, Vercel, Firebase, PayPal. More coming.