Security Disclosure Recommendation: Check for Unexpected Anthropic Usage

This guide is part of Railway's response to the security disclosure published on October 21, 2026.

If you use Claude with Railway, revoke any API key that may have been exposed, review the Console usage and logs for requests you didn't make, and redeploy your services with a new key.

If you have a Claude API key that may have been exposed, or your bill or rate limit consumption rose without a matching change in your traffic, check your Anthropic usage. Anthropic's guidance is to revoke the key immediately, then review the Usage and Logs pages in the Claude Console.

This guide applies the guidelines from Anthropic's What should I do if I suspect my API key has been compromised? and API key best practices, extended to include Railway-specific operations.

Revoke the key #

Deleting a key in the Console takes effect immediately. Create the replacement in the same place. Your Railway services can't reach Anthropic until you deploy the replacement key in the next section.

1. Open the API keys page in the Claude Console and confirm you're in the right workspace.
2. Click the menu next to the exposed key and select Delete API key .
3. Click Create key to generate a replacement, scoped to the same workspace. Copy it now. The Console doesn't show it again.
4. If an Admin API key (sk-ant-admin01-... ) may also have been exposed, delete it on theAdmin keys page.

GitHub's secret scanning reports exposed Claude keys to Anthropic, which deactivates them and emails you. If you received that email, the key is already deactivated, but you still need to deploy a replacement key on Railway and review usage.

Update the key on Railway #

On Railway, your Claude API key is a variable, so updating it means editing the variable and redeploying.

1. Open the service that uses the key and click Variables . If the key is ashared variable , edit it once inProject Settings and every service that references it gets the new value when you deploy.
2. Set the variable to the new key, then deploy the staged change .
3. Confirm the new deployment is active and its logs show successful requests to Anthropic.

Review for misuse #

The Console shows usage per key and per workspace, and the Logs page shows individual requests.

1. Open Usage and group by API key. Compare the exposed key's token volume and model mix against your normal traffic. If a key you only use with one model suddenly shows another, that's a strong signal.
2. Open Cost to see the spend attributed to the key and workspace during the exposure window.
3. Open Logs , filter to the exposed key, and look for request patterns, timings, and error rates that don't match your application.
4. Optional: pull the same data programmatically with the Usage and Cost Admin API , filtering byapi_key_ids[] . This needs an Admin API key and works for organizations, not individual accounts.

curl "https://api.anthropic.com/v1/organizations/usage_report/messages?\
starting_at=2026-10-14T00:00:00Z&\
ending_at=2026-10-21T00:00:00Z&\
api_key_ids[]=apikey_01Rj2N8SVvo6BePZj99NhmiT&\
bucket_width=1d" \
  -H "anthropic-version: 2023-06-01" \
  -H "x-api-key: $ANTHROPIC_ADMIN_KEY"

5. Review Members and workspace membership for people you didn't invite.
6. If you find usage you didn't generate, save the usage and cost data you found and contact Anthropic support .

If you have any other questions, contact Railway support at support@railway.com.