Security Disclosure Recommendation: Check for Unexpected Anthropic Usage

Railway published a security disclosure on October 21, 2026, advising customers who use Anthropic's Claude through its platform to revoke any API key that may have been exposed, review Claude Console usage and logs for requests they did not make, and redeploy services with a replacement key. The guidance applies Anthropic's API key compromise and key best-practices documentation to Railway-specific steps, including editing the key as a shared or service variable and deploying the staged change. Railway directs users to compare per-key token volume and model mix on the Usage page, check Cost and Logs for the exposure window, and optionally pull the same data via the Usage and Cost Admin API filtered by api_key_ids[].

Security Disclosure Recommendation: Check for Unexpected Anthropic Usage This guide is part of Railway's response to the security disclosure published on October 21, 2026 https://blog.railway.com/p/security-disclosure-wednesday-october-21st . If you use Claude with Railway, revoke any API key that may have been exposed, review the Console usage and logs for requests you didn't make, and redeploy your services with a new key. If you have a Claude API key that may have been exposed, or your bill or rate limit consumption rose without a matching change in your traffic, check your Anthropic usage. Anthropic's guidance is to revoke the key immediately, then review the Usage and Logs pages in the Claude Console. This guide applies the guidelines from Anthropic's What should I do if I suspect my API key has been compromised? https://support.claude.com/en/articles/8384961-what-should-i-do-if-i-suspect-my-api-key-has-been-compromised and API key best practices https://support.claude.com/en/articles/9767949-api-key-best-practices-keeping-your-keys-safe-and-secure , extended to include Railway-specific operations. Revoke the key Deleting a key in the Console takes effect immediately. Create the replacement in the same place. Your Railway services can't reach Anthropic until you deploy the replacement key in the next section. 1. Open the API keys https://platform.claude.com/settings/keys page in the Claude Console and confirm you're in the right workspace. 2. Click the menu next to the exposed key and select Delete API key . 3. Click Create key to generate a replacement, scoped to the same workspace. Copy it now. The Console doesn't show it again. 4. If an Admin API key sk-ant-admin01-... may also have been exposed, delete it on the Admin keys https://platform.claude.com/settings/admin-keys page. GitHub's secret scanning reports exposed Claude keys to Anthropic, which deactivates them and emails you. If you received that email, the key is already deactivated, but you still need to deploy a replacement key on Railway and review usage. Update the key on Railway On Railway, your Claude API key is a variable, so updating it means editing the variable and redeploying. 1. Open the service that uses the key and click Variables . If the key is a shared variable https://docs.railway.com/variables shared-variables , edit it once in Project Settings and every service that references it gets the new value when you deploy. 2. Set the variable to the new key, then deploy the staged change https://docs.railway.com/deployments/staged-changes . 3. Confirm the new deployment is active and its logs show successful requests to Anthropic. Review for misuse The Console shows usage per key and per workspace, and the Logs page shows individual requests. 1. Open Usage https://platform.claude.com/usage and group by API key. Compare the exposed key's token volume and model mix against your normal traffic. If a key you only use with one model suddenly shows another, that's a strong signal. 2. Open Cost https://platform.claude.com/cost to see the spend attributed to the key and workspace during the exposure window. 3. Open Logs https://platform.claude.com/logs , filter to the exposed key, and look for request patterns, timings, and error rates that don't match your application. 4. Optional: pull the same data programmatically with the Usage and Cost Admin API https://platform.claude.com/docs/en/manage-claude/usage-cost-api , filtering by api key ids . This needs an Admin API key and works for organizations, not individual accounts. curl "https://api.anthropic.com/v1/organizations/usage report/messages?\ starting at=2026-10-14T00:00:00Z&\ ending at=2026-10-21T00:00:00Z&\ api key ids =apikey 01Rj2N8SVvo6BePZj99NhmiT&\ bucket width=1d" \ -H "anthropic-version: 2023-06-01" \ -H "x-api-key: $ANTHROPIC ADMIN KEY" 5. Review Members https://platform.claude.com/settings/members and workspace membership for people you didn't invite. 6. If you find usage you didn't generate, save the usage and cost data you found and contact Anthropic support https://support.claude.com . If you have any other questions, contact Railway support at support@railway.com mailto:support@railway.com .