Case study

How I built this site with Claude Keychain

This whole site, the checkout, the license system, the admin panel, was built by having Claude Code work directly against real infrastructure: Cloudflare, Stripe, Resend. That only works if Claude Code can actually use those API keys, over and over, across many separate sessions, without them ending up back in a prompt, a terminal command, or a committed file.

The old way

Before this, using an API key with Claude Code meant one of a few bad options: paste the raw value into the chat so it could be exported in a shell command, keep it in a .env file that has to exist in every project and can end up in a commit if you forget to gitignore it, or type export CLOUDFLARE_API_TOKEN=... into a terminal by hand, again, in the new session, because the last one didn't persist it anywhere.

What I actually did

I added two keys to Claude Keychain once: a Cloudflare API token and a Resend API key. That's it. No .env file for this project, no export command, no pasting either value into a prompt.

From then on, every time Claude Code needed to deploy a Cloudflare Worker, update DNS, or send a real email through Resend, it asked Claude Keychain for the secret by name, ran the command with it injected as an environment variable, and only ever saw that command's normal output, not the key itself. The same two keys, reused across dozens of separate sessions over several days, building this exact site.

What that actually removed

No re-pasting a key into a prompt every time a new terminal session started.
No .env file for this project to gitignore, lose, or accidentally commit.
No typing a raw secret inline into a one-off curl command, where it sits in shell history afterward.
No manual "wait, which project has the current key" problem. One name, one place, used from any project.

The honest limit

This isn't a sandbox. If a command is told to print the environment variable back out, Claude Keychain redacts an exact, unmodified copy of the value from that output as a safety net, but it doesn't stop a command that deliberately does something else with the key. The full security model is here, including what it doesn't protect against.

If you're doing the same thing

If you're using Claude Code against real infrastructure, real API keys, for a real project, this is the actual use case Claude Keychain was built around, not a demo. Pricing is here, and there's a 48-hour refund if it isn't for you.