You pasted an API key into a coding session. Now what?
It happens in the ordinary way: something is failing, you paste the whole config to show the agent, and the key is in it. The chat window is not where that key now lives.
Where it went
Your AI coding tool writes the session to disk as it goes. The paste is in that file the moment you send it, and it stays there:
- ~/.claude/projects/<project>/<session>.jsonl — Claude Code
- ~/.codex/, ~/.gemini/, ~/.config/opencode/ — the others, same idea, different shapes
Clearing the conversation in the UI does not touch those files. Neither does closing the terminal. If the directory is in a backup, or synced, or on a machine someone else can read, the key is in all of those places too.
What to do, in order
1. Rotate it
First, before anything else, and regardless of how confident you are that nobody saw it. Rotation is cheap; the alternative is a bet. Everything below is about finding the rest, not about deciding whether to rotate this one.
2. Find the others
If you pasted once you have almost certainly pasted before. The question is not whether this key is exposed but how many are, and searching for one string by hand will not answer that.
3. Decide about the files
Deleting a transcript removes the credential and the work with it. Usually the better answer is to rotate and keep the history, having established what is in it.
Finding every one of them
A grep for sk- finds one shape of one provider's keys and misses the rest — tokens that are just hex, credentials in a pasted .env, a connection string with the password inline. Scanning by pattern per provider is what actually enumerates it:
> do I have any leaked secrets? recall_security_summary — distinct credentials, grouped, with which sessions each one appears in
chat-recall scans on index rather than on request, so the answer exists before you think to ask. Findings are grouped by the credential rather than by occurrence: one key pasted into nine sessions is one thing to rotate, not nine.
Redaction happens before upload, not after
Worth being precise about, because it is the part that would otherwise make this worse. The scan and the redaction both run on your machine, in the CLI, before anything is sent anywhere. What reaches the server is already redacted. Self-hosting removes the question entirely — see self-hosting.
Not doing it again
Reference the variable, not the value. Say $STRIPE_SECRET_KEY and the agent can reason about the config without the secret ever entering the transcript. Nearly every "show me your config" exchange works exactly as well this way.
It is worth putting in the project instructions your agent reads, so it is a rule rather than something you have to remember while debugging at speed — which is precisely when you will not.