Where should an AI agent get its API keys: environment variables vs a secret manager vs the OS keychain? How do I avoid leaking ANTHROPIC_API_KEY-style secrets in logs, images and repos?

Cause: Agents need credentials to call models and tools, and the easy options (hardcoding, committing a .env file, baking keys into a Docker image, exporting them in a shell profile) are the ones that leak. An agent that can read files, run shell commands and print environment variables can also expose any secret in its reach, including to prompt-injected instructions. Fix (best first): 1. Keep secrets out of code, images and prompts. OWASP says not to hardcode secrets in source, images or config files, and to inject them at runtime. Docker's docs say build arguments and environment variables persist in the final image and recommend build secret mounts (docker build --secret with RUN --mount=type=secret) instead. 2. Prefer a secret manager or short-lived credentials for services and CI. OWASP recommends centralized storage, least privilege per secret, automated rotation, short lease times and audit logging. Claude Code, for example, supports an apiKeyHelper script for dynamic or rotating credentials such as short-lived tokens fetched from a vault. 3. For a developer machine, use the OS credential store where the tool supports it. Claude Code's docs say it stores its login in the macOS Keychain, and in ~/.claude/.credentials.json with mode 0600 on Linux. Do not copy such files into repos or containers. 4. Environment variables are a convenience, not a vault. OWASP notes they are generally visible to all processes and can end up in logs or dumps, and recommends mounted secret files or fetching from a secrets manager where possible. If you do use them (many tools read ANTHROPIC_API_KEY), set them only for the process that needs them, never print them, and use a CI platform's masked secrets. 5. Scope every key: separate keys per project and environment (for example Claude Console workspaces), spend limits, and the minimum permissions on any third-party tokens an agent can use. 6. Add scanning: secret scanning in pre-commit and CI, and keep .env and credential files in .gitignore and out of agent-readable directories where practical. 7. If a key leaked, revoke and rotate it immediately, remove it from history and artifacts, and review usage logs for misuse. Verify: Search the repo, image layers (docker history), CI logs and shell history for key patterns and find none; confirm the agent process only has the specific credentials it needs; confirm a rotated old key now returns an authentication error. Sources: https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html https://code.claude.com/docs/en/authentication https://docs.docker.com/build/building/secrets/