The GIF above shows the real detection + sanitization engine. The full
in-editor block→auto-paste flow happens inside Claude Code's UI — install it
(below) to see it live.
Table of contents
The problem
When you paste an API key into Claude Code chat:
- The key is sent to Anthropic's API as part of your prompt
- The key is persisted in the local session transcript (
*.jsonl files)
- Claude Code (correctly) shows a warning that the key has leaked and should
be rotated
Rotating a key every time you reference one is friction. So is being careful
to never paste one. This plugin removes the friction by intercepting the
key locally before it leaves your machine, on every prompt.
What this plugin does
A UserPromptSubmit hook scans every message you submit:
- Detects secrets via regex (~20 well-known formats) OR explicit markers
(
/key NAME=VALUE, KEY:NAME=VALUE, KEY=VALUE)
- Saves each detected secret to
~/.claude/secrets/<name>.txt with
chmod 600 permissions
- Blocks the original prompt (the raw value never reaches the model or
the transcript)
- Re-submits a sanitized version of your prompt automatically — values
are replaced with
<<secret:NAME stored at ~/.claude/secrets/NAME.txt>>
- Teaches Claude (via a bundled skill) to USE the saved keys without
leaking them:
export VAR=$(cat ~/.claude/secrets/x.txt) && cmd, never
bare cat
The re-submission uses OS-level keystroke automation (osascript / xdotool /
wtype / PowerShell SendKeys), so from your perspective you just press Enter
once and Claude responds to the cleaned-up version.
Why Keyward (vs the alternatives)
You already have ways to handle secrets. Here's where each one leaves a gap that
Keyward fills:
| Approach | The gap |
|---|
| Just rotate the key after pasting | Works, but it's friction every single time, and you have to remember. Keyward makes the paste safe so there's nothing to rotate. |
| Be careful never to paste keys | Discipline fails under deadline. Keyward is a safety net that doesn't depend on you remembering. |
1Password / Vault / Keychain + reference by name | Great for stored secrets you reference deliberately. Useless for the key a colleague just DM'd you that you want to use right now without a vault round-trip. Keyward catches the ad-hoc paste. |
.env file + direnv | Good for project config. But you still had to get the key into .env without pasting it in chat — Keyward is how it gets there safely. |
| Claude Code's built-in "key leaked, rotate it" warning | Reactive: it tells you after the value already hit the API and the transcript. Keyward is proactive: the value never gets there. |
A PreToolUse hook / output filter | Scrubs Claude's tool calls, not your prompt. The leak happens at prompt submission, upstream of any tool. Keyward hooks UserPromptSubmit, the only point early enough. |
