What Is an API Key? Where Claude Code Wants You to Put It

Claude Code has asked you to "add your API key," and your build is waiting on it. This guide explains what an API key is, why services such as email providers hand them out, where to find yours, and the two places Claude Code usually wants it to go.

By the end, you'll know what to paste, where it goes and how to keep it safe.

What is an API key, in plain English?

An API key is a long, secret string of letters and numbers that proves your project is allowed to use a service. Think of it as a key card for a building: the service checks it every time your project asks for something, and whoever holds it gets in.

API stands for application programming interface. It's the set of doors a service opens so other software can ask it to do things, such as "send this email to this person." The API key is what your project shows at the door.

Two things make an API key different from your login password:

• It belongs to your project, not to you. Your project uses it in the background, with no one typing it in.
• Whoever has it can use it. There's no second check. Resend warns that anyone holding a leaked key can send email from your verified domains and use up your monthly allowance.

Why do services use API keys?

Services use API keys to know which account a request belongs to and what it's allowed to do. For an email service such as the ones covered in what a transactional email service is, that looks like this:

Where do you find your API key?

You create your API key in the dashboard of the service you signed up for. You give it a name, choose what it's allowed to do, and copy it. Most services show the key only once.

Copy the key as soon as it appears and keep it somewhere safe, such as a password manager, until it's in your project. For the full setup on each service, see how to set up Resend and how to set up SendGrid.

Where does Claude Code want your API key?

When Claude Code asks you to add your API key, it means one of two places, and a working project usually needs both.

The .env file. This file holds secrets as environment variables: named settings, such as RESEND_API_KEY, that your project reads when it runs. Because the code only refers to the name, the key itself never sits in the code.

Your hosting settings. When your SaaS is live, it runs on a host such as Vercel, not on your computer. The .env file normally isn't uploaded, so the key also goes into your host's settings. On Vercel, you open your project, choose Environment Variables in the sidebar, enter the name and value, pick which environments it applies to, and save. Vercel only applies changes to new deployments, so your project needs redeploying afterward.

You can hand both jobs to Claude Code:

I've created my email API key. Please set up a .env file for it, make sure that file never gets uploaded to GitHub, and tell me the exact name and value I need to add in Vercel for the live site.

Claude Code will set up the file, name the setting, check the file is on the list of files GitHub ignores (GitHub is where many projects' files are stored), and tell you what to enter in Vercel. It may ask you to paste the key into the chat or into the file. Either way, the key should never end up written into the code. For more detail, read where to put API keys.

How do you keep your API key safe?

Treat your API key like a password: keep it private, give it as little access as it needs, and replace it quickly if it leaks.

1. Keep it out of your code and out of GitHub. GitHub automatically scans public projects for leaked keys, but a key that's never uploaded is safer still. Resend notes that a key stays in a project's history even after it's removed from the files.
2. Choose the smallest permission. Most projects only need to send email. Resend recommends "Sending access" over full access for that reason.
3. Don't share it. Resend lists screenshots, messages and third-party tools among the common ways keys leak.
4. Delete keys you don't use. Resend flags keys that haven't been used for 30 days or more.

If a key does leak, delete it in the service's dashboard straight away. Resend says deleting a key stops it working immediately. Then create a new one and swap it in:

I think my email API key was exposed. I've deleted it and created a new one. Please help me put the new key everywhere the old one was used, including Vercel, and check the key isn't written anywhere in the code.

How do API keys work with SimpleSends?

SimpleSends works like other transactional email services here: your live project uses a secret key to send through SimpleSends. When a real customer resets their password at 3am, Claude Code isn't running, so your project sends the email directly.

The SimpleSends connector is for building. It's an MCP server, a standard way for Claude Code to work with outside services (see what MCP is). Through it, Claude Code can send test emails and check send logs from the chat while you build.

What sets SimpleSends apart is who it's built for: people who build with Claude Code but don't write code. Sign-up and help are written in plain English, without developer jargon, and after that everything happens in the chat. Claude Code designs, writes, builds and changes every transactional email, and can tell you whether one went out. See how to send emails from Claude Code for the full picture.

If that sounds like the way you want to work, connect SimpleSends to Claude Code and brief it on your emails in plain English.