How to keep ClearRun API keys out of your repo

Keep the key in an environment variable or in the file clearrun login saves. Never put it in a file you commit. A leaked key can spend your credits.

Last updated

Steps

  1. On your own computer

    Run clearrun login. It saves the key in your home folder, outside any repo.

  2. In CI

    Store the key as a secret (in GitHub, a repository secret) and pass it in as CLEARRUN_API_KEY.

  3. In an MCP config file

    Don't paste the key into a shared mcp.json. Use your saved login, or in VS Code use "${env:CLEARRUN_API_KEY}" as the value.

Places to avoid

  • apiKey in clearrun.config.json. The CLI reads it, but that file usually gets committed.
  • --api-key on the command line. It can end up in your shell history and CI logs.
  • Screenshots, tickets and chat messages. Blur the key.

Catch it before you push

Search for crun_ before committing, or set your secret scanner to flag it.

If a key leaks

Revoke it on the API keys page right away, then create a new key. See What to do if your ClearRun API key leaked.