---
title: "Call Claude or GPT without exposing your API key, with while.sh"
url: https://while.sh/en/guides/call-llm-api-without-exposing-key/
author: "Aloïs Oddon, co-founder of Nextmap"
updated: 2026-11-02
---

# Call Claude, GPT or Mistral from your app without exposing the key, with your AI agent

Your app talks to an AI model, and its key costs a lot if it leaks. With while, your app calls Claude, GPT or Mistral without ever holding the key, every call is recorded, and your AI agent connects it all over MCP.

## Prerequisites

- An app, deployed on while or ready to be.
- The key from your AI provider: Anthropic, OpenAI or Mistral.
- An AI agent that works in a terminal: Claude Code, Codex, Cursor or Gemini CLI.

## Step 1: Give your agent these instructions

Open your agent in your app's folder, and paste these instructions into it:

```text titre="Instructions"
Connect to while with my account (while.sh/agents), then deploy my app.
```

Your agent adds while's MCP server itself. If it asks you to, restart it. On the first call to while, a page opens in your browser. In Claude Code, if it doesn't open, type /mcp, choose while, then Authenticate. On that page, choose "A new app", then click Authorize.

## Step 2: Paste the key into while

Your agent declares the connection to Anthropic and gives you a link. You open it, paste the key and approve. Your agent never sees it.

## What your agent does

It adds the connection to the service, in while.yaml:

```yaml titre="while.yaml"
services:
  - name: web
    port: 3000
    connections: [anthropic]
```

Your app receives while's address for Anthropic in `ANTHROPIC_URL`, and calls the Messages API without a key (source 1):

```js titre="server.js"
const r = await fetch(`${process.env.ANTHROPIC_URL}/v1/messages`, {
  method: 'POST',
  headers: { 'content-type': 'application/json' },
  body: JSON.stringify({
    model: 'claude-sonnet-5-5',
    max_tokens: 1024,
    messages: [{ role: 'user', content: question }],
  }),
});
```

The key and the version header are added to each call, and every call is recorded. Calls to Claude go through from the first day, with no learning period.

## Switch models

> You, to your agent: Switch the summaries to Claude Haiku, so we pay less.

Your agent changes the model in your code and deploys again. The key stays as it is.

## Change the key

> You, to your agent: We need to change the Anthropic key.

You paste the new key into while, and your app uses it from the next call, with no new deployment.

## See your app's calls

> You, to your agent: Why did the summaries fail last night?

Your agent reads the latest call and the calls the connection refused in while, and fixes the problem.

## Add a second provider

> You, to your agent: Connect Mistral too, as a backup.

Your agent declares a second connection and adds it to while.yaml, you paste its key into while, and your app receives `MISTRAL_URL`. The Pro plan includes up to 25 API connections.

## Go back to the previous version

> You, to your agent: Go back to the previous version.

In the 30 minutes after a deployment, the previous version comes back in a second. After that, it takes a few seconds. Once the previous version is back, your agent reads what broke in while's logs, fixes it and deploys again.

## Next steps

- [Connect Stripe or Brevo with no key in your code](/en/guides/api-keys-out-of-code/)
- [Deploy a Claude artifact](/en/guides/deploy-claude-artifact/)
- [Security on while](/en/security/)

## Sources

1. [Anthropic, the Messages API](https://platform.claude.com/docs/en/api/messages), 2026-11-02

## Questions

### Can my agent see the key?

No. You enter it in while, never in your agent or in your code, and it is added to each call.

### Which providers work?

Anthropic, OpenAI and Mistral, and any other HTTP API with its key.

### Do I need to change my code?

Barely: your app calls the address it receives in ANTHROPIC_URL instead of Anthropic's, and it no longer sends a key.

### What if someone steals my app's code?

The key isn't in it: they can't use it anywhere else.