GitHub Push Blocked After Deleting an API Key? Remove It from the Commits

A push includes commits, not just today's file

If GitHub still blocks a push after you delete an API key, read the commit IDs and file locations in the rejection. The current file may be clean while an earlier commit still contains the value. GitHub's remediation guidance requires removing the secret from every commit where it appears.

The October 13 update adds Anthropic service and user API key patterns to default push protection. For a blocked Claude API integration, fixing the affected history is the next step before trying another push.

Amend the commit that introduced the key

If the key exists only in the latest commit, remove it from the code and update that commit using GitHub's documented sequence:

git commit --amend --all
git push

Amending updates the offending commit. Adding a separate deletion commit leaves its predecessor in the history. If the rejection names older commits too, amending only the tip is insufficient.

Start with the earliest affected commit

Compare the rejection's commit list with git log. For an affected commit that has a parent, GitHub documents starting an interactive rebase from that parent:

git rebase -i <COMMIT-ID>~1

Replace the placeholder with the earliest affected commit's ID. Change its action from pick to edit, remove the key when the rebase pauses, stage the correction, amend, and continue the rebase. Any later change that reintroduces the value also needs correction.

The Git manual explains how to handle conflicts: resolve the files, stage them, then continue. Use git rebase --abort to cancel and restore the original branch state. A root commit has no parent, so the ~1 starting point above does not apply to it.

This workflow addresses local history that has not successfully been pushed. The goal is to remove the value from the outgoing commits, not merely from the working file.

History cleanup does not deactivate a credential

If the key was already exposed, Anthropic recommends immediate revocation. In Claude Console's API keys page, open the key's menu and select Delete API key. Use Create key for a replacement and update the application's secret configuration.

Anthropic's storage guidance recommends environment variables and secret management. Local dotenv files belong in the version-control ignore list; cloud deployments should prefer encrypted secret storage.

There is also a provider response when GitHub detects a Claude API key in a public repository: GitHub notifies Anthropic, which automatically deactivates the exposed key. That public-repository integration is not a reason to wait when you already know a credential has leaked.

Default patterns do not enable every private repository

The added patterns are anthropic_service_api_key and anthropic_user_api_key. Distinguish that detector change from the repository's protection configuration.

User push protection is enabled by default on GitHub.com and covers pushes to public repositories. Repository push protection requires GitHub Secret Protection and administrator enablement; it is disabled by default.

Check that configuration for a private repository. For a rejected push, follow the reported commit locations; for an exposed key, revoke and replace it; for the replacement, keep the value outside source code.