Issue Station
Sign In
Tools hereToolbox

claude-code - 💡(How to fix) Fix [BUG] Billing - 12+ Unauthorized Auto-Recharge Charges Due to Exposed API Key, Only 1 of 12 Refunded [1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
anthropics/claude-code#51950•Fetched 2026-04-23 07:40:35
View on GitHub
Comments
0
Participants
1
Timeline
3
Reactions
0
Author
idiolleidiolle
Participants
idiolleidiolle
Timeline (top)
labeled ×2unlabeled ×1

Error Message

Error Messages/Logs

RAW_BUFFERClick to expand / collapse

Preflight Checklist

  • I have searched existing issues and this hasn't been reported yet
  • This is a single bug report (please file separate reports for different bugs)
  • I am using the latest version of Claude Code

What's Wrong?

My API key was exposed client-side due to a VITE_ prefixed environment variable, resulting in unauthorized usage. 12+ auto-recharge transactions totaling ~$148.67 occurred within 24 hours (April 16-17, 2026).

I contacted support and only 1 transaction ($11.00) was automatically refunded. The system marked my organization as "already refunded" and refuses to process the remaining ~$137.67.

5+ support conversations submitted (IDs: 215473951185476, 215473951268251, 215473951315517, 215473951805781, 215473987005927) but only AI agent responses received. No human agent has reviewed this case.

Account: [email protected] Organization: 현서방's Individual Org Compromised key: jesamoad (sk-ant-api03-i7E...SQAA) - revoked Period: April 16-17, 2026 Total unauthorized charges: ~$148.67 Refunded: $11.00 (1 transaction) Remaining: ~$137.67

What Should Happen?

Refund of the remaining ~$137.67 in unauthorized auto-recharge charges, reviewed by a human billing specialist.

Error Messages/Logs

Steps to Reproduce

  1. API key exposed via VITE_CLAUDE_API_KEY in client-side JavaScript
  2. Unauthorized third party extracted key and made API calls
  3. Auto-reload triggered 12+ times ($10-15 each)
  4. Support AI agent refunded only 1 of 12+ transactions
  5. AI agent marks organization as "already refunded" and repeats policy

Claude Model

None

Is this a regression?

No, this never worked

Last Working Version

No response

Claude Code Version

N/A - billing issue

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

VS Code integrated terminal

Additional Information

Actions already taken:

  1. Revoked compromised API key
  2. Disabled auto-reload
  3. Reduced monthly spend limit
  4. Migrated all API calls to Firebase Functions backend proxy
  5. New key stored as Firebase Secret (server-side only)
  6. Added rate limiting (5 req/min, $5/day cap)

extent analysis

TL;DR

The user needs a refund of the remaining ~$137.67 in unauthorized auto-recharge charges, which was not fully addressed by the support AI agent.

Guidance

  • The issue seems to be with the billing system marking the organization as "already refunded" after a single transaction was refunded, preventing further refunds.
  • To resolve this, the user should continue to escalate the issue to a human billing specialist, providing the support conversation IDs and details of the unauthorized transactions.
  • The user has already taken steps to secure their API key and prevent future unauthorized usage, which is a good practice.
  • The user should also consider providing more detailed information about the transactions, such as dates and amounts, to help the billing specialist process the refund.

Notes

The issue is specific to the billing system and the user's interactions with the support AI agent, so it's difficult to provide a technical solution. The user has already taken steps to secure their API key and prevent future issues.

Recommendation

Apply workaround: Continue to escalate the issue to a human billing specialist, providing detailed information about the unauthorized transactions, to resolve the refund issue.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#api#indexing error#inference speed#output truncation#environment variable

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING