# Credential stuffing

Canonical page: /glossary/credential-stuffing

API keys & secrets glossary, Mistakes & leaks. Credential Stuffing: Why Reusing Secrets Is Risky

**Short answer:** Credential stuffing is an automated attack where leaked username-password pairs, or in some cases leaked API keys, from one breach are tried against many other services, on the assumption that people reuse the same credentials in more than one place.

## Why it matters

This is one of the strongest arguments for never reusing an API key across unrelated services or projects: a leak in one place should not become an opening everywhere else.

## In Claude Keychain

Because Claude Keychain makes it just as easy to store five separate, narrowly scoped keys as it is to store one, there is little practical reason to reuse a single key across unrelated integrations.

## Common questions

**Does credential stuffing apply to API keys, not just passwords?**

Yes, if the same key or a similarly reused secret grants access somewhere else, it is vulnerable to the same pattern.

**How do I protect against credential stuffing?**

Use a unique credential per service, and rotate or revoke anything involved in a known breach immediately.

## Related

[API key scope](/glossary/api-key-scope), [Principle of least privilege](/glossary/least-privilege), [Revoking an API key](/glossary/revoke-api-key)