---
title: "Deploy a game from Claude Code without API keys"
description: "Yes, you can deploy a game from Claude Code without creating or pasting an API key."
url: "/docs/use-cases/claude-code-no-api-keys/"
lang: en
index: "/llms.txt"
---
# Deploy a game from Claude Code without API keys

Yes, you can deploy a game from Claude Code without creating or pasting an API key. Claude Code signs in to KUMODeck through your browser: you press **Allow** once, then ask it to deploy and get a test link. Going live waits for your own press on a KUMODeck page.

Most ways to put an app online from a coding agent start with a token: you make an access key on a website, paste it into a config file or an environment variable, and hope it never ends up in a commit. With KUMODeck, Claude Code signs in the way you do on a website. You press a button in your browser, and Claude Code can then deploy your game. There is no key to copy, and Claude Code never sees a secret key.

This page walks through it in Claude Code, from an empty folder or a game you already have to a link you can share.

## What you need

- **Claude Code**, in a terminal or on the web.
- **A KUMODeck account.** You can sign up on the page Claude Code opens for you. An invite code is optional: it adds credit to your balance.
- **A game or web app**, or an idea for one. The folder needs an `index.html` at the top once it is built.

## 1. Connect Claude Code once

Inside Claude Code, add the KUMODeck plugin with these two lines:

```text Run inside Claude Code
/plugin marketplace add kumodeck/kumodeck-plugin
/plugin install kumodeck@kumodeck
```

The plugin connects Claude Code to KUMODeck and adds the guides Claude Code follows when it builds and publishes your game (multiplayer, saves, login, publishing). The other ways to connect, and the same steps for Codex, Cursor and other agents, are on [Use from an AI agent (MCP)](/docs/claude-code/index.md).

## 2. Sign in in your browser, not in the terminal

The first time Claude Code uses KUMODeck, your browser opens the KUMODeck page:

1. Sign in, or sign up (an invite code is optional). Saved passwords, passkeys, Google and GitHub work the same as on the dashboard.
2. Check the agent's name and choose **what it may do**. Keep **Build and publish (recommended)**: it can publish to the test version and change your project's settings, while going live in production and every delete still ask you first.
3. Press **Allow**. The browser goes back to Claude Code, and it is connected.

Nothing was copied. The password stayed in your browser, and what Claude Code holds is a sign-in it can only use for what you chose. To change the choice later, disconnect in `/mcp` and sign in again.

## 3. Ask for the deploy

In the folder of your game, ask in plain words:

```text Ask Claude Code
Put this game online with KUMODeck and give me the test version's link.
```

Claude Code builds the game if it needs a build, sends the folder and gives you a link like `https://<name>--dev.kumodeck.app/`. That is the test version. Open it, try it on your phone, ask for changes. When you want everyone to see it, say "publish it": a KUMODeck page opens and you press **Publish** yourself.

No game yet? Ask for one first: "Make a small racing game, then put it online with KUMODeck."

## Keys for other services stay out of the conversation

Your game may need a key from somewhere else, for example a server-side key for an AI model or a map service. Two rules keep that key safe:

- **You type it into a small KUMODeck page, never into the conversation.** Ask Claude Code to "open the box for the key". It opens a page where you paste the key, so the value never goes through the conversation. Your code uses it from [Functions](/docs/guides/functions/index.md), your own server code, so it never reaches the browser.
- **A deploy that contains a key is stopped.** Everything you deploy is sent to the browser, so anyone could copy a key in your HTML or JS. Before the files go up, KUMODeck looks for the text of keys you saved, for known secret-key shapes (Stripe, OpenAI, Anthropic, Supabase, AWS, GitHub and many more), and for text that looks like a key. If it finds one, the deploy stops and says which file and line. The full list is in [Secrets in deployed files](/docs/guides/hosting/index.md#secrets-in-deployed-files).

Public keys made for the browser, such as `pk_…` keys or the `apiKey` in a Firebase config, are not stopped.

## An example: one of Sara's games

Sara is one of us at KUMODeck and makes small browser games with an AI to try it out. Take Beam Clash, a two-player game where each player has one button and taps faster than the other. From a folder with the game in it, the session in Claude Code goes like this:

| Step | Who does it |
|---|---|
| "Put this game online with KUMODeck." | you, in Claude Code |
| Opening the KUMODeck sign-in page | Claude Code, the first time only |
| Signing in and pressing **Allow** | you, in your browser |
| Sending the folder and giving back the test link | Claude Code |
| "Publish it." and pressing **Publish** on the KUMODeck page | you |

At no point is there a token to make, paste or rotate.

## What it cannot do, and conditions

- **You still need an account.** Anyone can sign up; an invite code is optional. Signing up and signing in are always done by you in the browser, never by Claude Code.
- **What Claude Code may do is what you chose.** With **Build and publish (recommended)**, going live in production and every delete still ask you first.
- **Big sites go through the CLI.** KUMODeck's MCP tool `hosting_deploy` carries files inside the conversation, so for anything bigger than a small page Claude Code uses `kumodeck deploy` ([Limits](/docs/limits/index.md)).
- **Some files are never deployed.** Dotfiles and `node_modules` are skipped (except `.well-known/`), so a `.env` with secrets is never published.
- **A key in your files stops the deploy.** Public keys made for the browser are not stopped; secret keys belong in a function.

## What it costs

There is no free tier: usage is taken from your prepaid balance at cost, and an invite code, if you have one, adds $5 of credit. Without one, you add funds before you create or publish. Each publish shows an estimate for that version, such as storage a month and the cost per 10,000 visits. See [Pricing](/docs/pricing/index.md).

## If something goes wrong

- **Claude Code says KUMODeck is not connected.** Run `/mcp`, pick the KUMODeck server and choose **Authenticate**. Your browser opens the same page as before.
- **The deploy stopped because of a key.** Move the key out of the page code, save it with the box above and call it from a function. Then ask Claude Code to deploy again.
- **You want to see what Claude Code can ask for.** [Talk to your AI agent](/docs/ask-claude-code/index.md) has requests you can copy, from starting a project to fixing errors.

Using Codex, ChatGPT or Claude in a browser instead? [Start here](/docs/start/index.md) has the steps for each place you use AI.

## Questions and answers

### Does Claude Code ever see my password?

No. You type it on the KUMODeck page in your browser. Claude Code holds a sign-in it can only use for what you chose on that page.

### How do I change what Claude Code may do?

Disconnect in `/mcp` and sign in again. The KUMODeck page asks again what the agent may do.

### My game calls an AI model with a secret key. Where does the key go?

Ask Claude Code to open the box for the key, and paste it into that small KUMODeck page. The value never goes through the conversation. Your code uses it from [Functions](/docs/guides/functions/index.md), so it never reaches the browser.

### Which keys does the deploy check stop?

The text of keys you saved, known secret-key shapes such as Stripe, OpenAI, Anthropic, Supabase, AWS and GitHub keys, and text that looks like a key. The deploy stops and says which file and line. Publishable keys like `pk_…` are not stopped.

### Can Claude Code publish to the public address on its own?

No. It can deploy test versions. When you say "publish it", a KUMODeck page opens and you press **Publish** yourself.

### Do the same steps work in Codex or Cursor?

The sign-in in the browser is the same. Only the way you add KUMODeck differs; the steps for each agent are on [Use from an AI agent (MCP)](/docs/claude-code/index.md), and Codex has its own page: [Deploy a web app from Codex](/docs/use-cases/codex-web-app/index.md).