Free API credits for ChatGPT and Claude users, plus new privacy risks

Posted on Nov 4 • Originally published at watershowdigital.com

AI providers are now bundling free API credits with their premium chat subscriptions. At the same time, two major developer tools silently changed privacy settings that expose your local code and API traffic.

You can build scrapers, bots, and single page apps using premium models without paying extra. You also need to check your local configuration to stop your client code from being sent to training servers or third party APIs without your permission.

Anthropic now gives monthly API credits to users on specific paid plans. If you pay for the Max or Ultra tier, or if you use a Team plan, you get a separate API balance to use in your own apps. Max users get 100 dollars. Ultra users get 200 dollars. Team plans receive 20 dollars or 100 dollars per seat, capped at a maximum of 500 dollars.

To get the credits, you must have an active subscription in good standing for seven days. You do not need to add a credit card to the Claude Platform. According to Monthly API credits for Max, Ultra, and Team plans | Claude Help Center, you claim the credits by linking an organization:

These credits do not roll over to the next month. They expire at the end of each billing cycle. You cannot use them for interactive Claude Code sessions in your terminal or IDE. They are strictly for the API, Playground, and Managed Agents.

OpenAI offers a similar benefit for eligible ChatGPT Pro and Business subscribers. The API credits allow you to build custom integrations without separate billing.

Pro subscribers receive 100, 200, or 500 dollars based on their specific tier. Business plans get 20 dollars per Standard seat or 100 dollars per Premium seat. This pool is also capped at 500 dollars per workspace. The official API credits for ChatGPT subscribers - OpenAI Developers page notes that you must activate the benefit by linking your subscription to an API organization you own.

You can claim these credits by visiting the ChatGPT billing page at https://chatgpt.com/settings/billing. Your first grant is prorated based on the time remaining in your paid billing period. The credits expire at the end of the subscription billing cycle and do not roll over.

Some users report problems claiming their balance. According to Claim up to 500$ in API credits using your ChatGPT Pro or Business..., people who purchased their subscription through the Apple App Store or Google Play Store cannot see the claim option. Others found that their credits disappeared after their monthly auto renewal triggered.

When you use these new API credits to build apps, you must configure your environment variables correctly.

Lovable and Bolt apps are Vite and React single page apps that use Supabase for the backend. They do not use Next.js unless you explicitly add it. In a Vite app, your client environment variables must start with VITE_. If you put your OpenAI or Anthropic API key in a VITE_ variable, it will be exposed to every visitor. You should call the AI APIs from a secure backend environment like a Supabase Edge Function instead.

If you build with Next.js, client environment variables start with NEXT_PUBLIC_. These variables are inlined at build time. If you change a NEXT_PUBLIC_ variable, you must trigger a redeploy for the change to take effect in the browser.

For authentication, Supabase OAuth requires correct URL settings. When users sign in with Google or GitHub, the provider sends the callback to a specific address:

https://<project-ref>.supabase.co/auth/v1/callback Enter fullscreen mode Exit fullscreen mode You must configure your own domains in the Supabase dashboard. Navigate to Authentication then find URL Configuration to set your Site URL and Redirect URLs. The Supabase service_role key must never reach the browser. Keep it strictly on the server.

Recent updates have introduced privacy risks for developers using AI tools.

OpenAI changed user settings without notification. According to OpenAI seems to be silently re-enabling model training on Codex chats, developers who previously opted out of data sharing found that the setting had been silently re-enabled in Codex. If you use Codex for work, you must verify your data sharing preferences again to ensure your code is not used for model training.

The Postman desktop application automatically installs AI plugins without asking for permission. The issue is documented in Postman silently auto-installs AI plugins and attempts to share all API data.

When you open Postman desktop version 12.33.4, the software installs plugins for Codex and Claude. It then modifies your global user configuration to trust its own startup hook.

[ marketplaces. postman ] source_type = "git" source = "https://github.com/postmanlabs/postman-plugin.git" [ plugins. "postman@postman" ] enabled = true Enter fullscreen mode Exit fullscreen mode The installer explicitly attempts to approve this hook. The hook instructs the coding agent to route API engineering tasks through Postman skills. This happens automatically when the agent starts. Postman also adds a remote connection pointing to an external server.

{ "mcpServers": { "postman": { "command": "node", "args": [ "..." ], "url": "https://mcp.postman.com/mcp" } } } Enter fullscreen mode Exit fullscreen mode This integration happens even if you just open Postman after leaving it closed for a while. It alters your global agent configurations and sets Postman as the default tool for general API work. You must manually check your agent configurations and remove the unwanted hooks if you opened Postman recently.

You claim Claude API credits by going to your account billing settings and clicking the option to link an organization. You must be on an eligible Max, Ultra, or Team plan for seven days before the option appears. The credits will go to the single console organization you select.

Users who subscribed to ChatGPT Pro through the Apple App Store or Google Play Store report that the option to claim credits is missing. Some users also state that their credits disappeared after an automatic renewal. The documentation states you must wait seven days after a subscription change.

The auto-installed Postman plugin alters your coding agent configuration to route API engineering tasks through Postman skills. It attempts to approve its own startup hook and adds a remote connection to a Postman server. It installs these changes automatically when you open the Postman desktop app.

Originally published at watershowdigital.com/blog/free-api-credits-chatgpt-claude-privacy. Need a hand with your app or automation? WaterShow Digital fixes and builds it, fixed quote first.