Claude API key: how to get one, use it and keep it safe

A Claude API key is what lets your code, scripts and agents call Claude directly, outside the Claude.ai apps. Getting one takes a minute. Choosing the right kind of key, and keeping it from ending up in a Git repository or a Slack thread, takes a bit more thought.

This guide covers how to create a key, which type to choose, how to use it, and how a team should manage keys. Facts are from Anthropic's documentation as of October 2026; the Console changes often, so check Get your Claude API key if a screen looks different.

Before you start: the API is not your Claude subscription

A common surprise: a paid Claude.ai plan (Pro, Max, Team or Enterprise) does not include API access. The apps and the API are separate products with separate billing. API usage is billed per token in the Claude Console, usually through prepaid credits, and new accounts get a small amount of free credit for testing. Some organisations are invoiced monthly instead through an agreement with Anthropic's sales team.

So you need a Console account at platform.claude.com even if you already pay for Claude.

How to create a Claude API key

1. Sign in to the Claude Console at platform.claude.com, or create an account.
2. Go to Settings → API keys.
3. Click Create key. Name it after what will use it ("ci-release-notes", not "test"), choose an expiration, and set Linked account to yourself or a service account. Optionally scope it to a workspace.
4. Copy the key and store it in a secrets manager or password manager. It starts with sk-ant-, and the Console shows it only once. If you lose it, you create a new one.

If the Create key button is greyed out, your role does not allow it. Ask an organisation admin to change your role or to create a service account key for you.

Which key type to choose

When you create a key, you choose what it acts as. This matters more than it looks.

The rule of thumb from Anthropic's docs is simple: a personal key for your own development, a service account key for anything shared (CI pipelines, production services, agents). A personal key used by a production service breaks the day that person leaves, and every request in the logs looks like it came from them. Workspace keys still work but are legacy: they outlive the people who created them, which is exactly what you do not want from a credential nobody owns.

For production workloads on AWS, Google Cloud, Azure, GitHub Actions or Kubernetes, Anthropic also supports Workload Identity Federation: the workload exchanges its cloud identity token for a short-lived Claude access token, so there is no static sk-ant- string to leak or rotate at all. If your platform supports it, it is the better option for anything that runs unattended.

How to use your API key

The SDKs read the ANTHROPIC_API_KEY environment variable automatically:

export ANTHROPIC_API_KEY="sk-ant-api03-..."

A first request with curl:

curl https://api.anthropic.com/v1/messages \
  -H "Authorization: Bearer $ANTHROPIC_API_KEY" \
  -H "anthropic-version: 2023-06-01" \
  -H "content-type: application/json" \
  -d '{
    "model": "claude-sonnet-5-5",
    "max_tokens": 1024,
    "messages": [{"role": "user", "content": "Hello, Claude"}]
  }'

Authorization: Bearer is the current header; the older x-api-key header still works. Both anthropic-version and content-type are required.

Workspaces. If the key is scoped to one workspace, requests run there automatically. If it can reach several workspaces, every request must also send anthropic-workspace-id with the workspace's ID (found under Settings → Workspaces), otherwise the API returns a 400 error. For most integrations, scoping each key to one workspace is simpler and safer.

Claude Code. Claude Code can run on an API key instead of a subscription login, which is how it is usually run in CI and automation. Cost then follows API pricing; see Claude Code pricing for how that compares with a subscription.

Expiration, rotation and what to do after a leak

When you create a key you choose an expiration: 3 hours, 1 day, 7 days, 30 days, a custom duration, or Never (for keys kept in a secrets manager that you rotate yourself). An organisation can set a maximum expiration policy, in which case Never disappears. Expiration is fixed at creation and cannot be changed later. Anthropic emails the creator before longer-lived keys expire (7 days before for keys of 14 days or more, 1 day before for keys of 7 days or more); shorter keys expire silently with a 401 authentication_error.

If a key leaks, act in this order:

1. Disable or delete it on the API keys page. Disable is reversible, delete is permanent.
2. Create and deploy a replacement, ideally of the right type this time.
3. Check the Usage page for spend you do not recognise.
4. Find out how it leaked (a commit, a log line, a screenshot, a frontend bundle) and close that path.

Short expirations for experiments and service accounts for production make step 1 rarely necessary.

How a team should manage Claude API keys

One developer with one key is easy. Twenty developers, three CI pipelines and a handful of agents is where it goes wrong: keys shared in chat, nobody knows which key is used where, and the first sign of a problem is the invoice.

What works:

• One workspace per environment or use case (development, CI, production, each agent). Workspaces separate usage, and you can set spend and rate limits per workspace so one runaway script cannot consume the whole organisation's budget.
• Service accounts for everything automated, one per workload, with keys scoped to that workload's workspace.
• Expirations on everything that is not in a secrets manager.
• Know your tier's spend cap. Organisations are placed on usage tiers with a monthly cap (Start $500, Build $1,000, Scale $200,000 at the time of writing). When the cap is reached, the API returns 429 errors until the next month or a tier increase, which can stop production. Set your own lower limit on the Billing page if you want a guardrail, not a cliff.
• Audit regularly. The Admin API lists every key with its status and expires_at, so a script can flag keys that never expire or belong to people who left.

The harder problem is that every key is a direct line to Anthropic, with whatever data the request carries, in whatever region Anthropic routes it. The Claude API's inference geography options are global or us; there is no EU-only option on the first-party API. Companies that need EU processing usually run Claude through a cloud provider's EU region (Amazon Bedrock or Google Cloud regional endpoints), and put a gateway in front so developers and agents never hold provider keys at all. The gateway holds the credentials, enforces budgets and model policy per team, and logs every call. That is what Walma AI Hub does, inside the customer's own Azure tenant in an EU region, for Claude, OpenAI models and approved MCP servers. For the general pattern, see What is an MCP gateway?.

Where to go next

• Claude API pricing: what your key will cost per model, and how to keep it down.
• Claude Managed Agents: Anthropic's hosted agent harness, which runs on the same key.
• How to install Claude Code: including running it on an API key.