Anthropic API Key: Get, Store and Rotate It Safely

Quick answer: An Anthropic API key (also called a Claude API key) is a secret starting with sk-ant- that authenticates your requests to the Claude API. You create it on the API keys page of the Claude Console at platform.claude.com, copy it once, and load it from the ANTHROPIC_API_KEY environment variable. Never ship it in client-side code.

This guide covers getting a key, the three key types, safe storage, workspaces, rotation and the errors that point to a key problem. Everything was checked against Anthropic’s docs and help center on October 24, 2026. If you already have a key and want to make your first call, jump to our Claude API tutorial.

How to get an Anthropic API key

1. Sign in to the Claude Console at platform.claude.com, or create an account. This is a developer account, separate from a Claude.ai chat subscription.
2. Add credits. Anthropic’s help center says most organizations pay with prepaid usage credits: someone with an Admin or Billing role goes to Settings, Billing and clicks Buy credits. Credits are available immediately, expire one year after purchase and are non-refundable. You can turn on auto-reload so the balance tops up below a threshold.
3. Open the API keys page (platform.claude.com/settings/keys) and click Create key.
4. Configure the key: give it a descriptive name, choose an expiration, set Linked account to yourself or a service account, and optionally scope it to one workspace.
5. Copy it immediately. The full key is shown only once. If you lose it, you can’t view it again; create a new one.

If the Create key button is greyed out, your role doesn’t allow key creation. Ask an organization admin to change your role or to create a service account key for you.

Which key type should you create?

When you create a key you choose what identity it acts as. That decides when it stops working.

Key type	Acts as	Stops working when	Use it for
Personal key	You, with your roles	You leave the organization (or lose access to its workspace)	Your own development and scripts
Service account key	A service account	The service account is archived or removed from the workspace	CI, production services, shared tools
Workspace key (legacy)	Nobody; belongs to the workspace	It expires, is deleted, or the workspace is archived	Existing integrations only

Anthropic recommends personal and service account keys for new work because they can’t outlive the people or workloads that own them. A shared personal key breaks the day its owner leaves, so give shared workloads a service account.

For production on AWS, Google Cloud, Azure, GitHub Actions or Kubernetes, also look at Workload Identity Federation, which swaps static keys for short-lived tokens from your identity provider. There’s no sk-ant- string to leak or rotate.

Store the key safely

The rule is simple: the key lives in your environment or a secrets manager, never in source code and never in a browser or mobile bundle.

Local development: environment variable

# macOS / Linux (add to ~/.zshrc or ~/.bashrc to persist)
export ANTHROPIC_API_KEY="sk-ant-..."

# Windows PowerShell (current session)
$env:ANTHROPIC_API_KEY = "sk-ant-..."

The official SDKs read ANTHROPIC_API_KEY automatically, so your code never mentions the key:

import anthropic
client = anthropic.Anthropic()  # picks up ANTHROPIC_API_KEY

Projects: a .env file that never gets committed

# .env  (real value, never committed)
ANTHROPIC_API_KEY=sk-ant-...

# .env.example  (committed, documents the variable)
ANTHROPIC_API_KEY=

# .gitignore
.env

Load .env with your framework’s built-in support or a library such as python-dotenv or Node’s --env-file flag. Commit .env.example so teammates know which variables to set.

Production: a secrets manager

Anthropic’s docs recommend storing keys in a secrets manager, rotating them periodically and disabling any key you suspect has leaked. Use your platform’s secret store (cloud secrets managers, CI secrets, Kubernetes secrets) and inject the value as ANTHROPIC_API_KEY at runtime. The same applies when you run Claude Code in pipelines; our Claude Code headless mode and GitHub Actions guides show the secret wiring.

Never put the key in client-side code

Anything shipped to a browser or app can be extracted. Call Claude from your backend and expose only your own endpoint. For iOS and macOS apps that must call the API directly, Anthropic offers App Attest, which issues short-lived tokens to genuine installs instead of embedding a key.

Anthropic’s own checklist

The help center’s API key best-practices article lists: never share your key, monitor usage and logs, use environment variables and secrets, rotate keys regularly, use separate keys for development, testing and production, scan repositories for secrets, and use a key management system.

Workspaces and key scoping

Workspaces split one organization into separate areas for teams, projects or environments, each with its own members, keys and limits. Every organization has a Default Workspace that can’t be renamed or deleted, and you can have up to 100 workspaces by default.

Scope	How requests pick a workspace	Good for
Key scoped to one workspace	Always that workspace	Most apps: one key per app and environment
Key not scoped to a workspace	You send the anthropic-workspace-id header on each request	Tools that work across several workspaces

If an unscoped key omits the header, the API returns a 400 explaining that the header is required. Useful patterns:

• Separate dev, staging and production workspaces, each with its own key.
• Set spend and rate limits per workspace so a runaway script in development can’t eat production’s budget. Spend limits can’t be set on the Default Workspace.
• Track cost per workspace in the Console’s usage pages.

When someone first signs in to Claude Code with a Console account, Anthropic automatically creates a Claude Code workspace and mints per-user keys there. You can’t create keys in it manually. New to the agent itself? Start with what is Claude Code.

Rotate, disable and delete keys

Expiration is set when you create a key and can’t be changed later. Options are 3 hours, 1 day, 7 days, 30 days, a custom duration, or Never (if your organization’s policy allows it). Anthropic emails the creator before longer-lived keys expire. After expiry, requests return 401 authentication_error.

A clean rotation looks like this:

1. Create a new key with the same scope.
2. Deploy it wherever the app reads ANTHROPIC_API_KEY.
3. Confirm requests succeed.
4. Delete the old key on the API keys page.

Disable is reversible; Delete is permanent. If you suspect a leak, delete the key right away and review your usage. As a safety net, Anthropic partners with GitHub’s secret scanning program: keys found in public repositories are reported to Anthropic, deactivated automatically, and the owner gets an email.

Admin API keys

Admin API keys are a different credential for managing the organization programmatically: members, workspaces and listing API keys. They’re meant for automation by organization admins, not for everyday model calls, and the Admin API never returns a key’s secret value, so it can’t recover a lost key or hand you a usable API key. Only organization admins should hold them. Most developers never need one.

Common API key errors and fixes

Error	Meaning	Fix
401 authentication_error	Key is missing, malformed, revoked or expired	Check the variable is set in this shell (echo $ANTHROPIC_API_KEY), look for stray quotes or spaces, create a new key if expired
402 billing_error	Billing or payment problem	Check credits and payment details on the Billing page
403 permission_error	Key can’t use this resource	Check the key’s workspace and your role
400 “not scoped to a workspace”	Unscoped key without workspace header	Send anthropic-workspace-id or use a workspace-scoped key
429 rate_limit_error	Rate limit, tier spend cap or Claude Code workspace limit	Wait for retry-after; if there’s no such header you’ve hit the monthly spend cap
529 overloaded_error	API temporarily overloaded	Retry with backoff; the SDKs retry automatically

Every response carries a request-id header. Include it if you contact Anthropic support.

API key vs Claude subscription

People often mix these up. They’re two separate products with separate billing.

	Claude API key (Console)	Claude subscription (Pro, Max, Team)
What it unlocks	Programmatic access to the Claude API	Claude apps on web, desktop and mobile, plus Claude Code
Billing	Pay per token from credits	Flat monthly price with usage limits; Max and Team include some API credits
Where you manage it	platform.claude.com	claude.ai settings

Claude Code can use either. You can log in with a Pro, Max, Team or Enterprise account, or with a Console account. If ANTHROPIC_API_KEY is set and you approve it, Claude Code uses the key, so usage is billed to the API rather than your plan. Run unset ANTHROPIC_API_KEY to fall back to your subscription and check /status to confirm. Our Claude Code pricing guide and Claude pricing guide compare both routes, and how to install Claude Code walks through login.

Next steps

• Make your first call with the Claude API tutorial.
• Estimate costs with the Claude API pricing guide and pick a model in Claude models explained.
• Building tools for Claude? Start with what is MCP. MCP server configs take environment variables too, so the same “keys in env, not in files you commit” rule applies.

For the official reference, see Anthropic’s Get your Claude API key and Authentication pages.