How to Get an Anthropic API Key
How do I get an Anthropic API key?
Anthropic (Anthropic, PBC) API key: open the official console, create a key for the correct project, workspace, or account, and copy it immediately. The key format is Anthropic API keys use the sk-ant- prefix followed by provider-issued secret characters.. Use the least-privilege permissions for this service. Store it as ANTHROPIC_API_KEY in a server-side secret manager. Key creation itself does not require payment.
Steps
- Open the Anthropic Console API keys page and select the workspace that should own the credential. (verified 2026-08-14)
- Choose Create Key, give it a descriptive name, and keep workspace membership and permissions limited to the required team. (verified 2026-08-14)
- Copy the key immediately; Anthropic shows the full secret value only at creation. (verified 2026-08-14)
- Add or confirm billing for the workspace before production use; usage is attributed to that workspace and organization. (verified 2026-08-14)
- Store the value as ANTHROPIC_API_KEY in a server-side environment or secret manager, never in source control or browser code. (verified 2026-08-14)
Key facts
| Env var | ANTHROPIC_API_KEY |
| Console | https://console.anthropic.com/settings/keys |
| Key format | Anthropic API keys use the sk-ant- prefix followed by provider-issued secret characters. |
| Scope and permissions | Keys belong to an Anthropic workspace; workspace membership and organization roles control access rather than a public per-request scope list. |
| Billing | Usage is billed to the Anthropic workspace and its organization billing account; generating a key does not itself create a charge. |
| Payment required before first call | No |
| Scoped to project/org | Yes |
| Shown once | Yes |
Rotate or revoke a key
Rotation
- Create a new key in the same workspace.
- Deploy it and verify a request.
- Revoke the previous key after the cutover.
Revocation
- Open Workspace Settings → API Keys.
- Select the key to retire.
- Revoke it and remove the old value from all deployments.
First API call
javascript example using claude-haiku-4-5; the key stays in ANTHROPIC_API_KEY and is never included in the snippet.
const client = new Anthropic({ apiKey: process.env.ANTHROPIC_API_KEY });
const response = await client.messages.create({
model: MODEL,
max_tokens: 1024,
messages: [{ role: 'user', content: 'Say hello in one sentence.' }],
});
const block = response.content[0];
console.log(block.type === 'text' ? block.text : '');FAQ
Do I need a credit card to get an Anthropic API key?
No — you can generate the key without a payment method, though usage limits stay low until you add one.
Can I see my Anthropic API key again after closing the page?
No — Anthropic shows the full key value exactly once. If you lose it, revoke it and create a new one.
Is this the same as an All AI Ask API key?
No. This page is about creating an API key with Anthropic directly, for calling their API yourself. For an All AI Ask key — one key that routes to Anthropic and every other provider we support — see /api-keys.
Batch 49 · anthropic decision and evidence contributions. Surface verification: 2026-08-14. These are route-local, server-rendered fixtures; unavailable values are not inferred.
Anthropic authentication-path selector
Frozen Batch 49 fixture board. Formula / decision rule: path = caller type ∧ organization/workspace ∧ supported surface ∧ identity authority Boundary: Do not recommend a static key where the first-party surface requires another identity mechanism.
| Frozen fixture / field ID | Joined inputs and observation | Calculated result | State |
|---|---|---|---|
batch49-anthropic-m1-r1workspace API key · expiring developer key | caller=server; org=org-acme; workspace=ws-prod; secret-bearing=Yes; header=x-api-key; expiry=2026-09-14; surface=Messages Workspace and expiry authority join the server caller and supported API surface. | path=workspace API key; monitor expiry | PASS WITH LIFETIME — workspace bound. |
batch49-anthropic-m1-r2Admin API key · cloud workload identity federation | caller=admin/cloud workload; org=org-acme; workspace=ws-prod; secret-bearing=No for federation; token=workload identity; surface=admin/runtime The admin and cloud workload paths have different authorities and are not collapsed. | path=Admin key for admin API; federation for workload | PASS WITH SEPARATION — path-specific. |
batch49-anthropic-m1-r3distributed iOS App Attest · Claude Code subscription | caller=mobile/subscription; workspace=Unavailable; secret-bearing=No; surface=distributed app/Claude Code; static key=disallowed Neither case is a direct server workspace-key workload. | static workspace key recommendation = Unsupported | UNSUPPORTED — use the owning first-party identity. |
Provenance: Batch 49 anthropic module 1 first-party evidence and surface verification date 2026-08-14. Anthropic authentication documentation. Missing joins fail closed.
Anthropic expiration-and-rotation scheduler
Frozen Batch 49 fixture board. Formula / decision rule: rotation start = expiry − max(deploy lead, validation lead, rollback reserve) Boundary: Never-expiring or policy-maximum states require an explicit owner and warning policy.
| Frozen fixture / field ID | Joined inputs and observation | Calculated result | State |
|---|---|---|---|
batch49-anthropic-m2-r13-hour · 1-day · 7-day expirations | created=2026-08-14T09:00Z; expiry=09:00/next-day/+7d; deploy lead=2h; validation=1h; rollback=1h; owner=platform Maximum lead is 2h, so the scheduler warns before each exact expiry. | start = expiry − max(2h,1h,1h) = expiry−2h | SCHEDULED — owner joined. |
batch49-anthropic-m2-r230-day · custom expiration | created=2026-08-14; expiry=custom; policy maximum=2026-09-30; warning=7d; overlap=required; owner=security Custom expiry is bounded by the organization maximum and requires overlap for deployment. | next action=issue replacement by policy max−7d | SCHEDULED WITH POLICY GATE. |
batch49-anthropic-m2-r3never-expiring · organization maximum policy | created=2026-08-14; expiry=never; policy=maximum 90d; warning=Unavailable; owner=missing The local never-expiring selection cannot override the organization maximum; warning owner is absent. | expiry semantics and warning=Unavailable; rotation cannot be scheduled | UNAVAILABLE — policy owner required. |
Provenance: Batch 49 anthropic module 2 first-party evidence and surface verification date 2026-08-14. Anthropic authentication documentation. Missing joins fail closed.
Anthropic workspace propagation and negative-test ledger
Frozen Batch 49 fixture board. Formula / decision rule: complete = 100% joined consumers ∧ accepted new request ∧ wrong-workspace rejection ∧ old-key rejection Boundary: A healthy request in one workspace cannot prove propagation to another.
| Frozen fixture / field ID | Joined inputs and observation | Calculated result | State |
|---|---|---|---|
batch49-anthropic-m3-r1API service · batch worker · CI | old=fp-ant-old-01; new=fp-ant-new-02; workspace=ws-prod; consumers=3/3; accepted=req-ant-1; wrong-workspace=403 All joined consumers accept the new key and a wrong-workspace request is rejected. | coverage=3/3=100%; revoke old after negative test | COMPLETE — workspace proof joined. |
batch49-anthropic-m3-r2two workspaces · scheduled job | old=fp-ant-old-03; new=fp-ant-new-04; workspaces=ws-prod/ws-staging; consumers=5/6; orphan=job-nightly; revoke=blocked The orphan scheduled job still uses the old workspace binding. | coverage=5/6=83.3%; completion=No | INCOMPLETE — join orphan job. |
batch49-anthropic-m3-r3compromised key · post-revoke rejection | old=fp-ant-leak-05; new=fp-ant-new-06; workspace=ws-prod; revoke=2026-08-14T11:00Z; post-revoke=401; audit=joined Revocation and post-revoke rejection are observed, with replacement coverage complete. | incident=contained; preserve audit receipt | COMPLETE — old credential rejected. |
Provenance: Batch 49 anthropic module 3 first-party evidence and surface verification date 2026-08-14. Anthropic authentication documentation. Missing joins fail closed.
