Claude API Key: Create, Secure or Skip It (2026)
How to create a Claude API key in the Console, pick the right key type, use workspaces and expiry, what it costs, and when EU teams should use IAM instead.
TL;DR
You create a Claude API key in the Claude Console under Settings, API keys: name it, pick an expiration, link it to yourself or a service account, and copy the sk-ant- string once. Keys are free; usage is prepaid. If your data must stay in the EU, skip the Anthropic key and use IAM on Bedrock or Google Cloud.
How do you create a Claude API key?
Sign in at platform.claude.com, open Settings, then API keys, and click Create key. You name the key, choose an expiration, set the linked account and optionally scope it to one workspace. The Console shows the full key exactly once. The whole process takes a few minutes once billing is set up.
The steps below follow Anthropic’s key guide as published on 19 September 2026:
- Create or sign in to a Console account at platform.claude.com. A paid Claude.ai plan (Pro, Max, Team or Enterprise) does not include API access; the Help Center calls them separate products.
- Buy credits under Settings, Billing. API usage is billed from prepaid credits, so add a balance before your first request.
- Open Settings, API keys and click Create key.
- Fill in the dialog: a descriptive name (for example
invoice-bot-prod), an expiration, the Linked account (yourself or a service account) and, ideally, a single workspace. - Copy the key into a secrets manager. It starts with
sk-ant-and cannot be displayed again. If you lose it, create a new one. - Test it with one request.
If the Create key button is greyed out, your role does not allow key creation. An organization admin has to change your role or create a service account key for you.
A first test from the terminal, using the model ID from the quickstart:
export ANTHROPIC_API_KEY="sk-ant-api03-..."
curl https://api.anthropic.com/v1/messages -H "x-api-key: $ANTHROPIC_API_KEY" -H "anthropic-version: 2023-06-01" -H "content-type: application/json" -d '{"model":"claude-sonnet-5","max_tokens":256,"messages":[{"role":"user","content":"Hello, Claude"}]}'The response headers include anthropic-workspace-id, so you can confirm which workspace the call was billed to.
Which key type should you choose?
Use a personal key for your own experiments and a service account key for anything shared, such as CI or production. Avoid the legacy workspace key: it has no owner and keeps working after its creator leaves. For production on AWS, Google Cloud or Kubernetes, Workload Identity Federation removes static keys entirely.
Anthropic documents three key types plus a separate admin credential in its authentication guide:
| Credential | Acts as | Stops working when | Our recommendation |
|---|---|---|---|
| Personal key | You, with your roles | You leave the organization (key is archived) | Local development, scripts |
| Service account key | A service account | The service account is archived or removed from the workspace | CI, backends, agents |
| Workspace key (legacy) | Nobody | Expired, disabled, deleted or workspace archived | Migrate away |
Admin API key (sk-ant-admin...) |
Organization admin | It expires or an admin revokes it | Automation of keys, members, workspaces only |
| Workload Identity Federation | Your cloud or CI identity | Short-lived token expires | Production on AWS, GCP, Azure, GitHub Actions |
Two details matter in practice. First, a key that is not scoped to one workspace must send the anthropic-workspace-id header on every request, otherwise the API answers with a 400 error. Scoping the key to a single workspace avoids that. Second, the Admin API cannot create a usable API key or recover a lost one, and it is not available for individual accounts at all, per the Admin API docs.
Workload Identity Federation deserves a closer look if you already run in a cloud. Your workload exchanges an identity token from AWS IAM, Google Cloud, Entra ID, Okta, GitHub Actions or a Kubernetes service account for a short-lived Claude token. There is no sk-ant string to leak or rotate. Developers who only need a coding agent can skip the key the same way, as our Claude Code Bedrock setup guide shows.
How do workspaces organize keys and costs?
A workspace is a container inside your organization for keys, members, spend limits and rate limits. Every organization has a Default Workspace that cannot be renamed or deleted, and an organization can have up to 100 workspaces by default. We recommend one workspace per environment or product, each with its own spend cap.
Only organization admins can create workspaces, under Settings, Workspaces, Create workspace, as described in the workspaces guide. Roles are assigned per workspace:
| Workspace role | What it can do |
|---|---|
| Workspace User | Playground only |
| Workspace Limited Developer | Create and manage keys, use the API, no session tracing or file downloads |
| Workspace Developer | Create and manage keys, use the API |
| Workspace Admin | Full control over settings and members |
| Workspace Billing | View billing (inherited from the organization billing role) |
Each workspace has two limit tabs: spend limits (monthly cap plus alerts) and rate limits (requests, input tokens and output tokens per minute per model tier). Workspace limits can be lower than the organization limits, never higher, and you cannot set any on the Default Workspace. That last point is a good reason not to run production there.
Be careful with archiving. Archiving a workspace archives every key created in it within seconds, and it cannot be undone. Prompt caches are also isolated per workspace on the Claude API, so splitting one app across two workspaces halves your cache hits.
How do you keep a Claude API key secure?
Treat the key like a password: keep it in a secrets manager or environment variable, never in code, give it an expiration, scope it to one workspace and rotate it on a schedule. Anthropic suggests rotating every 90 days. If a key lands in a public GitHub repository, Anthropic deactivates it automatically.
A minimal least-privilege setup looks like this:
- One key per app and environment. Separate keys for dev, staging and production make revocation painless. The Help Center best practices recommend exactly that.
- Scope to one workspace and give developers the Developer role only in the workspaces they need.
- Set an expiration. Presets are 3 hours, 1 day, 7 days, 30 days, a custom duration or Never. Expiration cannot be changed later, and an organization policy can remove the Never option.
- Inject via environment variable and add
.envto.gitignore. In cloud environments, use encrypted secret storage instead of dotenv files. - Rotate. Create the new key, deploy it, confirm traffic, then delete the old one. Anthropic emails the creator 7 days before expiry for keys with a lifetime of at least 14 days.
- Know the kill switches. Disable is reversible; Delete is permanent.
The SDK reads ANTHROPIC_API_KEY automatically, so the key never needs to appear in code:
# pip install anthropic
# export ANTHROPIC_API_KEY="sk-ant-api03-..." (from your secrets manager)
import anthropic
client = anthropic.Anthropic() # reads ANTHROPIC_API_KEY
message = client.messages.create(
model="claude-sonnet-5",
max_tokens=1024,
messages=[{"role": "user", "content": "Summarise our key rotation policy in three bullets."}],
)
print(next(b.text for b in message.content if b.type == "text"))The GitHub safety net is real but narrow. GitHub scans public repositories, notifies Anthropic, and Anthropic deactivates the exposed key and emails the owner. Private repositories, Slack messages and log files are not covered, so do not rely on it.
What does a Claude API key cost?
The key itself is free. You pay for tokens from a prepaid credit balance, at the same list price for every key: Claude Sonnet 5 costs 2 USD per million input tokens and 10 USD per million output tokens. Credits expire one year after purchase and are non-refundable. Larger organizations can arrange monthly invoicing through sales. Per-token prices on Bedrock and Google Cloud EU endpoints are compared in our Claude API pricing EU guide.
Current list prices from the Anthropic pricing page, in USD per million tokens:
| Model | API model ID | Input | Output |
|---|---|---|---|
| Claude Fable 5.1 | claude-fable-5-1 |
10.00 | 50.00 |
| Claude Opus 5 | claude-opus-5 |
5.00 | 25.00 |
| Claude Sonnet 5 | claude-sonnet-5 |
2.00 | 10.00 |
| Claude Haiku 4.5 | claude-haiku-4-5 |
1.00 | 5.00 |
Your organization also sits in a usage tier with a monthly spend cap, according to the rate limits page: 500 USD on Start, 1,000 USD on Build and 200,000 USD on Scale. When you hit the cap, requests return HTTP 429 with the code enforced_spend_limit_reached until the first of the next month, and SDK retries do not help. New organizations may start in an Evaluation tier with lower limits. On the Start tier, Sonnet 5 allows 1,000 requests and 2 million input tokens per minute.
Our advice: set your own spend limit below the tier cap on day one, and a stricter one per workspace. According to the billing article, failed requests are not charged, but a runaway loop with valid requests is.
Do EU companies need an Anthropic API key at all?
Often not. The Claude API offers inference_geo only as global or us, so an Anthropic key cannot guarantee EU processing. Companies with EU data residency requirements should call Claude through Amazon Bedrock with an IAM role or through Google Cloud with a service account. Neither uses an sk-ant key, and access control stays in your cloud IAM.
This is the part most “get an API key” tutorials skip. Anthropic’s data residency page lists only global (default) and us as inference locations, with a 1.1x price multiplier for US-only. On Bedrock and Google Cloud, the cloud provider is the data processor, and both offer EU-bound endpoints at a 10% premium.
| Route | Credential | EU processing | Sonnet 5 price in/out (USD per MTok) |
|---|---|---|---|
| Claude API | sk-ant key or WIF token |
No (global or US only) | 2.00 / 10.00 |
| Amazon Bedrock, EU profile | IAM role, no key | Yes, EU regions | 2.20 / 11.00 |
Google Cloud, eu multi-region |
Service account, no key | Yes, EU member states | 2.20 / 11.00 |
The same Anthropic Python SDK covers all three. Only the client class and the credential change:
# 1) Claude API with an Anthropic key (global or US processing)
# pip install anthropic | export ANTHROPIC_API_KEY=...
import anthropic
api = anthropic.Anthropic()
api.messages.create(model="claude-sonnet-5", max_tokens=512, messages=[{"role": "user", "content": "Hi"}])
# 2) Amazon Bedrock with IAM, EU inference profile (no Anthropic key)
# pip install -U "anthropic[bedrock]" | credentials from the AWS chain: SSO, role, ECS task role
from anthropic import AnthropicBedrock
bedrock = AnthropicBedrock(aws_region="eu-central-1")
bedrock.messages.create(model="eu.anthropic.claude-sonnet-5", max_tokens=512, messages=[{"role": "user", "content": "Hi"}])
# 3) Google Cloud with a service account, EU multi-region (no Anthropic key)
# pip install -U "anthropic[vertex]" | gcloud auth application-default login, or an attached service account
from anthropic import AnthropicVertex
vertex = AnthropicVertex(project_id="my-eu-project", region="eu")
vertex.messages.create(model="claude-sonnet-5", max_tokens=512, messages=[{"role": "user", "content": "Hi"}])On Google Cloud, the service account needs roles/aiplatform.user. On Bedrock, restrict the IAM policy to the EU inference profile and deny global routing, as shown in our Claude on AWS Bedrock EU setup guide. The Google side, including the eu endpoint and its quotas, is covered in the Claude on Vertex AI in Europe guide. For a legal and contractual comparison of all routes, see our Claude GDPR comparison.
Two trade-offs are worth knowing. The cloud routes lag behind on some features: Bedrock and Google Cloud do not support the Files API, Message Batches or the Admin API. And the Anthropic key remains the fastest way to prototype. Our position: prototype with a personal Anthropic key on synthetic data, then move anything touching personal data to an EU cloud route. What Anthropic does with prompts on each plan is explained in our Claude data privacy guide.
FAQ
The answers below stand alone and reflect the Anthropic documentation as read on 19 September 2026. Console labels and limits change, so check the linked pages before you write them into an internal policy or a data processing agreement.
Is a Claude API key free?
Yes. Creating keys costs nothing, and you can create as many as you need. You pay only for tokens used, from prepaid credits bought under Settings, Billing. Credits expire one year after purchase and are non-refundable. A Claude Pro or Team subscription does not include API usage.
How much does the Claude API cost per request?
It depends on tokens, not requests. Claude Sonnet 5 costs 2 USD per million input tokens and 10 USD per million output tokens. A request with 2,000 input and 500 output tokens therefore costs about 0.009 USD. Batch processing halves the price, and cache reads cost a tenth of the input rate.
Personal key vs. service account key: which one for production?
A service account key. A personal key acts as one person and is archived when that person leaves the organization, which breaks your production system. A service account key belongs to a non-human identity that an admin manages. Even better for cloud workloads is Workload Identity Federation, which replaces the static key with short-lived tokens.
I lost my Claude API key. Can I recover it?
No. The Console shows the full key only once at creation, and the Admin API only returns a redacted hint. Create a new key, deploy it, and then delete the old one. If you suspect the lost key leaked, disable it immediately; disabling is reversible, deleting is not.
Can I keep Claude processing in the EU with an Anthropic API key?
No, not as of September 2026. The Claude API supports only global and US inference locations. For EU processing, use Amazon Bedrock with the eu. inference profile or Google Cloud with the eu multi-region endpoint. Both authenticate with cloud IAM instead of an Anthropic key and cost 10% more than their global option.
Why does my API key return a 400 error about the workspace ID?
Your key is not scoped to a single workspace. Such keys must send the anthropic-workspace-id header with a wrkspc_ ID on every request. Either add the header, for example via default_headers in the Python SDK, or create a new key scoped to one workspace.
Sources
- Anthropic docs: Get your Claude API key (19 September 2026)
- Anthropic docs: Authentication (19 September 2026)
- Anthropic docs: Workspaces (19 September 2026)
- Anthropic docs: Rate limits (19 September 2026)
- Anthropic docs: Admin API (19 September 2026)
- Claude Help Center: How do I pay for my Claude API usage? (19 September 2026)
- Claude Help Center: API key best practices (19 September 2026)
- Anthropic docs: Data residency (18 September 2026)
- Anthropic docs: Pricing (18 September 2026)
- Anthropic docs: Claude on Google Cloud (19 September 2026)
- Anthropic docs: Claude on Amazon Bedrock (InvokeModel) (19 September 2026)