Claude API Key: How to Get One and Use It Safely (2026)

A Claude API key is a secret token from Anthropic's developer Console that authenticates your requests to the Claude API, and getting one takes about two minutes: create a Console account (console.anthropic.com, which now lives at platform.claude.com), open the API Keys page under Settings, and click Create Key. The key is shown once, billing is per token with no monthly fee, and the same key powers the SDKs, raw HTTP calls, and Claude Code in API mode. This guide covers the exact steps, current pricing, rate limits, and the security practices that keep your key from being stolen, verified against Anthropic's official docs as of July 5, 2026.

How to Get a Claude API Key

Getting a Claude API key requires a Claude Console account and takes four steps:

1. Create a Console account. Go to console.anthropic.com (Anthropic's developer Console, now hosted at platform.claude.com) and sign up with an email address. This account is separate from a claude.ai chat account.
2. Add billing. Buy prepaid credits or add a payment method under the billing settings. The API has no free tier, so requests fail until the account is funded.
3. Create the key. Open Settings > API Keys and click Create Key. Name it after the project or environment it belongs to (for example "staging-invoice-agent"), and scope it to a workspace if you use them.
4. Copy it once and store it. Anthropic keys start with sk-ant- and are displayed a single time. Put the key straight into a password manager or secrets manager, then set it as an environment variable where your code runs.

export ANTHROPIC_API_KEY="sk-ant-your-key-here"

# Verify it works with one request
curl https://api.anthropic.com/v1/messages \
  -H "x-api-key: $ANTHROPIC_API_KEY" \
  -H "anthropic-version: 2023-06-01" \
  -H "content-type: application/json" \
  -d '{"model": "claude-sonnet-5", "max_tokens": 100,
       "messages": [{"role": "user", "content": "Say hello"}]}'

Anthropic also ships a keyless option for development machines: the ant CLI's ant auth login opens a browser OAuth flow and stores a short-lived credential the SDKs read automatically, per the official quickstart. For servers and CI, a standard API key (or Workload Identity Federation) remains the right tool.

Claude API Pricing

Claude API pricing is pay as you go, metered per million tokens (MTok) with separate input and output rates and no monthly minimum. Current rates from Anthropic's pricing docs as of July 2026:

Two levers cut those numbers substantially: prompt caching bills repeated context at roughly a tenth of the input rate, and the Batch API processes asynchronous jobs at a 50 percent discount. For a deeper dive into what the newest models cost in practice, see our Claude Fable 5 price breakdown and our guide to using Opus models in the Anthropic API.

Using Your Key: SDKs and Claude Code

Every official surface reads the same ANTHROPIC_API_KEY environment variable, so one export covers the Python and TypeScript SDKs, the ant CLI, and Claude Code. The SDKs need zero configuration beyond it:

pip install anthropic        # Python
npm install @anthropic-ai/sdk  # TypeScript

# Python: the client finds ANTHROPIC_API_KEY automatically
python -c "
import anthropic
msg = anthropic.Anthropic().messages.create(
    model='claude-sonnet-5', max_tokens=100,
    messages=[{'role': 'user', 'content': 'Say hello'}])
print(msg.content[0].text)"

Claude Code in API mode: with ANTHROPIC_API_KEY set (or Console billing selected at login), Claude Code bills per token against your Console account instead of a subscription. That is the standard route for CI pipelines and automation, and the full tradeoff versus Pro and Max plans is covered in our is Claude Code free guide. The same key also drives open-source agents; our OpenClaw Claude setup guide shows that configuration end to end.

Rate Limits and Spend Caps

Claude API accounts are placed on a usage tier (Start, Build, Scale, or Custom) that sets both rate limits and a monthly spend cap, and organizations move up automatically as they use the API, per Anthropic's rate limits documentation. Limits are measured in requests per minute (RPM), input tokens per minute (ITPM), and output tokens per minute (OTPM), enforced per model with a token bucket algorithm.

Three details worth knowing. First, cached input tokens do not count toward ITPM on current models, so prompt caching raises your effective throughput as well as cutting cost. Second, exceeding a limit returns a 429 error with a retry-after header, and the official SDKs retry automatically with backoff. Third, you can set your own spend limit below the tier cap in Console Settings > Limits, which is the single best guard against a runaway agent bill.

Security Best Practices

The most common way Claude API keys leak is developers committing them to public git repositories, according to Anthropic's official API key best practices. The non-negotiables:

• Never commit keys. Keep them in environment variables or a secrets manager, add .env to .gitignore, and never hardcode sk-ant- strings in source. Anthropic participates in GitHub's secret scanning partner program and automatically deactivates keys detected in public repos, which saves you from abuse but also breaks production the moment you leak.
• Scan before you push. Run a tool like Gitleaks locally or in CI so a key never reaches the remote; Anthropic recommends exactly this in its best practices article.
• One key per app and environment. Separate keys (and Console workspaces) per project make rotation painless and blast radius small.
• Do not paste keys into chats, tickets, or third-party tools. Uploading your key to a tool gives that tool's developer access to your account. Treat any key that has been shared anywhere as compromised and rotate it.
• Set spend limits and watch usage. A custom spend limit plus the Console usage dashboards turn a stolen key from a five-figure incident into a capped one.
• Rotate on any suspicion. Creating a replacement key and deleting the old one takes under a minute in Settings > API Keys.

The same rules apply to keys used by autonomous agents, where prompt injection adds another exfiltration path; our OpenClaw API key guide covers agent-specific key handling.

When You Do Not Need an API Key

You do not need a Claude API key for interactive use: the claude.ai apps run on free, Pro, and Max subscriptions with no key involved, and Claude Code runs on Pro and Max logins without Console billing. Developers working locally can also skip static keys with the ant CLI's OAuth login. The API key path is specifically for programmatic access: building products, automation, CI, and agents. Remember the two billing worlds never mix: a $200 Max subscription includes zero API tokens, and $200 of API credits grants no app subscription. Price both against your workload before committing.

Related Guides

• Is Claude Code Free? Plans That Include It
• How to Use Claude Opus in the Anthropic API
• Claude Fable 5 Price: Full Cost Breakdown
• OpenClaw API Key Guide: Setup and Security