How to Get an Anthropic API Key Safely (and Test It)

To create an Anthropic API key, sign in to the Claude Console, choose the right workspace, make sure the API account has billing credit, then open Settings > API Keys and create a key.

The direct key-management page is platform.claude.com/settings/keys.

That is the short answer. The important part is what happens next: store the key as a secret, give it the smallest practical blast radius, test it without exposing it, and know how to revoke it.

Before you start: Claude chat and the API are separate

A paid Claude plan does not automatically fund API calls.

Anthropic describes Claude paid chat plans and Console API usage as separate products with separate billing. A Pro or Max subscription improves the Claude chat experience, but it does not give an application a reusable API balance.

For direct API access you need:

• a Claude Console account;
• access to the correct organisation and workspace;
• API billing or prepaid usage credit;
• permission to create a key in that workspace; and
• a secure place to store the key.

If a company already uses Claude through Microsoft Foundry, Amazon Bedrock or Google Cloud, stop before creating another direct key. Those routes use their cloud platform's identity and billing model. The Anthropic API overview compares direct access with cloud-platform access.

Step 1: Sign in to Claude Console

Open Claude Console and sign in with the account that should own the integration.

Do not casually create a production integration under an employee's personal account. For a business workload, decide who owns the organisation, who can administer billing, and who can revoke the credential if the original developer leaves.

If you have access to more than one organisation, check the organisation name before buying credit or creating a key. A working key in the wrong organisation is still the wrong key.

Step 2: Choose or create the right workspace

Anthropic workspaces segment API keys and spend by use case. Use that boundary.

For example, do not put a public website, an internal assistant and a development experiment behind one shared key if they can be separated. A practical structure might be:

• customer-support-production;
• customer-support-development;
• website-content-tool; and
• research-sandbox.

This makes cost investigation and emergency revocation much cleaner. If one key leaks, you can revoke the affected workload without breaking every Claude integration in the organisation.

Step 3: Set up API billing

Open the Console billing page and confirm the organisation has usable API credit.

Anthropic's current self-service guidance says API and Workbench use is funded through prepaid usage credits. You can buy credit, see the available balance and optionally configure auto-reload.

Treat auto-reload as a budget decision, not a convenience checkbox. If you enable it:

1. set an intentional low-balance threshold;
2. choose a reload amount that matches expected use;
3. configure spend and rate limits where available;
4. assign someone to review usage; and
5. test what your application does when the balance or a limit is exhausted.

Anthropic says purchased credits expire after one year and are non-refundable under its credit terms. Check the live billing page before funding a large balance.

Step 4: Create the API key

Open API Keys in Claude Console, then:

1. Check that the organisation and workspace are correct.
2. Select Create Key.
3. Give the key a name that identifies the workload and environment, such as support-triage-prod.
4. Choose an appropriate expiry. Anthropic's current documentation says you choose a key's expiration when creating it.
5. Create the key and copy it into your approved secret store.

Use one key per application or deployment boundary where practical. Names such as test, mark-key or website are poor audit clues six months later.

Do not put the full key in a ticket, Teams chat, email, documentation page or screenshot. If a key has already been exposed, delete or revoke it and create a replacement. Editing the screenshot or Git commit afterwards does not make the old credential trustworthy again.

Step 5: Store it as a secret

For a local test, Anthropic's current quickstart uses the environment variable ANTHROPIC_API_KEY.

On macOS or Linux, set it only in the shell session you are using:

export ANTHROPIC_API_KEY="paste-the-key-here"

Then keep application code free of the literal value. Anthropic's official SDKs read ANTHROPIC_API_KEY automatically.

For a deployed application, use the platform's secret facility: for example, a managed secret store, deployment secret or protected environment variable. A .env file can be acceptable for local development only when it is excluded from version control and protected on the device.

Never ship a reusable Anthropic key in browser JavaScript, a Power Apps formula, a mobile app bundle or any other client that an end user can inspect. Put the API call behind a server-side service you control and authenticate callers to that service.

Step 6: Make a safe smoke test

The least error-prone test is Anthropic's official quickstart because it tracks the current SDK and model examples. It creates a local project, reads ANTHROPIC_API_KEY, calls the Messages API and prints the returned text.

Use a tiny prompt such as “Reply with the word ready” and a small output limit. You are proving four things:

• the key authenticates;
• the workspace has billing capacity;
• the selected model is available to that account; and
• the network can reach https://api.anthropic.com.

For a direct REST client, the API overview documents POST /v1/messages and the required authentication/version headers. Copy the live request example from Anthropic rather than freezing an old model ID into a long-lived internal runbook.

After the call, confirm that usage appears against the expected workspace. A successful reply from the wrong workspace is not a successful deployment check.

Common errors

401 or authentication error

Check that the application is reading the expected environment variable, that the key has no pasted whitespace, and that it has not expired or been revoked. Do not print the whole key to debug this. Log only a non-secret key name or internal identifier.

Credit or billing error

Confirm the Console organisation has available API credit and that the workload is using that organisation's key. A Claude chat subscription does not solve an API credit error.

403 or unavailable model

Use Anthropic's current Models documentation and check access for the organisation. Do not assume every account, region or cloud route exposes the same models at the same time.

429 or rate-limit error

Rate limits and spend limits protect the service and account. Use retry handling that respects Anthropic's response guidance, reduce unnecessary parallel calls, and review the workspace's current limits. Do not create extra keys to dodge a legitimate limit.

It works locally but not in production

The deployed environment probably does not have the secret, has it under a different name, or is using the wrong organisation/workspace. Check secret injection and deployment logs without ever logging the value itself.

Rotate or revoke a key

Create a replacement before deleting an in-use key:

1. Create a new key in the same intended workspace.
2. Update the secret in the deployment platform.
3. deploy or restart the workload as required;
4. run a small production smoke test;
5. confirm the new key's workspace usage; and
6. revoke the old key.

Revoke immediately if the key is committed to a public repository, exposed in a client application, posted in a message, or used by an unknown process. Rotation is an incident response action, not proof that no one used the old key.

A production-ready checklist

Before calling the integration finished, confirm:

• the key belongs to a business-owned organisation and the correct workspace;
• API billing and auto-reload rules are understood;
• the key has a useful name and expiry;
• the secret exists only in an approved server-side secret store;
• development and production do not share a key;
• spend and rate behaviour are monitored;
• logs cannot reveal prompts, personal data or credentials accidentally;
• the application handles 401, 403, 429 and temporary service failures; and
• at least two authorised people know how to rotate and revoke the key.

If you are turning experiments like this into a repeatable client service, join The 50x Founder Space for practical AI-automation agency systems and delivery discussions.

Frequently asked questions

Is an Anthropic API key free?

Creating a Console account and key is not the same as receiving free API usage. Anthropic's current self-service API uses prepaid usage credits. Check the live Console billing page and pricing before building around an assumed allowance.

Does Claude Pro or Max include API credit?

No. Anthropic says its paid Claude chat plans and Console API usage are separate products. A chat subscription does not automatically fund API calls.

Where do I create an Anthropic API key?

Sign in to Claude Console, select the intended organisation and workspace, then open platform.claude.com/settings/keys. Create a clearly named key with an appropriate expiry and copy it into a secret store.

Can I put the key in browser JavaScript or a Power App?

No reusable production key should be exposed in client-side code or formulas. Call Anthropic from a server-side service, protect that service, and store the key in its managed secret facility.

What should I do if an Anthropic API key leaks?

Revoke it in Console, create and deploy a replacement, inspect usage and logs for unexpected activity, and remove the exposure. Assume a publicly exposed key is compromised even if you delete the post or commit quickly.