Providers / Anthropic API

AI APIs

Anthropic API API keys and credentials

What every Anthropic API credential a founder holds does, whether it expires, and what tends to break. Each fact links to Anthropic API's own docs.

Last checked 2026-11-08 · platform.claude.com

At a glance

How to rotate the Anthropic API key

1. In the Claude Console, open the API keys page and click Create key. Name the key, choose its expiration (a preset of 3 hours, 1 day, 7 days or 30 days, a custom duration, or Never) and set Linked account (yourself for a personal key, a service account for a shared one). You can also scope the key to a workspace. If your organization has a maximum expiration policy, presets and custom durations are limited to it and Never is unavailable. Expiration cannot be changed after creation. Anthropic API docs
2. Replace the old key wherever the workload reads it, typically the ANTHROPIC_API_KEY environment variable or a secrets manager entry. For a key that is not scoped to a workspace, also send the anthropic-workspace-id header. Anthropic API docs
3. Confirm that requests succeed with the new key. Anthropic API docs
4. Disable the old key on the API keys page. Disable is reversible (Re-enable returns it to active) Anthropic API docs
5. Or, through the Admin API, POST /v1/organizations/api_keys/{api_key_id} accepts a status of active, inactive or archived and a name Anthropic API docs
6. Once nothing uses the old key, delete it on the API keys page. Delete is permanent: the key is archived and still appears in List API Keys with status archived. Anthropic API docs

Can the old and new key work at the same time? Anthropic API's docs don't say. The docs' procedure for replacing a workspace key with a personal or service account key creates and deploys the new key, confirms requests succeed, then deletes the old one, which implies the old key keeps working until deleted. The docs do not say this explicitly for other key types and do not state a limit on how many keys can be active at once.

Revoking the old one: Disable the old key (reversible), or delete it (permanent) on the Console API keys page. Per the Admin API overview (https://platform.claude.com/docs/en/manage-claude/admin-api), the Admin API can only read, rename and change the status of existing keys (POST /v1/organizations/api_keys/{api_key_id} with status inactive or archived; GET /v1/organizations/api_keys lists them with expires_at and status). It cannot create API keys. The docs do not document a separate DELETE endpoint for API keys.

Source: platform.claude.com/docs/en/manage-claude/authentication, checked 2026-11-09

Does the Anthropic API key expire?

It's up to you: you can set an expiry for the Anthropic API key.

What breaks when the Anthropic API key expires

After a key expires, requests made with it return a 401 authentication_error. Create a new key to restore access; expired keys cannot be reactivated, only deleted. Anthropic emails the key's creator 7 days before expiry for keys created with a lifetime of at least 14 days, and 1 day before for keys with a lifetime of at least 7 days; shorter-lived keys expire without a warning email. The Console API keys table and the Admin API's expires_at field (null if no expiry) show each key's expiry.

Other things that often go wrong with Anthropic API:

• Key expires and requests start returning 401 authentication_error; no warning for keys with lifetimes under 7 days
• Expiration is set at creation and cannot be extended, so long-lived CI keys need a new key before the old one lapses
• Admin key secret is shown only once; lost Admin keys must be recreated
• Expiry emails go to the key creator; if that person leaves the organization the warning may be missed
• Workspace-scoped keys stop working if the workspace is archived
• Keys in browser code are blocked for CORS on organizations with Compliance API or ZDR enabled

How to rotate the Anthropic Admin API key

1. As an organization member with the admin role, open the Admin keys page in the Claude Console, click Create admin key, give it a name, select a key expiration and click Add. Anthropic API docs
2. Copy the displayed secret and store it in your secrets manager. The full secret is shown only once. Anthropic API docs
3. The Admin key uses the same expiration choices as regular API keys. For API keys, expiration is set at creation and cannot be changed, and an organization maximum expiration policy limits the options; the docs do not restate this separately for Admin keys Anthropic API docs
4. Update the workload to send the new key in the x-api-key header, then confirm that Admin API calls succeed. Anthropic API docs
5. The docs do not describe how to disable or delete an old Admin key in the Console, so check the Admin keys page for controls before relying on one Anthropic API docs

Can the old and new key work at the same time? Anthropic API's docs don't say. The docs do not say whether the old Admin key keeps working after a new one is created, or whether there is a limit on how many Admin keys you can hold.

Revoking the old one: The docs do not say how to disable or delete a Console Admin key. The Disable and Delete controls and the Admin API key endpoints are documented for API keys; whether they cover Admin keys is not stated on the pages read.

Source: platform.claude.com/docs/en/manage-claude/admin-api-keys, checked 2026-11-09

Does the Anthropic Admin API key expire?

It's up to you: you can set an expiry for the Anthropic Admin API key.

What breaks when the Anthropic Admin API key expires

The docs state that an expired API key returns a 401 authentication_error and cannot be reactivated; they do not separately describe an expired Admin key or expiry emails for it. Create a new Admin key.

Each credential

API key (personal, service account or legacy workspace key)

• You choose
• Full access only
• Expiry readable by API

Created in the Console API keys page. Expiration is chosen at creation: presets of 3 hours, 1 day, 7 days, 30 days, a custom duration, or Never. An organization maximum policy can limit presets and remove Never. Expiration cannot be changed after creation. Expired keys return 401 authentication_error and cannot be reactivated; create a new key. Admin API list/get endpoints return expires_at (null if no expiry). Emails go to the creator 7 days before expiry for keys with lifetime of at least 14 days, and 1 day before for lifetime of at least 7 days; shorter keys expire without warning. Disable is reversible; Delete is permanent. Keys can be bound to one workspace (no permission scopes). Personal keys act as the user and are archived when the user leaves the org; service account keys stop when the service account is archived; workspace keys are legacy. The Console key table also shows expiration.

Anthropic API docs

Admin API key (sk-ant-admin01-...)

• You choose
• Full access only

Created by an organization member with the admin role on the Console Admin keys page. Same expiration options as regular API keys, chosen at creation and fixed afterward. Secret is shown only once. Console Admin keys have no selectable scopes and carry full access to every endpoint that accepts Admin keys (service-account and federation endpoints need an org:admin OAuth token instead). Covers Admin API, Usage and Cost APIs, Rate Limits API and related admin endpoints. Admin keys are the most sensitive Anthropic credential: store separately and rotate.

Anthropic API docs

Claude Console account login

• Not documented

Dashboard login at platform.claude.com. Admin API keys can only be created by members with the admin role. Removing a member archives their personal keys; single-workspace personal keys stop working when access is lost.

Anthropic API docs

Renewals and billing

• Claude Console usage-based API billing, billed by usage. Billed by usage.

Usage and Cost Analytics API (beta, header anthropic-beta: analytics-usage-cost-2026-08-24): GET /v1/organizations/analytics/usage (tokens, requests) and GET /v1/organizations/analytics/cost (USD). Group by api_key_id, workspace_id, actor, model. Requires an Admin API key (x-api-key) on Console orgs; Admin key has no scopes. Verified on the official page.

Where to find it in Anthropic API

• Open Claude Console API keys
• Open Claude Console billing (spend limits and usage tier)
• Open Claude Console workspaces

What Anthropic API's docs don't say

We couldn't confirm these from official docs, so don't rely on them either way:

• Console admin key read-only option: none documented (the Console has no scopes)
• Whether actor or user fields in the analytics response include emails (excludes_customer_pii)
• Exact status of the Usage and Cost Analytics API beta
• Rate limits for the analytics endpoints
• Billing plan, prepaid credit, and payment method details
• Enterprise read:analytics key path: not tested, not a Console option
• Value of an organization's maximum expiration policy (configurable per org; no fixed maximum published)
• How to disable or delete a Console Admin key
• Whether Admin keys appear in the List API Keys endpoint
• Whether expiry emails apply to Admin keys
• Whether old and new API keys can be active at once, and any cap on the number of keys
• Whether API status archived equals Console Delete

Rotating or replacing a Anthropic API key

The steps are the same for most providers: make the new key, deploy it everywhere the old one is used, check it works, then revoke the old one. Our guides walk through it:

Sources

• platform.claude.com/docs/en/manage-claude/authentication
• platform.claude.com/docs/en/manage-claude/admin-api-keys
• platform.claude.com/docs/en/manage-claude/admin-api
• platform.claude.com/docs/en/manage-claude/usage-cost-analytics-api
• platform.claude.com/docs/en/api/organization/api_keys/update

Related providers

Keep track of every Anthropic API key

StackHangar stores your Anthropic API keys in an encrypted vault, grouped by the product they belong to, warns you before they expire, and walks you through rotating them. We can't read your secrets.