How to Get Your Claude AI API Key in 2026

Getting a Claude AI API key takes about five minutes: create an account at platform.claude.com, add billing, open the API Keys page, and generate a key. The key is shown exactly once, starts with sk-ant-, and authenticates every request you send to the Claude API. This guide walks through each step, explains workspaces, and covers the security practices and common errors — especially the dreaded 401 — that I see developers hit in their first week.

TL;DR: Sign up at platform.claude.com, add a payment method under Billing, then go to API Keys and click “Create Key”. Copy it immediately — it’s shown once. Store it in an ANTHROPIC_API_KEY environment variable, never in code or git. Use separate keys per environment via workspaces. A 401 error almost always means a missing header, a revoked key, or a shell that didn’t export the variable.

Before you start: what a Claude AI API key gets you

An API key authenticates requests to Anthropic’s Messages endpoint — the interface behind every programmatic Claude integration. It is completely separate from a claude.ai login: a Pro or Max subscription includes no API credits, and API spending never counts against chat limits. API usage is pay-as-you-go, billed per token, so you’ll need a payment method on file before making sustained calls (new accounts get a small free credit for testing). If you’re not sure whether you need the API at all, the Claude API developer’s guide explains what the platform offers before you commit.

Step-by-step: getting your Claude AI API key in 2026

1. Create a Console account. Go to platform.claude.com and sign up with an email address or Google account. This Console account is independent of any claude.ai account, even if you use the same email.
2. Add billing. Open Settings → Billing and add a credit card, or buy prepaid credits. Without billing you can explore the Console and Workbench, but real request volume needs a funded account.
3. Pick a workspace. Every account has a Default workspace. For anything beyond a solo experiment, create one workspace per project or environment (more on this below).
4. Generate the key. Navigate to Settings → API Keys, click “Create Key”, give it a descriptive name like myapp-production, and select its workspace.
5. Copy it now. The full key — the string beginning with sk-ant- — is displayed exactly once. If you lose it, you can’t retrieve it; you revoke and re-create. Paste it straight into your secrets manager or environment configuration.
6. Verify it works. Run the test request below before writing any application code.

curl https://api.anthropic.com/v1/messages \
  -H "x-api-key: $ANTHROPIC_API_KEY" \
  -H "anthropic-version: 2023-06-01" \
  -H "content-type: application/json" \
  -d '{
    "model": "claude-haiku-4-5",
    "max_tokens": 64,
    "messages": [{"role": "user", "content": "Reply with the single word: pong"}]
  }'

A JSON response containing "pong" means your key, billing, and headers are all correct. I run this exact command every time I provision a new environment — it isolates key problems from code problems.

Workspaces: one key per environment

Workspaces are the Console’s isolation unit. Each workspace gets its own API keys, its own spend limits, and its own usage reporting. The pattern that has served me well: a dev workspace with a low monthly cap for experiments, a staging workspace for CI, and a production workspace with alerting on spend. When a dev key leaks or a test script runs away, the blast radius is one capped workspace — not your production budget. Keys are scoped to the workspace they were created in and cannot see resources in others.

Storing the key: environment variables done right

Every official Anthropic SDK reads the ANTHROPIC_API_KEY environment variable automatically, so a correctly configured environment means zero key-handling code. On macOS or Linux, add it to your shell profile:

# macOS / Linux — add to ~/.zshrc or ~/.bashrc
export ANTHROPIC_API_KEY="sk-ant-your-key-here"

# Windows PowerShell — persists for your user account
setx ANTHROPIC_API_KEY "sk-ant-your-key-here"

With the variable set, client construction takes no arguments:

import anthropic

client = anthropic.Anthropic()  # picks up ANTHROPIC_API_KEY automatically

message = client.messages.create(
    model="claude-sonnet-5",
    max_tokens=256,
    messages=[{"role": "user", "content": "Confirm the API key works."}],
)
print(message.content[0].text)

For projects, a .env file loaded by python-dotenv or your framework works well — as long as .env is in .gitignore. In production, prefer a real secrets manager (AWS Secrets Manager, GCP Secret Manager, Vault, or your platform’s encrypted config) over baked-in environment files.

API key security best practices

• Never commit keys. Add .env to .gitignore before your first commit, and run a secret scanner (gitleaks, GitHub secret scanning) in CI. A key pushed to a public repo should be treated as compromised the moment it lands.
• Never ship keys to browsers or mobile apps. Anything delivered to a client can be extracted. Calls to the Claude API belong behind your own backend endpoint.
• One key per app and environment. Shared keys make revocation a coordinated outage instead of a one-click fix.
• Rotate on departure and on suspicion. Create the replacement key first, deploy it, then revoke the old one — revocation is immediate.
• Set workspace spend limits. A monthly cap on the dev workspace converts a leaked key from a financial incident into an annoyance.
• Watch usage in the Console. An unfamiliar spike in the usage dashboard is often the first sign of a leaked key.

Common errors and what they actually mean

Error	Typical cause	Fix
401 authentication_error	Missing x-api-key header, revoked key, or unset env variable	Echo the variable in the failing shell; re-send with the curl test above
403 permission_error	Key’s workspace lacks access to the model or feature	Check workspace settings in the Console
404 not_found_error	Typo in the model ID (e.g. claude-sonnet-5.0)	Use exact IDs: claude-sonnet-5, claude-opus-4-8, claude-haiku-4-5
400 invalid_request_error	Malformed body, or legacy params like temperature on current models	Read the error message — it names the offending field
429 rate_limit_error	Tier limit exceeded	Honor retry-after; see the rate limits guide below

The 401 deserves special attention because it has three distinct flavors. First, the header is literally missing — common when a proxy strips it or you typed Authorization instead of x-api-key. Second, the key is invalid — revoked, truncated during copy-paste, or containing a stray newline from a password manager. Third, the environment variable isn’t visible to the process — set in your shell but not in the systemd unit, Docker container, or cron job actually running the code. Printing the first ten characters of the key from inside the failing process settles it in seconds. If you’re being throttled rather than rejected, that’s a 429 — a different problem covered in the Claude API rate limits guide.

Rotating and revoking keys without downtime

Revocation in the Console is immediate — the moment you click it, every request using that key starts returning 401s. That’s exactly what you want for a leaked key and exactly what you don’t want for a routine rotation, so the order matters: create the new key first, deploy it to your secrets manager or environment, confirm traffic is flowing on the new key in the usage dashboard, and only then revoke the old one. In CI systems, store the key as a masked secret (GitHub Actions secrets, GitLab CI variables) and inject it as ANTHROPIC_API_KEY at job time — never echo it in build logs. I rotate production keys on a calendar schedule as well as on events; a quarterly rotation costs five minutes and means any silent leak has a bounded lifetime.

What people get wrong about Claude API keys

• Expecting a Pro subscription to include one. It doesn’t. Console billing is separate, and there’s no bundled API allowance with any claude.ai plan — the plans are compared in is Claude AI free.
• Hardcoding the key “temporarily”. Temporary hardcoding has a way of becoming a permanent commit. Start with the environment variable; it’s genuinely less work.
• Reusing one key everywhere. When it leaks — and shared keys leak — you get to redeploy every service at once.
• Confusing Console credit with claude.ai usage. Two products, two bills. Spending $50 on API credits changes nothing in the chat app.
• Not testing with curl first. Debugging authentication through six layers of framework wastes an afternoon; the one-line curl test isolates it immediately.

Next steps

With a working key in your environment, the natural next step is the Claude API tutorial — a complete first integration in Python, from install through streaming and error handling. The API section collects everything else: pricing, rate limits, and per-language guides. For request schemas and the authentication reference, Anthropic’s official docs are the source of truth.

FAQ