Claude Code API key: where to set ANTHROPIC_API_KEY
Claude Code reads ANTHROPIC_API_KEY from your environment, and it outranks your Pro or Max login. Where to set it, how billing changes, and how to keep it out of Git.
Claude Code reads your API key from the ANTHROPIC_API_KEY environment variable. Run export ANTHROPIC_API_KEY="sk-ant-...", start claude, and approve the key once when asked. A set key outranks your Pro or Max /login, so usage is billed to your Console account at API rates. unset ANTHROPIC_API_KEY returns you to your subscription; /status shows which one is active.
This is an independent, unofficial guide; claude/for is not affiliated with Anthropic or GitHub. Every behavior below comes from Anthropic's documentation, reopened on October 22, 2026, and linked at the claim.
Do you even need an API key?
Probably not, if you pay for Claude. Anthropic's authentication guide lists subscription OAuth from /login as "the default for Claude Pro, Max, Team, and Enterprise users." You type claude, a browser opens, you sign in, and your plan's usage pays for the work.
An API key makes sense when you have no subscription and want pay-as-you-go billing, when your company bills Claude Code through the Claude Console, or when a script needs a credential with no browser. If you are unsure which costs less for you, read the Claude Code pricing guide before creating a key.
Get a key from the Claude Console
Anthropic's Get your Claude API key page gives the path:
Sign in to the Console
Go to platform.claude.com and sign in, or create an account.
Open API keys
The page lives at platform.claude.com/settings/keys.
Click Create key
Name it, pick an expiration, and set Linked account to yourself or a service account. You can scope it to one workspace.
Copy it once
The full key starts with sk-ant- and the Console shows it only at creation. Lost keys cannot be viewed again; create a new one.
Pick the key type deliberately. Anthropic says to "use a personal key for your own development, and a service account key for anything shared." Expiration options run from 3 hours to 30 days, a custom duration, or Never, and the authentication reference notes that expiration cannot be changed after creation.
Set it for one shell or every session
For the current terminal only, on macOS, Linux or WSL:
export ANTHROPIC_API_KEY="sk-ant-api03-your-key"
claude
In Windows PowerShell, the equivalent is $env:ANTHROPIC_API_KEY = "sk-ant-api03-your-key". Close the terminal and the key is gone, which is the safest way to try it.
To make it permanent, add the export line to your shell profile (~/.zshrc or ~/.bashrc). Be aware that this applies to every project and every session, including ones where you meant to use your subscription. That is the most common way people get surprise API bills.
Per project
Claude Code does not document loading a .env file by itself. Its error reference warns that "tools like direnv, dotenv shell plugins, and IDE terminals can load a stale key from a .env file in your project without you setting it explicitly." So a per-project key works through one of those tools, not through Claude Code.
If you prefer Claude Code's own settings, keep any credential in .claude/settings.local.json, never in .claude/settings.json. Anthropic's settings guide says the shared file is meant to be committed so teammates get it.
API key vs Pro or Max login: which one is billed
When several credentials exist, the authentication precedence list puts ANTHROPIC_API_KEY above apiKeyHelper, CLAUDE_CODE_OAUTH_TOKEN, and your /login subscription. Only cloud-provider settings and ANTHROPIC_AUTH_TOKEN rank higher.
What happens when both are set:
- Interactive sessions prompt you once to approve or decline the key, and remember the choice. The "Use custom API key" toggle in
/configchanges it later, and only appears while the variable is set. - Non-interactive runs (
claude -p) always use the key when present, with no prompt. - Billing follows the key. Anthropic's support article on managing API key environment variables says you'll be charged "via API pay-as-you-go rates using the API account associated with that key."
unset ANTHROPIC_API_KEY, remove the line from your profile, and relaunch claude.The Claude moves worth stealing, by email
Workflows tested on real jobs, sent only when they are worth it. Free.
Check what is active with /status
Type /status inside Claude Code. Anthropic's documentation says that "when a login and an API key are both configured, /status marks the credential that isn't in use." Outside Claude Code, env | grep ANTHROPIC lists any Anthropic variables your shell has picked up, which catches keys a .env loader set behind your back.
Anthropic's support article suggests running /status "periodically to verify your current authentication method." It costs one second and saves a billing argument.
apiKeyHelper for rotating keys
If you would rather not keep a static key in your environment at all, the apiKeyHelper setting runs a shell command that prints a credential. Anthropic's example:
{
"apiKeyHelper": "/bin/generate_temp_api_key.sh"
}
Claude Code caches the output and reruns the command after five minutes by default (change it with CLAUDE_CODE_API_KEY_HELPER_TTL_MS), after a 401 or 403 error, or when a cached JWT has expired. Point the script at your password manager or vault CLI, and the key never sits in a file Claude Code can read.
Naming the variable in .env, .env.local and .env.example
The variable Claude Code and Anthropic's SDKs read is ANTHROPIC_API_KEY, exactly that. Anthropic's environment variable reference does not document a CLAUDE_TOKEN or CLAUDE_API_KEY variable, so those names do nothing for Claude Code. The other documented credential variables are ANTHROPIC_AUTH_TOKEN (for gateways) and CLAUDE_CODE_OAUTH_TOKEN (for subscription tokens).
A shareable .env.example names the variable and leaves the value empty or obviously fake:
ANTHROPIC_API_KEY=
# or
ANTHROPIC_API_KEY=your-key-here
Your real value goes in .env or .env.local, which must never be committed. The same rule applies to any other provider key in the file.
Keep .env out of Git, before the key exists
Add the ignore rule first:
.env
.env.*
!.env.example
Order matters: Git's .gitignore documentation says ignore rules do not affect files already tracked. Then prove it worked.
Tested with Git 2.46.0 in a fresh disposable repository on July 12, 2026, with a .env holding only a synthetic value:
git check-ignore -v .env
git status --short --ignored -- .env .env.example .gitignore
git ls-files .env
Our observed status was ?? .env.example, ?? .gitignore and !! .env. The !! means Git ignores .env, and git ls-files .env printed nothing. Before each commit, read git diff --cached --name-only: .env should never appear. This is the evidence-first habit from the guide to make Claude Code verify its work.
An ignored .env is still plaintext on disk. Claude Code can deny itself Read(./.env) through permission rules, but Anthropic's permissions documentation notes that a Python or Node script can still open files itself, so treat the deny rule as one layer, not a wall.
If your key leaks
Revoke first, investigate second. Anthropic's API key best practices article says to go to the API keys page in the Console, open the menu next to the key, and select Delete API key. Then create a replacement and update wherever the old one lived.
The same article describes a GitHub partnership: GitHub scans public repositories for exposed Claude API keys and notifies Anthropic, and "Anthropic automatically deactivates the exposed API key," then emails the affected user. That covers public repositories only, so do not count on it for a private repo, a log, or a screenshot.
Deleting the file from your latest commit does not remove it from history. GitHub's sensitive data removal guide explains the coordinated cleanup, but a rotated key makes the old copy worthless, which is why rotation comes first.
Using a key in CI
In GitHub Actions, store the key as a repository secret named ANTHROPIC_API_KEY and pass it to the action's anthropic_api_key input. Anthropic's GitHub Actions guide is blunt: "Never commit API keys or OAuth tokens directly to your repository."
Subscribers can run claude setup-token instead, which prints a one-year OAuth token for the CLAUDE_CODE_OAUTH_TOKEN variable and bills your plan. For a secret shared across many repositories, Anthropic recommends a Console API key, because the OAuth token is tied to one person's subscription. Cloud routines are different again: the Routines guide explains why they cannot see your laptop's environment.
New to terminals and environment variables? Claude Code for non-developers covers the basics first.
Where does Claude Code store my API key?
If you export ANTHROPIC_API_KEY, it lives wherever you put it: your shell session or profile. Credentials from /login go in the macOS Keychain, or in ~/.claude/.credentials.json on Linux and Windows, according to Anthropic's authentication documentation.
Does Claude Code use my API key or my Pro subscription?
The API key, once you approve it, and always in claude -p runs. Anthropic ranks ANTHROPIC_API_KEY above subscription login. Run unset ANTHROPIC_API_KEY to fall back to Pro or Max, and check /status to confirm.
Does Claude Code read my .env file automatically?
Anthropic does not document that. A .env file reaches Claude Code when direnv, a dotenv shell plugin, or your IDE terminal loads it into the environment, which is also how a stale key can switch your billing without you noticing.
What happens if I push my Claude API key to a public GitHub repo?
Anthropic says GitHub secret scanning reports exposed Claude API keys in public repositories, and Anthropic automatically deactivates them and emails you. Still delete the key in the Console yourself, create a new one, and clean the repository history.