How do you get a Claude API key, and keep it safe?

Creating the key

• Sign in to the Claude Console, Anthropic's developer platform, at platform.claude.com.
• Add a payment method or buy credits. API usage is billed separately from Claude.ai subscriptions such as Pro or Max.
• Go to API keys and create a key, ideally in a workspace for this project.
• Copy it immediately. The full key is shown only once.

Using it from your server

This example uses a reserved domain. Replace the host and model with the current endpoint and model ID from the provider's documentation before running it.

curl https://api.claude.example/v1/messages \
  -H "x-api-key: $ANTHROPIC_API_KEY" \
  -H "anthropic-version: 2023-06-01" \
  -H "content-type: application/json" \
  -d '{"model": "claude-sonnet-5-5", "max_tokens": 512, "messages": [{"role": "user", "content": "Hello"}]}'

The official SDKs read ANTHROPIC_API_KEY from the environment automatically. Check the models page in the documentation for current model names before choosing one.

Keeping it safe

• Store it in server-side environment variables only. Call the API from an API route or serverless function, not from the browser.
• Use separate keys for development and production, and separate workspaces for separate projects.
• Set workspace spend limits in the Console, so a leaked key or a runaway loop cannot run up an unlimited bill.
• Rate limit your own endpoints that call Claude, per user and per IP.
• Revoke and replace any key that appears in a repository, screenshot or chat.

A Claude-powered feature with no rate limit and no spend limit is the most expensive kind of bug. Set both before launch.

Common errors

• 401 authentication error: the key is missing, mistyped, revoked or sent in the wrong header.
• 400 with a credit balance message: the account has no credits left.
• 429 rate limit: your usage tier's limit was reached. Retry with backoff and check your tier.
• 529 overloaded: the API is temporarily under heavy load. Retry later.

In AI app builders

Tools such as Lovable, Bolt and v0 can connect to the Claude API. Use their secrets or environment settings for the key, and make sure the call runs in a backend function. If the generated code calls api.anthropic.com from the browser, the key is exposed.

What a scan can and cannot tell you

WebAuditOS does not currently detect API keys inside your JavaScript. It checks related exposure on your site, such as wide-open CORS, HTML error pages with recognizable debug output, and directory listings.

Search your built frontend for the key prefix before launch, and watch usage in the Claude Console.

If usage appears that you cannot explain, revoke the key first and investigate second.

Short answers

Is the Claude API free? No. It is billed per token, separately from Claude.ai plans.

Does Claude Pro include API access? No. The API has its own billing in the Claude Console.

Where do I find my existing key? You cannot view it again. Create a new one and revoke the old one if lost.

Can I use the key in a mobile app? Not directly. Route calls through your own backend.