admin-api-keys changedmanage-claude/admin-api-keys
Nearest release: v2.1.312, published under an hour before this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+9added
Lines−9removed
From line
4
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits9to this page, all time
The whole hunk
from line 4, old and new numbered
/
from line 4
44description: Create an Admin API key for your Claude Console or Claude Enterprise organization.
55---
66
7An Admin API key authenticates every API in the **Admin** section of this guide: the [Admin API](https://platform.claude.com/docs/en/manage-claude/admin-api), [Analytics APIs](https://platform.claude.com/docs/en/manage-claude/analytics-api), [Compliance API](https://platform.claude.com/docs/en/manage-claude/compliance-api), [Plugins API](https://platform.claude.com/docs/en/manage-claude/plugins-api), [Claude Tag API](https://platform.claude.com/docs/en/manage-claude/claude-tag-api), [Spend Limits API](https://platform.claude.com/docs/en/manage-claude/spend-limits-api), [Usage and Cost API](https://platform.claude.com/docs/en/manage-claude/usage-cost-api), and [Rate Limits API](https://platform.claude.com/docs/en/manage-claude/rate-limits-api). You do not need a separate key for each API. The one exception is the Admin API's service-account, federation-issuer, and federation-rule endpoints, which accept only an OAuth bearer token with the `org:admin` scope. See [Obtain an OAuth bearer token](https://platform.claude.com/docs/en/manage-claude/admin-api#oauth-bearer-token).
7An Admin API key authenticates every API in the **Admin** section of this guide: the [Admin API](https://platform.claude.com/docs/en/manage-claude/admin-api), [Analytics APIs](https://platform.claude.com/docs/en/manage-claude/analytics-api), [Compliance API](https://platform.claude.com/docs/en/manage-claude/compliance-api), [Plugins API](https://platform.claude.com/docs/en/manage-claude/plugins-api), [Claude Tag API](https://platform.claude.com/docs/en/manage-claude/claude-tag-api), [Spend Limits API](https://platform.claude.com/docs/en/manage-claude/spend-limits-api), [Usage and Cost API](https://platform.claude.com/docs/en/manage-claude/usage-cost-api), and [Rate Limits API](https://platform.claude.com/docs/en/manage-claude/rate-limits-api). You do not need a separate key for each API. The one exception is the Admin API’s service-account, federation-issuer, and federation-rule endpoints, which accept only an OAuth bearer token with the `org:admin` scope. See [Obtain an OAuth bearer token](https://platform.claude.com/docs/en/manage-claude/admin-api#oauth-bearer-token).
88
99Where you create the key depends on which Claude product your organization uses.
1010
from line 13
1313| Your organization | Create the key in | Key prefix | Who can create it | Works with |
1414| ----------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ | -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
1515| **Claude Console** (Claude Platform, `platform.claude.com`) | [Admin keys](https://platform.claude.com/settings/admin-keys) page (`platform.claude.com/settings/admin-keys`) in the Claude Console | `sk-ant-admin01-...` | Organization members with the **admin** role | [Admin API](https://platform.claude.com/docs/en/manage-claude/admin-api), [Usage and Cost API](https://platform.claude.com/docs/en/manage-claude/usage-cost-api), [Rate Limits API](https://platform.claude.com/docs/en/manage-claude/rate-limits-api), [Claude Code Analytics API](https://platform.claude.com/docs/en/manage-claude/claude-code-analytics-api), and the Compliance API [Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed) |
16| **Claude Enterprise** (`claude.ai`) | [claude.ai > Organization settings > API](https://claude.ai/admin-settings/api-access) | `sk-ant-api01-...` | The parent organization's **primary owner** (all linked organizations). An **organization owner** can create one carrying Compliance API scopes only, restricted to their own organization | [User management](https://platform.claude.com/docs/en/manage-claude/user-management) (the Admin API's member, invite, and group endpoints), [Plugins API](https://platform.claude.com/docs/en/manage-claude/plugins-api), [Claude Tag API](https://platform.claude.com/docs/en/manage-claude/claude-tag-api), [Compliance API](https://platform.claude.com/docs/en/manage-claude/compliance-api), [Claude Enterprise Analytics API](https://platform.claude.com/docs/en/manage-claude/analytics-api), and [Spend Limits API](https://platform.claude.com/docs/en/manage-claude/spend-limits-api), according to the [scopes](https://platform.claude.com/docs/en/manage-claude/admin-api-keys#choose-scopes-for-a-claude-enterprise-key) you select |
16| **Claude Enterprise** (`claude.ai`) | [claude.ai > Organization settings > API](https://claude.ai/admin-settings/api-access) | `sk-ant-api01-...` | The parent organization’s **primary owner** (all linked organizations). An **organization owner** can create one carrying Compliance API scopes only, restricted to their own organization | [User management](https://platform.claude.com/docs/en/manage-claude/user-management) (the Admin API’s member, invite, and group endpoints), [Plugins API](https://platform.claude.com/docs/en/manage-claude/plugins-api), [Claude Tag API](https://platform.claude.com/docs/en/manage-claude/claude-tag-api), [Compliance API](https://platform.claude.com/docs/en/manage-claude/compliance-api), [Claude Enterprise Analytics API](https://platform.claude.com/docs/en/manage-claude/analytics-api), and [Spend Limits API](https://platform.claude.com/docs/en/manage-claude/spend-limits-api), according to the [scopes](https://platform.claude.com/docs/en/manage-claude/admin-api-keys#choose-scopes-for-a-claude-enterprise-key) you select |
1717
1818A key created in one organization cannot be used to manage a different organization. If your company uses both Claude Console and Claude Enterprise, create one key in each.
1919
from line 67
6767| Admin API [user management](https://platform.claude.com/docs/en/manage-claude/user-management): change member roles, remove members, and create and withdraw invites (to assign the `managed` role on a role change or an invite, also select `write:rbac_groups`) | `write:members` |
6868| Admin API [user management](https://platform.claude.com/docs/en/manage-claude/user-management): read groups and their members | `read:rbac_groups` |
6969| Admin API [user management](https://platform.claude.com/docs/en/manage-claude/user-management): create, rename, and delete groups; add and remove group members; with `write:members`, assign the `managed` role (on an invite or a role change) or assign groups on an invite | `write:rbac_groups` |
70| [Plugins API](https://platform.claude.com/docs/en/manage-claude/plugins-api): read plugins, versions, installation settings, shares, and marketplaces; download plugin files, including the files of members' personal plugins; validate a marketplace before you connect it | `read:plugins` |
71| [Plugins API](https://platform.claude.com/docs/en/manage-claude/plugins-api): upload plugins and versions; choose which version members are served; delete plugins, including members' personal plugins; set and remove installation settings; set a marketplace's default installation setting; validate a marketplace before you connect it (to read plugins, also select `read:plugins`) | `write:plugins` |
72| [Claude Tag API](https://platform.claude.com/docs/en/manage-claude/claude-tag-api): read Claude Tag's settings on Slack channels and Slack workspaces; list Access bundles and where they are attached (no other scope grants access to the Claude Tag API) | `read:claude_tag` |
70| [Plugins API](https://platform.claude.com/docs/en/manage-claude/plugins-api): read plugins, versions, installation settings, shares, and marketplaces; download plugin files, including the files of members’ personal plugins; validate a marketplace before you connect it | `read:plugins` |
71| [Plugins API](https://platform.claude.com/docs/en/manage-claude/plugins-api): upload plugins and versions; choose which version members are served; delete plugins, including members’ personal plugins; set and remove installation settings; set a marketplace’s default installation setting; validate a marketplace before you connect it (to read plugins, also select `read:plugins`) | `write:plugins` |
72| [Claude Tag API](https://platform.claude.com/docs/en/manage-claude/claude-tag-api): read Claude Tag’s settings on Slack channels and Slack workspaces; list Access bundles and where they are attached (no other scope grants access to the Claude Tag API) | `read:claude_tag` |
7373| [Claude Tag API](https://platform.claude.com/docs/en/manage-claude/claude-tag-api): set up and remove channels; change settings; attach and detach Access bundles (to read as well, also select `read:claude_tag`) | `write:claude_tag` |
74| [Spend Limits API](https://platform.claude.com/docs/en/manage-claude/spend-limits-api): read members' effective spend limits and increase requests | `read:spend_limits` |
74| [Spend Limits API](https://platform.claude.com/docs/en/manage-claude/spend-limits-api): read members’ effective spend limits and increase requests | `read:spend_limits` |
7575| [Spend Limits API](https://platform.claude.com/docs/en/manage-claude/spend-limits-api): set or clear per-user spend limits; approve or deny increase requests | `write:spend_limits` |
7676| [Claude Enterprise Analytics API](https://platform.claude.com/docs/en/manage-claude/analytics-api): engagement, adoption, cost, and usage reports | `read:analytics` |
7777| [Compliance API Activity Feed](https://platform.claude.com/docs/en/manage-claude/compliance-activity-feed): organization-wide activity events | `read:compliance_activities` |
from line 82
8282
8383The Compliance and Analytics APIs must be enabled for your organization before keys with those scopes can be used. See [Set up the Compliance API](https://platform.claude.com/docs/en/manage-claude/compliance-api-access#set-up-the-compliance-api) and [Get access to the Claude Enterprise Analytics API](https://platform.claude.com/docs/en/manage-claude/analytics-api#get-access-to-the-claude-enterprise-analytics-api).
8484
85You can create and use keys with `read:plugins` or `write:plugins` only if your organization can use the Plugins API. The [Plugins API](https://platform.claude.com/docs/en/manage-claude/plugins-api) guide says which organizations can use it. In those organizations, keys with `read:org_audit` or `read:compliance_org_data` can also call the Plugins API's read endpoints, including file downloads, but not marketplace validation. The `read:plugins` and `write:plugins` scopes act only on the organization the key was created in. See [Plugins API scopes](https://platform.claude.com/docs/en/manage-claude/plugins-api#scopes) and [Reading another organization under the same parent](https://platform.claude.com/docs/en/manage-claude/plugins-api#reading-another-organization-under-the-same-parent).
85You can create and use keys with `read:plugins` or `write:plugins` only if your organization can use the Plugins API. The [Plugins API](https://platform.claude.com/docs/en/manage-claude/plugins-api) guide says which organizations can use it. In those organizations, keys with `read:org_audit` or `read:compliance_org_data` can also call the Plugins API’s read endpoints, including file downloads, but not marketplace validation. The `read:plugins` and `write:plugins` scopes act only on the organization the key was created in. See [Plugins API scopes](https://platform.claude.com/docs/en/manage-claude/plugins-api#scopes) and [Reading another organization under the same parent](https://platform.claude.com/docs/en/manage-claude/plugins-api#reading-another-organization-under-the-same-parent).
8686
8787## Use the key
8888
89Pass the key in the `x-api-key` header on every request. See each API's documentation for complete request examples.
89Pass the key in the `x-api-key` header on every request. See each API’s documentation for complete request examples.
9090
91A call that exceeds the key's scopes returns `403 Forbidden` with a message listing the scopes the key has and the scopes the endpoint needs.
91A call that exceeds the key’s scopes returns `403 Forbidden` with a message listing the scopes the key has and the scopes the endpoint needs.
9292
9393## Next steps
9494
No line in this hunk matches that.