authentication changedmanage-claude/authentication
Nearest release: v2.1.318, published 4 hours before this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+13added
Lines−3removed
From line
42
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits17to this page, all time
### Browser-based applications
The whole hunk
from line 42, old and new numbered
/
from line 42
4242```http
4343POST /v1/messages
4444Authorization: Bearer YOUR_API_KEY
45anthropic-version: 2023-06-01
45anthropic-version: 2026-10-21
4646content-type: application/json
4747```
4848
from line 54
5454 ```bash cURL
5555 curl https://api.anthropic.com/v1/messages \
5656 -H "x-api-key: $ANTHROPIC_API_KEY" \
57 -H "anthropic-version: 2023-06-01" \
57 -H "anthropic-version: 2026-10-21" \
5858 -H "content-type: application/json" \
5959 -d '{
6060 "model": "claude-opus-5-5",
from line 137
137137 # Omit the anthropic-workspace-id header for a key scoped to one workspace.
138138 curl https://api.anthropic.com/v1/messages \
139139 -H "x-api-key: $ANTHROPIC_API_KEY" \
140 -H "anthropic-version: 2023-06-01" \
140 -H "anthropic-version: 2026-10-21" \
141141 -H "anthropic-workspace-id: wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ" \
142142 -H "content-type: application/json" \
143143 -d '{
from line 351
3513513. **Create the new key.** Create it specifically for the integration’s workspace unless the integration needs multiple workspaces.
3523524. **Deploy the new key.** Replace the old key wherever the integration reads it, typically the `ANTHROPIC_API_KEY` environment variable or a secrets manager entry. For a key that isn’t scoped to a workspace, also send the `anthropic-workspace-id` header as shown in [Select a workspace](https://platform.claude.com/docs/en/manage-claude/authentication#select-a-workspace).
3533535. **Delete the old key.** Confirm that requests succeed, then delete the workspace key on the [API keys page](https://platform.claude.com/settings/keys) in the Claude Console.
354
355### Browser-based applications
356
357Call the Claude API from your own back end, not from code that runs in your users’ browsers. Anyone who uses a webpage can read an API key in that page’s code. Typically, your web front end calls your back end, which holds the key and calls the Claude API.
358
359A request sent directly from a browser is a cross-origin (CORS) request. The API accepts these requests only when they include the `anthropic-dangerous-direct-browser-access: true` header, which the TypeScript SDK sends when you set `dangerouslyAllowBrowser` to `true`. For the cases where exposing a key this way is acceptable, see [Browser usage](https://platform.claude.com/docs/en/cli-sdks-libraries/sdks/typescript#runtime-support) in the TypeScript SDK guide.
360
361Organizations that have [zero data retention (ZDR)](https://platform.claude.com/docs/en/manage-claude/api-and-data-retention#zero-data-retention-zdr-scope) or the [Compliance API](https://platform.claude.com/docs/en/manage-claude/compliance-api-access#set-up-the-compliance-api) enabled cannot call the API directly from a browser, even with that header. Other organization settings can have the same effect, and no setting allows browser requests for these organizations. The API returns a 401 `authentication_error` whose message begins `CORS requests are not allowed for this Organization`, even though the API key is valid. A Claude Console organization linked to a Claude Enterprise parent organization inherits the Compliance API setting from the parent. The restriction can therefore apply even when your Claude Console settings show no Compliance API section.
362
363The restriction applies only to requests that include an `Origin` header, which browsers add and server-side HTTP clients normally do not. Requests from your own back end are not affected. If your back end forwards requests that start in a browser, have it create a new request to the Claude API. Don’t pass the browser’s request through. That request still includes the browser’s `Origin` header, and the API rejects it the same way.
354364
355365## Workload Identity Federation
356366
No line in this hunk matches that.