ANTHROPIC_API_KEY
A Claude Code environment variable, read out of the shipped bundle. It has been in the build since v2.1.138, including the newest one read.
API key sent as X-Api-Key header. When set, this key is used instead of your Claude Pro, Max, Team, or Enterprise subscription even if you are logged in. In non-interactive mode (-p), the key is always used when present. In interactive mode, you are prompted to approve the key once before it overrides your subscription. To use your subscription instead, run unset ANTHROPIC_API_KEY
Anthropic's own wording. Read off Environment variables, captured 2026-09-28.
In the changelogs
34Releases whose published page names ANTHROPIC_API_KEY.
-
v2.1.307
Sign-in error for environment management no longer built in place
The error shown when you are not signed in for environment management now comes from elsewhere in Claude Code, and its wording may differ
found in this entry's text
-
v2.1.307
Environment management needs
claude login, not an API keyA reworded error says environment-management features need you signed in with
claude loginand do not work withANTHROPIC_API_KEYnamed in this entry, found in this entry's text
-
v2.1.305
claude plugin evalpasses your session's API key to its test runsWith an API key session,
claude plugin evalnow hands the key to its test runs itself, except on Windows, where you must setANTHROPIC_API_KEYfound in this entry's text
-
v2.1.304
Organisation policy limits are re-fetched as soon as the API refuses a request
When the API refuses a request over an organisation policy the session has not loaded, Claude Code re-fetches its policy limits straight away
found in this entry's text
-
v2.1.300
Analytics now note where your sign-in credential came from
Some analytics events now record how the credential was supplied, such as an environment variable, a file descriptor or none at all
found in this entry's text
-
v2.1.296
Cloud sessions message names the key or token whose organization was checked
When cloud sessions are blocked by organization policy, the message now says which API key or token Claude Code checked the policy for
found in this entry's text
-
v2.1.288
/login in bare mode explains why it won't sign you in
In bare mode,
/loginnow prints an explanation instead of a sign-in that would have no effectfound in this entry's text
-
v2.1.286
Keys managed through /login are now labelled as API keys, not claude.ai
Claude Code now reports a key managed through
/loginas an API key rather than a claude.ai loginfound in this entry's text, named in this entry
-
v2.1.285
Detection of sign-in forwarded over SSH now checks for a placeholder
Claude Code recognises SSH-forwarded sign-in when a socket is set and exactly one credential variable holds the value ssh-placeholder
found in this entry's text
-
v2.1.285
Bedrock, Mantle and Vertex connections share headers and can send your API key
Bedrock, Mantle and Vertex clients now share one set of headers and add an
X-Api-Keyheader fromANTHROPIC_API_KEYunless one is setfound in this entry's text
-
v2.1.284
Bedrock and Vertex model-access checks are remembered for 15 minutes
A successful check that your cloud provider gives you access to a model is now saved on disk and reused for 15 minutes
found in this entry's text
-
v2.1.284
Clearer error when a managed login policy clashes with your API key or token
When managed settings require a specific sign-in but another credential is set, the error names that credential, where it came from, and how to fix it
found in this entry's text
-
v2.1.282
/install-github-appcan be stopped part-way and lists what it already didPressing Esc during
/install-github-appnow stops after the current step and reports which steps were already completed in the repositoryfound in this entry's text
-
v2.1.275
apiKeyHelper case removed from dead switch in Op
A dead code path's switch statement dropped an unused apiKeyHelper case
found in this entry's text
-
v2.1.267
Auth check shortcut for ANTHROPIC_UNIX_SOCKET sessions
Sessions using ANTHROPIC_UNIX_SOCKET now skip most auth checks and rely only on token/key presence
found in this entry's text
-
v2.1.248
Console profile login refusals are classified
Console profile login refusals now say which condition blocked you, like an API key in your environment.
found in this entry's text
-
v2.1.248
Command analysis sees through wrappers and ignores benign env prefixes
Command parsing now looks past wrappers like sudo and timeout and ignores harmless variable prefixes.
found in this entry's text
-
v2.1.242
Console "profile" sign-in that stores credentials per profile
A per-profile sign-in can store logins under a named profile, but it is switched off here.
found in this entry's text
-
v2.1.235
Policy-helper subprocess environment scrubbing moved and hardened
Policy-helper environment scrubbing moved into its own module and now strips more variables
found in this entry's text
-
v2.1.235
Policy helpers can now be delivered by remote settings, but only after an explicit consent record — and they run in a scrubbed environment
Remote-delivered policy helpers now require explicit consent and run with a scrubbed environment
found in this entry's text
-
v2.1.234
SDK reports where an API key actually came from
The SDK now reports where an API key really came from, like the env var or an apiKeyHelper.
named in this entry, found in this entry's text
-
v2.1.233
Auth preflight before plugin eval runs
Plugin eval checks your credentials up front and fails fast instead of dying partway through a run.
named in this entry, found in this entry's text
-
v2.1.224
Artifact tool now explains exactly which credential is blocking it
The artifact tool now names the exact credential blocking you, with a fix for each.
named in this entry, found in this entry's text
-
v2.1.223
Settings-supplied API and credential env vars are stripped when ANTHROPIC_UNIX_SOCKET is set
When you connect through a unix socket, settings files can no longer override your API keys or endpoint.
named in this entry, found in this entry's text
-
v2.1.221
Artifact environment variables, with the API token treated as a credential
Three artifact environment variables are now recognised, with the API token stripped from spawned processes as a secret.
found in this entry's text
-
v2.1.221
Artifact credentials and artifact base URLs are stripped from child process environments
Artifact tokens and artifact base URLs no longer leak into processes Claude spawns.
named in this entry, found in this entry's text
-
v2.1.212
CLAUDE_CODE_SIMPLE Environment Variable
found in this entry's text
-
v2.1.172
Ultra (Cloud Review) — Improved Auth Error Messages
found in this entry's text
-
v2.1.139
Remote Control Diagnostics Are More Specific
found in this entry's text
-
v2.1.79
Subprocess Environment Scrubbing
found in this entry's text
-
v2.1.76
Disabled Organization Error Handling
found in this entry's text
-
v1.0.111
Environment Variable Whitelist
found in this entry's text
-
v1.0.70
Enhanced Security Model
found in this entry's text
-
v1.0.16
Authentication and API Key Handling
found in this entry's text
First cited
6The earliest release whose published evidence quoted ANTHROPIC_API_KEY was v2.1.76, 14 Mar 2026. That is the oldest release this project wrote about it, so it is a floor on the name's age and not the release that introduced it. It is not a presence reading: which builds carried the name is the table below.
Presence across releases
1Build by build
149One row per release since the first build this name was read out of. Absent means the build was read and the name was not in it, never mined means no bundle for that release was ever archived, and a declared type or a default is only ever what that release's own bundle stated.
Read out of the published npm bundle release by release, and out of Anthropic's own documentation as this site captured it. Nothing on this page is a description anybody here wrote about what the environment variable does. All environment variables.