Authentication

Every API request is authenticated with an API key sent as a bearer token.

API keys#

Keys are created in the dashboard under API keys. Each key:

starts with sk- followed by 48 random characters;
is shown once at creation. Claud stores only a SHA-256 hash, so a lost key must be rotated, not recovered;
can be named, given an expiry date, rotated and revoked at any time;
inherits the plan, balance and rate limits of the account that owns it.

The number of active keys per account depends on your plan (5 on pay-as-you-go and Starter, 20 on Pro and more above). Expired or revoked keys are rejected with 401 invalid_api_key.

Sending the key#

Pass the key in the Authorization header using the Bearer scheme:

HTTP

POST /v1/chat/completions HTTP/1.1
Host: api.claudkey.com
Authorization: Bearer sk-XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Content-Type: application/json

curl https://api.claudkey.com/v1/models \
  -H "Authorization: Bearer $CLAUD_API_KEY"

Requests without a key, or with a malformed one, receive 401 with code: "missing_api_key" or code: "invalid_api_key". See Errors.

`x-api-key` header#

Anthropic-style clients send the key in an x-api-key header instead of Authorization. Claud accepts both on every endpoint, so the Anthropic SDKs, Claude Code and tools with an "Anthropic base URL" setting work as-is. See SDKs & libraries.

HTTP

POST /v1/messages HTTP/1.1
Host: api.claudkey.com
x-api-key: sk-XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
anthropic-version: 2023-06-01
Content-Type: application/json

Account requirements#

Beyond a valid key, a request is accepted only if the owning account is in good standing:

Condition	Result
Email address not verified	`403 email_not_verified`
Account suspended or pending deletion	`403 account_inactive`
Account, key or network on the blocklist	`403 account_blocked`, `api_key_blocked`, `ip_blocked`
Balance below the minimum reservation	`402 insufficient_balance`
Model not included in your plan	`403 model_not_in_plan`
Platform in maintenance mode	`503 maintenance_mode`

Key management over the API#

You can list your keys with GET /v1/api-keys using any key. Creating, rotating and revoking keys, however, is only possible from a signed-in dashboard session, never from another API key. This limits the damage a leaked key can do: it cannot mint new credentials for itself. See the API keys reference.

Keeping keys safe#

Never ship a key to a browser or mobile app

Anything you send to a client can be extracted. Call Claud from your own backend and let your clients talk to you.

Load keys from environment variables or a secret manager; keep them out of source control.
Use one key per application or environment so you can rotate or revoke without collateral damage and attribute usage on the Usage page.
Set an expiry date on keys used for experiments and CI jobs.
Rotate immediately if a key may have leaked: Rotate creates a replacement and revokes the old key in a single step, and the audit trail records both events.
Watch for x-claud-balance dropping unexpectedly or unfamiliar requests in your usage log; they are the fastest signals of a compromised key.

If you believe a key has been exposed and you cannot reach the dashboard, open a ticket from Support and we will revoke it for you.