Guide

Claude Code API key and login

Harrowtech.ai · last checked 13 October 2026

Most people sign in to Claude Code with a Claude subscription. An API key from the Claude Console is the other route: it bills by usage, and a key left in your environment can take over from your subscription. This guide covers signing in, using a key on purpose, and the fix for each common error.

Harrowtech.ai is independent of Anthropic. Quick check: run /status inside Claude Code. It shows which credential is active, and when a login and an API key are both set up it marks the one not in use.

Signing in with a subscription

Run claude in your terminal. On first launch it opens your browser to log in, and the terminal shows Login successful when it is done.
If the browser does not open, press c to copy the login URL and paste it into a browser.
If the browser shows a code instead of returning you to the terminal, paste it at Paste code here if prompted. Anthropic says this is common in WSL2, over SSH and in containers. If pasting does nothing, run claude auth login, which reads the code from standard input.
In WSL2, if no browser opens at all, set the BROWSER variable. Anthropic's example is export BROWSER="/mnt/c/Program Files/Google/Chrome/Application/chrome.exe".
To start again cleanly: /logout, close Claude Code, run claude and log in again.
For a work and a personal account side by side, give each its own configuration folder with CLAUDE_CONFIG_DIR. Anthropic's example alias is alias claude-work='CLAUDE_CONFIG_DIR=~/.claude-work claude'.

Pro, Max, Team and Enterprise accounts all sign in this way. Team and Enterprise members use the claude.ai account their admin invited.

Using an API key on purpose

A Claude Console account is Anthropic's route for usage-based billing. Anthropic's authentication page describes it as the option for organisations that prefer API-based billing. There are two ways in.

Option 1: let Claude Code sign in to the Console

Run /login and choose the Anthropic Console account. From v2.1.242, Claude Code then asks how to sign in:

Sign in with your Console account, marked recommended. Claude Code keeps an OAuth login and refreshes it, and creates no API key.
Create an API key, marked legacy. Claude Code creates a Console key for you and stores it with your other credentials.

Unset ANTHROPIC_API_KEY before choosing the first route. If your admin invited you to the Console, they gave you one of two roles: the Claude Code role can only create Claude Code keys, and the Developer role can create any kind.

Option 2: create a key yourself and set it

Sign in at platform.claude.com, or create an account.
Go to Settings, then API keys.
Click Create key. Name it, choose when it expires, set Linked account to yourself or a service account, and optionally pick a workspace.
Copy the key. It starts sk-ant- and the Console shows it only once. Anthropic suggests keeping it somewhere safe such as a secrets manager. A lost key cannot be viewed again; create a new one.

Anthropic recommends a personal key for your own development and a service account key for anything shared, such as a CI pipeline. A personal key stops working if you leave the organisation. If the Create key button is greyed out, your role may not allow it; an organisation admin can change the role or create a service account key.

Then set the key in the shell you start Claude Code from:

export ANTHROPIC_API_KEY="sk-ant-api03-..."
claude

How Claude Code picks the key up

In an interactive session, Claude Code asks once whether to use the key and remembers the answer. To change it later, use the "Use custom API key" toggle in /config, which only appears while the variable is set.
In non-interactive mode (claude -p), the key is always used when present.
The key applies to the terminal and to the tools that wrap it, including the VS Code extension, the Agent SDK and GitHub Actions. The Claude desktop app and cloud sessions ignore it and sign in with OAuth. Cloud sessions always use subscription credentials.
For keys that rotate, Anthropic points to the apiKeyHelper setting, which runs a script that returns a key.
Bare mode (--bare) does not read the long-lived subscription token, so a script that passes --bare needs ANTHROPIC_API_KEY or an apiKeyHelper.

Which credential wins

When several are present, Anthropic's authentication page gives this order, highest first:

1. Cloud provider	When `CLAUDE_CODE_USE_BEDROCK`, `CLAUDE_CODE_USE_VERTEX` or `CLAUDE_CODE_USE_FOUNDRY` is set.
2. `ANTHROPIC_AUTH_TOKEN`	A bearer token, for an LLM gateway or proxy.
3. `ANTHROPIC_API_KEY`	A Console key, once approved.
4. `apiKeyHelper`	The output of your key script.
5. `CLAUDE_CODE_OAUTH_TOKEN`	A one-year token made with `claude setup-token`, for CI and scripts. It needs a Pro, Max, Team or Enterprise plan.
6. Anthropic profile	Profile and federation credentials, as used by Anthropic's `ant` CLI and Workload Identity Federation. Some profiles rank below `/login`; Anthropic's page has the detail.
7. `/login`	Your subscription login, the default for Pro, Max, Team and Enterprise.

That order is why an old key in a shell profile overrides a working subscription. Anthropic notes that a signed-in Claude apps gateway sits outside this list and outranks all of it.

How billing differs

Subscription	Usage is included in the plan, up to its usage limits. On Team and Enterprise, Claude Code draws on each member's seat allowance, which it shares with Claude chat. Usage credits can take you past a limit, and `/usage-credits` manages them.
Console API key	Billed per token to your organisation, from prepaid credits. On first Console sign-in, a workspace called "Claude Code" is created for cost tracking, and admins can set workspace spend limits. When the credits run out, requests fail with `Credit balance is too low`.

Other differences Anthropic lists:

The session cost in /usage is an estimate meant for API users. The Console's Usage page is the authoritative bill. Subscribers see plan usage bars instead.
/usage-credits is not available when signed in with an API key.
Features that need a claude.ai login, such as claude.ai connectors and /schedule, are not available on a Console key or profile.
The prompt cache lasts an hour on a subscription but five minutes by default on an API key, so on a key the first message after a five-minute break reprocesses the full context.

Per-token prices are on Anthropic's pricing page. Claude Code pricing lists them alongside the subscription plans.

Errors and fixes

`Your ANTHROPIC_API_KEY belongs to a disabled organization`, or `API Error: 400 ... This organization has been disabled`	An old `ANTHROPIC_API_KEY` is overriding your subscription. Run `unset ANTHROPIC_API_KEY` (PowerShell: `Remove-Item Env:ANTHROPIC_API_KEY`) and remove the `export` line from `~/.zshrc`, `~/.bashrc` or `~/.profile`. On Windows, also check `$PROFILE` and your User environment variables. If the message says "Update or unset", there is no saved login to fall back to, so run `/login` as well. Then check `/status`.
`Invalid API key · Fix external API key`	Check for typos and that the key has not been revoked in the Console. Run `env \| grep ANTHROPIC` (PowerShell: `Get-ChildItem Env:ANTHROPIC*`). Anthropic warns that tools such as direnv and IDE terminals can load a stale key from a `.env` file. To use your subscription instead, unset the key and run `/login`.
`Credit balance is too low`	Either the Console organisation has run out of prepaid credits, or an approved `ANTHROPIC_API_KEY` is sending requests through the Console when you meant to use your plan. Check the API key row in `/status`. Add credits under Billing in the Console, or unset the key.
`Your organization has disabled API key authentication`	The Console admin has turned keys off. Unset `ANTHROPIC_API_KEY` or remove the `apiKeyHelper` setting, as the message says, then run `/login`. `/login` alone does not help while a key is still set.
`Not logged in · Please run /login`	Run `/login`. If you expected a key to sign you in, check `ANTHROPIC_API_KEY` is set and exported in the shell that started `claude`.
`Login expired · Please run /login`	Claude Code could not renew your saved claude.ai login and cleared it. Run `/login`. Claude Code warns three days before a login expires.
`OAuth token revoked · Please run /login`, or `API Error: 401 OAuth token has expired`	Run `/login`. If you use `CLAUDE_CODE_OAUTH_TOKEN`, make a fresh token with `claude setup-token`, or unset the variable and log in.
`API Error: 401 Invalid authentication credentials`	The account or organisation behind the credential was revoked, disabled or removed. Run `/status` first. If an API key is active, rotate it in the Console or unset it. If only your login is active, run `/login` once; if the error returns, ask your admin to restore access.
`OAuth error: Invalid code. Please make sure the full code was copied`	The code expired or was cut short. Retry quickly, or press `c` to copy the full URL. Over SSH, open that URL in your local browser.
`API Error: 403 Request not allowed`	Pro or Max: check the subscription is active at claude.ai/settings. Console users: confirm the account has the Claude Code or Developer role, which admins set on the Console's Members page. Behind a corporate proxy, check the network set-up.
`Claude Code access has not been granted for this account`	On Enterprise, your role is Custom and none of your custom roles includes Claude Code. An Owner must assign one that does, or change your role to a standard one such as User. Then log in again.

If you are asked to log in again and again, Anthropic suggests checking the system clock, because token checks depend on correct time. On a Mac, a locked Keychain can also cause it; claude doctor reports that case.

What this guide does not cover

It does not cover Amazon Bedrock, Google Cloud's Agent Platform or Microsoft Foundry set-up, LLM gateways, or the managed settings admins use to restrict which login people may use. Anthropic's authentication page covers those. Installing Claude Code is covered in How to install Claude Code.

Sources

Anthropic: Authentication, read 13 October 2026.
Anthropic: Troubleshoot installation and login, read 13 October 2026.
Anthropic: Error reference, authentication and billing errors, read 13 October 2026.
Anthropic: Manage costs effectively, read 13 October 2026.
Anthropic: Quickstart, for the prepaid credits and the "Claude Code" workspace, read 13 October 2026.
Anthropic: Get your Claude API key, read 13 October 2026.