Claude Code API key: how to use one, and when it costs less than a plan

To run Claude Code on an API key, create a key in the Claude Console, export it as ANTHROPIC_API_KEY and start claude: it asks once whether to use the key, and from then on bills every token to it, even if you are logged in to Pro or Max. Whether that costs less than a plan depends on how much you use it — at my volume, the API would have cost 29 times the plan.

Get a Claude Code API key

Keys live in the Claude Console, not on claude.ai.

• Sign in at platform.claude.com, or create a Console account.
• Open Settings → API keys and click Create key. Name it, choose an expiry, and link it to yourself for your own work.
• Copy it at once. The full key, starting with sk-ant-, is shown only at creation. Lose it and you create a new one.

If Create key is greyed out, your role may not allow it; ask an admin. In a Console organization set up for Claude Code, the Claude Code role can only create Claude Code keys; Developer can create any kind.

How to use Claude Code with an API key

On first launch with the variable set, Claude Code skips the browser login and asks you to approve the key instead. Your answer is remembered. To change it later, use the Use custom API key toggle in /config; the toggle shows only while the variable is set.

Two places the prompt does not cover:

• claude -p uses the key whenever it is present. A script that runs on a machine with the variable set bills the key, whatever you answered interactively.
• Claude Desktop and cloud sessions do not read ANTHROPIC_API_KEY; they use your login. Cloud sessions always bill your subscription.

To keep the key out of your shell, /login and choose the Anthropic Console account. Since Claude Code v2.1.242 it offers two routes: Sign in with your Console account (recommended), which stores a login and creates no key, and Create an API key (legacy), which creates one and keeps it with your other credentials. Unset ANTHROPIC_API_KEY before you sign in this way. The first Console sign-in creates a workspace called "Claude Code" that holds this usage.

apiKeyHelper, for keys that rotate

When the key comes from a vault or expires, point apiKeyHelper in settings.json at a script that prints it:

{
  "apiKeyHelper": "/bin/generate_temp_api_key.sh"
}

Claude Code sends the script's output as the key and reruns it every five minutes by default (CLAUDE_CODE_API_KEY_HELPER_TTL_MS changes that), and again after a 401 or 403. A helper in project or local settings waits for the workspace trust prompt.

Which one Claude Code uses: API key or subscription

With several credentials on the machine, Claude Code takes the first one it finds, in this order:

• 1. A cloud provider, when CLAUDE_CODE_USE_BEDROCK, CLAUDE_CODE_USE_VERTEX or CLAUDE_CODE_USE_FOUNDRY is set.
• 2. ANTHROPIC_AUTH_TOKEN, a bearer token for an LLM gateway or proxy.
• 3. ANTHROPIC_API_KEY, once approved, or always in -p.
• 4. apiKeyHelper output.
• 5. CLAUDE_CODE_OAUTH_TOKEN, the one-year token from claude setup-token. It bills your subscription.
• 6. Anthropic profile and federation credentials.
• 7. The subscription login from /login, the default for Pro, Max, Team and Enterprise.

So an API key you exported months ago for another project, once approved, outranks your Max login. If the key belongs to a disabled or expired organization, authentication can fail.

Switch back to your subscription

Then remove the export line from ~/.zshrc or ~/.bashrc, or the next terminal brings it back. When a login and a key are both configured, /status marks the one that is not in use. If you signed in with a Console account, /logout, then /login with your claude.ai account.

Bedrock, Google Cloud and Foundry keys

A cloud provider outranks every Anthropic credential, and you pay through your cloud bill. Run claude and choose 3rd-party platform at the login prompt for a setup wizard for Bedrock or Google Cloud, or set the variables yourself:

• Amazon Bedrock: CLAUDE_CODE_USE_BEDROCK=1, plus AWS_REGION if your AWS profile sets no region. A Bedrock API key goes in AWS_BEARER_TOKEN_BEDROCK; an AWS profile or access keys work too.
• Where a Bedrock session's dollars land, and who sees them: Claude Code on Bedrock.
• Google Cloud's Agent Platform (formerly Vertex AI): CLAUDE_CODE_USE_VERTEX=1, CLOUD_ML_REGION and ANTHROPIC_VERTEX_PROJECT_ID. It takes Google Cloud credentials, not an API key.
• Microsoft Foundry: CLAUDE_CODE_USE_FOUNDRY=1, ANTHROPIC_FOUNDRY_RESOURCE and ANTHROPIC_FOUNDRY_API_KEY, or Microsoft Entra ID instead of the key.

Claude Code API vs subscription: which costs less

A plan is a flat fee with limits: Pro at $20 a month, Max at $100 or $200, each with a five-hour window and a weekly one. An API key has neither window and no flat fee: every token is billed at list price, within per-minute rate limits. Every plan and rate is in Claude Code pricing, every model's per-token price in Claude API pricing.

Anthropic's own figure, across enterprise deployments, is about $13 per developer per active day and $150–250 a month. At that rate a key costs more than Pro, and about what Max costs.

My machine sits far above that. The same calls priced at API list prices, against what I paid for Max:

$5,898

August at API list prices, on a $200 plan

29×

the plan fee, in August, the one full month

None of these is a bill: on a plan I paid the plan. They are what the same calls cost at list price — and on a key they would not be quite the same calls. On a subscription, within plan usage, the main conversation's prompt cache lives an hour; on an API key it is five minutes unless you set promptCacheTtl to 1h, and the first message after a longer break reprocesses the whole conversation.

• Use a key if your month at list price is under the plan fee you would otherwise pay, or you need -p scripts and CI billed apart from your own plan.
• Keep the plan if your month at list price is well over the fee, or you hit the five-hour window and would rather wait than pay per token.

See what your months cost on a key before you switch

Inside Claude Code, the Session block of /usage prices the current session at list price. It does not add up a month.

Caprock prices every Claude Code call at list price, whether the session ran on a key or a login, and whether or not Caprock started it. Set your plan in its header — Pro, Max, a Team seat, or API / Bedrock — and the Cost screen labels the total to match: on a flat plan, "at API list price · not a bill" with the multiple of your fee; on API / Bedrock, "at API list price · ≈ your bill", with no multiple. On a subscription it also shows the five-hour and weekly windows, read from Claude Code's status line once Caprock's status line is set up (caprock statusline install, which the headless caprock up also offers); on a key Claude Code reports none.

For whole months, caprock export writes every call with its cost_usd. On my machine, today:

$ caprock export events --agent claude --format csv --out claude.csv
300870 events rows → claude.csv
$ awk -F, '$6=="turn.assistant" && $1<"2026-10" {m=substr($1,1,7); usd[m]+=$14} END {for (m in usd) printf "%s  $%.2f\n", m, usd[m]}' claude.csv | sort
2026-07  $6056.39
2026-08  $5898.03
2026-09  $1763.78

July starts on the 18th; from 10 to 28 September my work went to Codex. Claude Code cost per month reads these months in full.

Every dollar it shows is a list-price estimate, as Claude Code's own /usage is; on a plan it sits beside the plan's dollars and the share of the weekly limit the work used. Free, open source; nothing leaves your machine. Install Caprock.