ANTHROPIC_API_KEY and ANTHROPIC_AUTH_TOKEN: where to get a key and where to set it

The question "where to get an anthropic_api_key" is really two questions: where the key itself comes from and which environment variable to put it in. The second part causes more confusion: the Anthropic SDK and Claude Code use different variables, and a key placed in the wrong one gives an authorization error or makes the program look for a subscription login. Below: what each variable is for, how to set it on three systems and how not to publish the key by accident.

Two variables: how they differ

According to the Claude Code documentation (the "Environment variables" page), ANTHROPIC_API_KEY is sent as the X-Api-Key header, and when it is set it is used instead of your subscription login even if you are signed in. In interactive mode Claude Code asks you once to approve using the key. ANTHROPIC_AUTH_TOKEN sets the value of the Authorization header, with Bearer prepended.

The practical rule for a Zukko key follows:

• in Claude Code use ANTHROPIC_AUTH_TOKEN and ANTHROPIC_BASE_URL=https://api.zukko.pro;
• in the Anthropic SDK (Python, TypeScript) ANTHROPIC_API_KEY and ANTHROPIC_BASE_URL=https://api.zukko.pro are usually enough: the SDK sends x-api-key, and the gateway accepts it just like an Authorization: Bearer header;
• clients built on the OpenAI SDK use different variables: OPENAI_API_KEY and OPENAI_BASE_URL=https://api.zukko.pro/v1.

Mind the address. The official Anthropic SDK and Claude Code add /v1 to the address themselves, so it is not written in ANTHROPIC_BASE_URL. This is a frequent source of errors, covered in the article on base URL with and without /v1↗.

Where to get a key

An official Anthropic key is issued in the Anthropic console after registration and payment setup. Conditions, supported countries and payment methods are set by Anthropic itself, and from Russia this route is usually hard: check their current rules, we cannot guarantee it will work for you.

A Zukko key takes a couple of minutes:

1. Register at zukko.pro↗ and top up the balance (from $1): SBP, cryptocurrency or a MasterCard. With SBP the payment page adds an 8.5% fee on top.
2. Open the API keys↗ section and create a key. The full fetch_... key is shown once at creation, so save it in a password manager right away.
3. Set a name, daily and monthly limits in dollars and, if you like, a list of allowed models. A separate key per project is handier: you can revoke it without breaking the others.

The full authorization scheme is in the documentation↗.

How to set the variables

macOS and Linux

For the current terminal session:

export ANTHROPIC_BASE_URL=https://api.zukko.pro
export ANTHROPIC_AUTH_TOKEN=fetch_your_key

To make them persistent, add these lines to ~/.zshrc (macOS, zsh) or ~/.bashrc (Linux, bash) and restart the terminal or run source ~/.zshrc. Note that the file is readable by any process of your user and may end up in dotfile backups; if you publish your dotfiles to git, do not put the key there.

Windows (PowerShell)

For the current window:

$env:ANTHROPIC_BASE_URL = "https://api.zukko.pro"
$env:ANTHROPIC_AUTH_TOKEN = "fetch_your_key"

To keep the values for future windows:

setx ANTHROPIC_BASE_URL "https://api.zukko.pro"
setx ANTHROPIC_AUTH_TOKEN "fetch_your_key"

setx does not change variables in an already open window, so close it and open a new one.

Through Claude Code settings.json

Claude Code reads an env block from the settings file ~/.claude/settings.json, so you do not have to export the variables in every terminal:

{
  "env": {
    "ANTHROPIC_BASE_URL": "https://api.zukko.pro",
    "ANTHROPIC_AUTH_TOKEN": "fetch_your_key"
  }
}

A file in your home folder lives outside the repository, which is safer than project settings. If you keep settings in .claude/settings.json inside a project, do not write the key there. Installation and first commands are in the Claude Code docs↗.

A .env file for applications

In your own applications the key is conventionally kept in .env, listed in .gitignore. For Python the python-dotenv library is convenient:

from anthropic import Anthropic
from dotenv import load_dotenv

load_dotenv()  # reads .env next to the script

client = Anthropic()  # takes ANTHROPIC_API_KEY and ANTHROPIC_BASE_URL from the environment
msg = client.messages.create(
    model="claude-sonnet-5-5",
    max_tokens=200,
    messages=[{"role": "user", "content": "Answer in one word: is it working?"}],
)
print(msg.content[0].text)

.env contains the lines ANTHROPIC_API_KEY=fetch_... and ANTHROPIC_BASE_URL=https://api.zukko.pro. If the constructor did not pick a variable up, pass the values explicitly: Anthropic(api_key=..., base_url=...).

Checking that the key works

A model list request is no good for checking a key: the GET /v1/models endpoint is public and ignores the key. Check the key with a balance request instead, where the key is required and the request costs nothing:

curl https://api.zukko.pro/v1/balance -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN"

A 200 response with your balance means the key is accepted. A 401 means a wrong key (an extra space, a truncated string, a key from another service). Errors 402 (not enough balance) and 403 model_not_allowed_for_key (the model is not on the key's list) show up only when you call a model.

Variable conflicts

If the environment has both ANTHROPIC_API_KEY with someone else's key and ANTHROPIC_AUTH_TOKEN for Zukko, the Claude Code documentation (the section on credential precedence) gives ANTHROPIC_AUTH_TOKEN priority. But the extra variable confuses troubleshooting, and the Anthropic SDK and other programs will pick up ANTHROPIC_API_KEY. The /status command shows which sign-in method Claude Code is using. An old key often stays in a shell profile after experiments. Check with env | grep ANTHROPIC (macOS and Linux) or Get-ChildItem Env:ANTHROPIC* (PowerShell) and remove the extra variable with unset ANTHROPIC_API_KEY. If you used to sign in to Claude Code with a subscription and now use a key, sign out if needed; see the Claude Code documentation for the commands.

How not to leak the key

• Do not commit .env: add it to .gitignore before the first commit.
• Do not paste the key into code, screenshots or support chats.
• Do not pass the key to docker build through ARG: it ends up in image layers, pass it when the container starts instead.
• Set daily and monthly limits: if the key leaks anyway, the damage is bounded.
• If the key already reached a repository, deleting the commit does not help: it stays in history. Revoke it in the dashboard and create a new one (what to do step by step↗).

FAQ

How does ANTHROPIC_API_KEY differ from ANTHROPIC_AUTH_TOKEN?

The first is sent in the x-api-key header, the second in Authorization: Bearer. Zukko accepts both headers. For Claude Code use ANTHROPIC_AUTH_TOKEN, for the SDK ANTHROPIC_API_KEY is enough.

Where do I get an Anthropic API key if I cannot register?

The official key is issued by Anthropic on its own terms, and we cannot promise you will get one. An alternative is a Zukko key, which works in the Anthropic format and in the OpenAI format; access from Russia goes through a gateway, with payment by SBP, MasterCard or crypto.

Should I write /v1 in ANTHROPIC_BASE_URL?

No. For Claude Code and the official Anthropic SDK the address is https://api.zukko.pro without /v1. With /v1 you get a path like /v1/v1/messages and a 404 error.

Can I keep the key in environment variables on a server?

Yes, it is common practice: through the hosting provider's secret manager or a service environment file with restricted permissions. Do not put the key in the repository or the image.

To get started, create a key in the Zukko dashboard↗ and set the two variables from this article.