Claude API key for a company: Console setup, separate keys, spending and safe storage

A Claude API key for a company should be created inside a Console organisation the company owns. You then create a separate key for each project and fund the keys with credits the company controls. Keep the keys out of code, and replace them on a schedule. A Claude API key is the secret string that lets a program call Claude through the Claude API, paid per token as you go.

Anthropic's getting started documentation lists two prerequisites for calling the API: a Claude Console account and an API key. The Claude Console is the web account where your keys, billing and organisation settings live. Third-party guides add two details you will notice at once. Keys start with sk-ant-, and the Console shows a new key only once, when you create it.

A key is not the same as a chat seat. A seat in Claude Team gives a person the Claude apps. A key gives software access to Claude, so it can answer email or draft quotes from a server. If you are still deciding which seats your staff need, read our guide to choosing between Claude Pro and Claude Team first. This guide covers the API side only.

Anthropic's Commercial Terms of Service define "Services" as Anthropic API keys and any other Anthropic offerings that reference the Terms, together with the related tools and documentation. In practice, the key is how your company uses its contract with Anthropic, and the contract belongs to whoever holds the account. The Terms cover business use only. Consumer products such as Claude.ai fall under the separate Consumer Terms.

Several protections attach to the customer that holds the account. Your company keeps all rights to its Inputs, which the Terms define as what you submit. It also owns its Outputs, the responses Claude generates. Anthropic may not train models on Customer Content from the Services. Data you submit is processed under the Anthropic Data Processing Addendum, which is part of the Terms.

Two duties come with the key. You may use the Services to power products for your own customers and end users. You must also tell those users not to rely on factual assertions in Outputs without checking them. And you may not resell the Services unless Anthropic expressly approves.

The Terms can change, so diary a review. Updates to the Terms usually take effect 30 days after Anthropic posts them, sooner if you receive notice, and at once if the change responds to a new law. Published rates take effect 30 days after posting, or earlier if you receive notice.

Never buy a Claude API key from a marketplace or borrow one from another business. The Commercial Terms forbid reselling the Services without Anthropic's express approval, and they count API keys as part of the Services. Someone selling keys is reselling the Services. If you buy one, your business depends on that breach.

The data problem is worse than the licence problem. Ownership of Outputs, the no-training commitment and the Data Processing Addendum belong to the Customer. The Customer is the organisation that holds the account. If your requests run on someone else's key, their contract covers your data, not yours. They can also replace or cancel the key at any time, and your system stops without warning.

Shared keys inside one company cause a quieter version of the same problem. In one public Reddit thread, a developer said they had been using Claude Code with their personal account and paying for credits themselves. Their employer had given them an API key, but they could not see where to enter it. Work like that runs on accounts the company does not control and cannot audit.

The fix is the same for bought keys and shared keys. Give every person and every system access through the company's own organisation.

Create the Console organisation with a company address that does not depend on one employee, such as a shared IT or finance mailbox. If the founder or a contractor signs up with a personal address, the company's keys leave with that person. Third-party guides describe the sign-up steps: create the account, verify a phone number, then generate keys. They also note that phone verification is not supported in every country.

Decide who administers the organisation before anyone creates a key. Organisation settings affect every request. Anthropic's models overview gives one example: an administrator can switch off web search for the organisation. Requests that use web search then fail, even on a model that supports it. Keep administrator rights to two named people, so one can cover for the other.

Set up billing in the company's name from the start. API use is funded with credits bought in advance. Make's guide describes the order as creating a Console account, generating a key and buying credits. Pay with a company card, and send the receipts to finance, not to a personal inbox. That way the spend appears in your accounts and can be reconciled every month.

Give each project, team or connection its own key, never one key for everything. A single key would work across every project. Separate keys give better security and clearer cost tracking. When one key leaks, you replace it, and the other systems keep running.

Take a ten-person distributor with two Claude projects. The first is a quoting agent that reads prices from Zoho CRM. The second sorts incoming support email. Its keys might be named like this:

• crm-quotes-production for the live quoting agent
• crm-quotes-test for trying changes before they go live
• support-triage-production for the live email sorting
• dev-firstname-2026 for one developer's experiments, with an early expiry date

The model can differ per project too. Anthropic positions Claude Haiku 5.5 for high-volume tasks such as classification, extraction and routing, which fits the triage key. For the quoting agent, Anthropic recommends starting with Claude Opus 5.5 when you are unsure which model to use. Because each project has its own keys, its usage shows separately, and you can see which one costs what.

At Svennis we give every connection we build its own key, with a named owner and an expiry date. When a key leaks, we revoke that one key and nothing else stops.

Keep each key in an environment variable or a secret store on the server that calls Claude. Never keep it in source code, a spreadsheet, an email or a chat message. Anthropic's SDK, the code library your developer installs, reads the key automatically from a variable called ANTHROPIC_API_KEY. Your code therefore never needs the key written into it.

Your developer runs the two lines below in a terminal on the server. They install the Python SDK and set the variable for the current session.

pip install anthropic
export ANTHROPIC_API_KEY="paste-the-key-here"

Replace paste-the-key-here with the key. On a live server, set the variable in the server's secret settings rather than typing it into a terminal. A terminal's history can keep a copy of the key.

Every tool that holds a key is another place it can leak. Make asks you to paste your key into a connection field, so Make now holds a copy. The open-source tool cuti stores keys in a file that only the owner can read (file mode 600). The file is not encrypted, so the protection depends on the computer's own permissions.

cuti's documentation warns never to commit that key file to version control. Keep a register of every tool that holds each key. You will need it on the day you replace one.

The authentication documentation also compares API keys with Workload Identity Federation, an alternative method. If your systems run in a cloud platform, ask your developer whether it fits your setup better than stored keys.

You control what the API costs in three ways. Keep the prepaid credit balance modest, choose the smallest model that does the job, and read usage per key every month. Because API use is paid from credits bought in advance, the balance acts as a ceiling. A runaway script can only spend what is in the account.

Model choice moves the bill more than anything else. Anthropic's models overview lists these prices per million tokens, where a token is a short segment of text:

Model	Input	Output	Anthropic's suggested use
Claude Fable 5.1	$10	$50	Demanding reasoning and long agentic work
Claude Opus 5.5	$4	$20	The starting point for most workloads
Claude Haiku 5.5	from $0.10	from $0.50	Classification, extraction and routing at volume

Use grows fast once people work with the API all day. One developer reported on LinkedIn that he spent $20 to $50 a day running Claude Code on an API key. He calculated that 30 engineers spending $50 or more a day would cost $20,000 to $30,000 a month. He called his test unscientific and about a week long. The pattern still holds: unwatched keys add up.

Rate limits also apply. New accounts start with strict limits until they build a usage history, and very heavy use can block access for a while. For a full-year budget, see what Claude costs a ten person company per year.

Give every key an expiry date, and replace it before that date arrives. Anthropic's authentication documentation explains how to set key expiration. An expiry date makes sure a forgotten key stops working instead of lingering for years. Rotating a key means replacing it with a new one on purpose. To rotate a key without downtime, follow this order:

1. Create the replacement key, using the same name plus the date.
2. Put the new key in the secret store and in every tool listed in your register.
3. Confirm that the system's calls to Claude succeed with the new key.
4. Remove the old key in the Console.
5. Update the register with the new key's name, owner and expiry date.

Revoke a key at once when any of these happens:

• Someone who had access to the key leaves the company.
• The key appears in source code, an email, a ticket or a chat.
• A supplier who held the key finishes their contract.
• Usage on the key jumps and nobody can explain why.

Good key hygiene limits who can call Claude. It does not stop an agent from being misled by the content it reads. For that second risk, read how to keep Claude agents safe from prompt injection.

Since 7 October 2026, Max and Team plans include monthly API credits for running your own apps and agents on the Claude Platform. The change is announced in the Claude Help Center release notes. A company already paying for Claude Team may therefore have some API use covered by its plan.

Claim the credits for the company's Console organisation, not a personal account. The release note does not change any rule in this guide. The credits pay for usage. They do not make a shared or personal key acceptable. Check the claim steps in your plan's settings on the day you set it up, because the screens can change after an announcement.

Treat plan credits as a budget line, and record them alongside the prepaid credits. When you review usage per key each month, note how much the plan credits covered and how much came from purchased credits. That record shows whether a project is outgrowing what the plan includes, before the balance runs out mid-month.

Use this checklist to audit an existing setup or to plan a new one. Each row names the control, what to do and why it matters.

Control	What to do	Why it matters
Organisation owner	Sign up with a shared company mailbox	The keys do not leave with one person
Administrators	Name two people with admin rights	Settings changes have an owner and a backup
Billing	Buy credits on a company card in the company name	Spend sits in your accounts
Key per project	One key per project, team or connection, with a descriptive name	Costs are traceable and a leak is contained
Storage	Environment variable or secret store, never code or chat	The key cannot be copied from a file or message
Key register	List each key, its owner, its tools and its expiry date	Rotation takes minutes, not a search
Expiry and rotation	Set an expiry date and replace keys before it arrives	Forgotten keys stop working
Source of keys	Only keys created in your own organisation	Bought keys breach the reselling clause
Plan credits	Claim Team or Max API credits for the company organisation	Included usage counts towards company work

Review the register every quarter. It is also worth reviewing whenever a person or supplier with key access changes.

A company in the UK, the EEA or Switzerland contracts with Anthropic Ireland, Limited, and the Commercial Terms are governed by the laws of Ireland. Customers elsewhere contract with Anthropic, PBC under the laws of California. Your company's own key therefore gives you a contract with an Irish company. The main Terms are under Irish law, and the Data Processing Addendum includes the UK Addendum, which is governed by the law of England and Wales.

Your data protection lead should file the Data Processing Addendum with your records of processing. Next to it, record that Anthropic may not train models on Customer Content from the Services. These documents only cover you if the account is yours. A bought or borrowed key leaves you outside the contract, with no addendum to point to if a regulator asks.

The commercial clauses are worth knowing too. Each party's liability is capped at the fees paid for the Services in the previous 12 months, though the cap does not apply to indemnification. Anthropic will defend customers against third-party claims that their authorised paid use, or the Outputs, infringes intellectual property rights. If a dispute arises, there is a 45-day informal period before either side may seek arbitration.

For the wider picture of accounts, data handling and UK law, read how Claude runs in your company.

Start with an inventory, because most companies already have keys they have not counted. Work through these steps in order:

1. Ask everyone who works with Claude which keys and accounts they use, including personal ones.
2. Create or confirm the company Console organisation, with two administrators and company billing.
3. Create one key per project or connection, with a descriptive name and an expiry date.
4. Move every key into a secret store and start the key register.
5. Revoke any key that is shared, personal or of unknown origin.
6. Claim Team or Max plan API credits for the company organisation.

Once the keys are in order, the real work is connecting Claude to the programs your business runs on. Svennis works in four steps: a Workshop, then Pilot Claude A or Pilot Claude B, then the department Activation, then monthly operations. Pilot Claude A is an AI agent on Claude for one process, and Pilot Claude B is Claude Team for the whole team. For each connection we build a connector, an MCP server, a plugin or a skill.

We show you the connection options with their cost, and you choose. To see how one process goes live, read about Pilot Claude A, an AI agent on Claude for one process.