---
title: API Keys
url: https://platform.claude.com/docs/en/api/php/organization/api_keys
---

# API Keys

## List API Keys

`$client->organization->apiKeys->list(?string afterID, ?string beforeID, ?string createdByUserID, ?int limit, ?Status status, ?string workspaceID): Page<APIKey>`

**GET** `/v1/organizations/api_keys`

List API Keys

### Parameters

- `afterID?:optional string` (query parameter)

  ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately after this object.

- `beforeID?:optional string` (query parameter)

  ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately before this object.

- `createdByUserID?:optional string` (query parameter)

  Filter by the ID of the User who created the object.

- `limit?:optional int` (query parameter)

  Number of items to return per page.

  Defaults to `20`. Ranges from `1` to `1000`.

  default: 20

- `status?:optional Status` (query parameter)

  Filter by API key status.

- `workspaceID?:optional string` (query parameter)

  Filter by Workspace ID.

### Returns

- `class APIKey`

  - `"api_key" type`

    Object type.

    For API Keys, this is always `"api_key"`.

  - `string id`

    ID of the API key.

  - `\Datetime createdAt`

    RFC 3339 datetime string indicating when the API Key was created.

  - `?APIKeyCreatedBy createdBy`

    The ID and type of the actor that created the API key, or `null` when the
    creator is not recorded (legacy, workload-identity-federated, or
    system-created keys).

  - `?\Datetime expiresAt`

    RFC 3339 datetime string indicating when the API Key expires, or `null` if it never expires.

  - `string name`

    Name of the API key.

  - `?string partialKeyHint`

    Partially redacted hint for the API key.

  - `?Principal principal`

    The principal the API key acts as (a User or a Service Account), or `null` if the API key is not bound to a principal.

  - `Scope scope`

    Where the API key belongs: its Workspace (`{"type": "workspace", "workspace_id": "wrkspc_..."}`, with the Workspace's real ID even when it is the organization's default Workspace), or the organization (`{"type": "organization"}`) for a principal-bound API key that has no Workspace.

  - `Status status`

    Status of the API key.

### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$page = $client->organization->apiKeys->list(
  afterID: 'after_id',
  beforeID: 'before_id',
  createdByUserID: 'created_by_user_id',
  limit: 1,
  status: 'active',
  workspaceID: 'workspace_id',
);

var_dump($page);
```

#### Response (200)

```json
{
  "data": [
    {
      "id": "apikey_01Rj2N8SVvo6BePZj99NhmiT",
      "created_at": "2024-10-30T23:58:27.427722Z",
      "created_by": {
        "id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
        "type": "user"
      },
      "expires_at": "2024-10-30T23:58:27.427722Z",
      "name": "Developer Key",
      "partial_key_hint": "sk-ant-api03-R2D...igAA",
      "principal": {
        "type": "user_actor",
        "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
      },
      "scope": {
        "type": "workspace",
        "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
      },
      "status": "active",
      "type": "api_key"
    }
  ],
  "first_id": "first_id",
  "has_more": true,
  "last_id": "last_id"
}
```

## Retrieve API Key (Admin API)

`$client->organization->apiKeys->retrieve(string apiKeyID): APIKey`

**GET** `/v1/organizations/api_keys/{api_key_id}`

Retrieve information about a single API key in your organization, looked up by its ID. This Admin API endpoint requires an Admin API key, is intended for programmatic key management, and never returns the key's secret value. To view or create your own API keys, go to [API keys](https://platform.claude.com/settings/keys) in the Claude Console.

### Parameters

- `apiKeyID: string` (path parameter)

  ID of the API key.

### Returns

- `class APIKey`

  - `"api_key" type`

    Object type.

    For API Keys, this is always `"api_key"`.

  - `string id`

    ID of the API key.

  - `\Datetime createdAt`

    RFC 3339 datetime string indicating when the API Key was created.

  - `?APIKeyCreatedBy createdBy`

    The ID and type of the actor that created the API key, or `null` when the
    creator is not recorded (legacy, workload-identity-federated, or
    system-created keys).

  - `?\Datetime expiresAt`

    RFC 3339 datetime string indicating when the API Key expires, or `null` if it never expires.

  - `string name`

    Name of the API key.

  - `?string partialKeyHint`

    Partially redacted hint for the API key.

  - `?Principal principal`

    The principal the API key acts as (a User or a Service Account), or `null` if the API key is not bound to a principal.

  - `Scope scope`

    Where the API key belongs: its Workspace (`{"type": "workspace", "workspace_id": "wrkspc_..."}`, with the Workspace's real ID even when it is the organization's default Workspace), or the organization (`{"type": "organization"}`) for a principal-bound API key that has no Workspace.

  - `Status status`

    Status of the API key.

### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$apiKey = $client->organization->apiKeys->retrieve('api_key_id');

var_dump($apiKey);
```

#### Response (200)

```json
{
  "id": "apikey_01Rj2N8SVvo6BePZj99NhmiT",
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by": {
    "id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
    "type": "user"
  },
  "expires_at": "2024-10-30T23:58:27.427722Z",
  "name": "Developer Key",
  "partial_key_hint": "sk-ant-api03-R2D...igAA",
  "principal": {
    "type": "user_actor",
    "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
  },
  "scope": {
    "type": "workspace",
    "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
  },
  "status": "active",
  "type": "api_key"
}
```

## Update API Key

`$client->organization->apiKeys->update(string apiKeyID, ?string name, ?Status status): APIKey`

**POST** `/v1/organizations/api_keys/{api_key_id}`

Update API Key

### Parameters

- `apiKeyID: string` (path parameter)

  ID of the API key.

- `name?:optional string`

  Name of the API key.

- `status?:optional Status`

  Status of the API key.

### Returns

- `class APIKey`

  - `"api_key" type`

    Object type.

    For API Keys, this is always `"api_key"`.

  - `string id`

    ID of the API key.

  - `\Datetime createdAt`

    RFC 3339 datetime string indicating when the API Key was created.

  - `?APIKeyCreatedBy createdBy`

    The ID and type of the actor that created the API key, or `null` when the
    creator is not recorded (legacy, workload-identity-federated, or
    system-created keys).

  - `?\Datetime expiresAt`

    RFC 3339 datetime string indicating when the API Key expires, or `null` if it never expires.

  - `string name`

    Name of the API key.

  - `?string partialKeyHint`

    Partially redacted hint for the API key.

  - `?Principal principal`

    The principal the API key acts as (a User or a Service Account), or `null` if the API key is not bound to a principal.

  - `Scope scope`

    Where the API key belongs: its Workspace (`{"type": "workspace", "workspace_id": "wrkspc_..."}`, with the Workspace's real ID even when it is the organization's default Workspace), or the organization (`{"type": "organization"}`) for a principal-bound API key that has no Workspace.

  - `Status status`

    Status of the API key.

### Example

```php
<?php

require_once dirname(__DIR__) . '/vendor/autoload.php';

use Anthropic\Client;

$client = new Client(apiKey: 'my-anthropic-api-key');

$apiKey = $client->organization->apiKeys->update(
  'api_key_id', name: 'x', status: 'active'
);

var_dump($apiKey);
```

#### Response (200)

```json
{
  "id": "apikey_01Rj2N8SVvo6BePZj99NhmiT",
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by": {
    "id": "user_01WCz1FkmYMm4gnmykNKUu3Q",
    "type": "user"
  },
  "expires_at": "2024-10-30T23:58:27.427722Z",
  "name": "Developer Key",
  "partial_key_hint": "sk-ant-api03-R2D...igAA",
  "principal": {
    "type": "user_actor",
    "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q"
  },
  "scope": {
    "type": "workspace",
    "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ"
  },
  "status": "active",
  "type": "api_key"
}
```

## Domain types

### API Key

- `class APIKey`

  - `"api_key" type`

    Object type.

    For API Keys, this is always `"api_key"`.

  - `string id`

    ID of the API key.

  - `\Datetime createdAt`

    RFC 3339 datetime string indicating when the API Key was created.

  - `?APIKeyCreatedBy createdBy`

    The ID and type of the actor that created the API key, or `null` when the
    creator is not recorded (legacy, workload-identity-federated, or
    system-created keys).

  - `?\Datetime expiresAt`

    RFC 3339 datetime string indicating when the API Key expires, or `null` if it never expires.

  - `string name`

    Name of the API key.

  - `?string partialKeyHint`

    Partially redacted hint for the API key.

  - `?Principal principal`

    The principal the API key acts as (a User or a Service Account), or `null` if the API key is not bound to a principal.

  - `Scope scope`

    Where the API key belongs: its Workspace (`{"type": "workspace", "workspace_id": "wrkspc_..."}`, with the Workspace's real ID even when it is the organization's default Workspace), or the organization (`{"type": "organization"}`) for a principal-bound API key that has no Workspace.

  - `Status status`

    Status of the API key.

### API Key Created By

- `class APIKeyCreatedBy`

  - `Type type`

    Type of the actor that created the object.

  - `string id`

    ID of the actor that created the object.

### API Key Organization Scope

- `class APIKeyOrganizationScope`

  - `"organization" type`

    Scope type. Always `"organization"`: the API key has no Workspace. Only a principal-bound API key can have this scope.

### API Key Service Account Actor

- `class APIKeyServiceAccountActor`

  - `"service_account_actor" type`

    Principal type. Always `"service_account_actor"` for a Service Account.

  - `string serviceAccountID`

    ID of the Service Account the API key acts as.

### API Key User Actor

- `class APIKeyUserActor`

  - `"user_actor" type`

    Principal type. Always `"user_actor"` for a User.

  - `string userID`

    ID of the User the API key acts as.

### API Key Workspace Scope

- `class APIKeyWorkspaceScope`

  - `"workspace" type`

    Scope type. Always `"workspace"`: the API key belongs to one Workspace.

  - `string workspaceID`

    ID of the Workspace the API key belongs to, including when it is the organization's default Workspace.