AdminSet up CMEK

Add and attach an encryption key with the Admin API

Copy page



Create, validate, and attach a customer-managed encryption key with three Admin API calls.

These calls work on Claude Platform. On Claude Enterprise or Claude Platform on AWS, follow your setup page.

Creating an external key is what Add key does in the Claude Console, and validating it is what Verify does.

Before you start

• Customer-managed encryption keys (CMEK) are turned on for your organization.
• You have an Admin API key. The samples read it from ANTHROPIC_API_KEY.
• You've created your key in AWS KMS, Google Cloud KMS, or Azure Key Vault, and kept the values the setup steps tell you to copy.
• You have a workspace that retains data, ideally a new one, because existing data stays under Anthropic's key.

Create, validate, and attach the key

1. 1

   Create the external key

   AWSGoogle CloudAzure

   AWS

   Replace <friendly-name> with a display name and <key-arn-from-create-key-step> with the key ARN.

   cURLCLIPythonTypeScriptC#GoJavaPHPRuby

   Python

   

   client = anthropic.Anthropic()
   
   external_key = client.organization.external_keys.create(
       display_name="<friendly-name>",
       geo="us",
       provider_config={"type": "aws", "kms_arn": "<key-arn-from-create-key-step>"},
   )
   
   print(f"id: {external_key.id}")
   print(f"display_name: {external_key.display_name}")

   The id in the response is the external key ID. Copy it for the next two steps.

   {
     "type": "external_key",
     "id": "ekey_<id>",
     "display_name": "<friendly-name>"
   }

   
2. 2

   Validate the key

   Replace ekey_<id> with the external key ID.

   cURLCLIPythonTypeScriptC#GoJavaPHPRuby

   Python

   

   client = anthropic.Anthropic()
   
   validation = client.organization.external_keys.validate("ekey_<id>")
   
   print(f"status: {validation.status}")
   print(f"error: {validation.error}")

   A successful response looks like this:

   { "type": "external_key_validation", "status": "success", "error": null }

   

   If status is failure, the error field says why. See Troubleshoot CMEK.

3. 3

   Attach the key to a workspace

   Replace <workspace-id> with the workspace ID, which starts with wrkspc_, and ekey_<id> with the external key ID.

   cURLCLIPythonTypeScriptC#GoJavaPHPRuby

   Python

   

   client = anthropic.Anthropic()
   
   workspace = client.organization.workspaces.update(
       "<workspace-id>", external_key_id="ekey_<id>"
   )
   
   print(f"id: {workspace.id}")
   print(f"external_key_id: {workspace.external_key_id}")

   The response shows the attached key's ID in external_key_id. If the request is refused, look up the error.