--- title: API Keys url: https://platform.claude.com/docs/en/api/typescript/organization/api_keys --- # API Keys ## List API Keys `client.organization.apiKeys.list(query?, options?): Page` **GET** `/v1/organizations/api_keys` List API Keys ### Parameters - `query: APIKeyListParams` - `after_id?: string` (query parameter) ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately after this object. - `before_id?: string` (query parameter) ID of the object to use as a cursor for pagination. When provided, returns the page of results immediately before this object. - `created_by_user_id?: string | null` (query parameter) Filter by the ID of the User who created the object. - `limit?: number` (query parameter) Number of items to return per page. Defaults to `20`. Ranges from `1` to `1000`. minimum: 1, maximum: 1000 - `status?: "active" | "archived" | "expired" | "inactive" | null` (query parameter) Filter by API key status. - `"active"` - `"archived"` - `"expired"` - `"inactive"` - `workspace_id?: string | null` (query parameter) Filter by Workspace ID. ### Returns - `interface APIKey` - `type: "api_key"` Object type. For API Keys, this is always `"api_key"`. default: api_key - `id: string` ID of the API key. - `created_at: string` RFC 3339 datetime string indicating when the API Key was created. format: date-time - `created_by: APIKeyCreatedBy | null` The ID and type of the actor that created the API key, or `null` when the creator is not recorded (legacy, workload-identity-federated, or system-created keys). - `type: "service_account" | "user"` Type of the actor that created the object. - `"service_account"` - `"user"` - `id: string` ID of the actor that created the object. - `expires_at: string | null` RFC 3339 datetime string indicating when the API Key expires, or `null` if it never expires. format: date-time - `name: string` Name of the API key. - `partial_key_hint: string | null` Partially redacted hint for the API key. - `principal: APIKeyUserActor | APIKeyServiceAccountActor | null` The principal the API key acts as (a User or a Service Account), or `null` if the API key is not bound to a principal. - `interface APIKeyUserActor` - `type: "user_actor"` Principal type. Always `"user_actor"` for a User. default: user_actor - `user_id: string` ID of the User the API key acts as. - `interface APIKeyServiceAccountActor` - `type: "service_account_actor"` Principal type. Always `"service_account_actor"` for a Service Account. default: service_account_actor - `service_account_id: string` ID of the Service Account the API key acts as. - `scope: APIKeyOrganizationScope | APIKeyWorkspaceScope` Where the API key belongs: its Workspace (`{"type": "workspace", "workspace_id": "wrkspc_..."}`, with the Workspace's real ID even when it is the organization's default Workspace), or the organization (`{"type": "organization"}`) for a principal-bound API key that has no Workspace. - `interface APIKeyOrganizationScope` - `type: "organization"` Scope type. Always `"organization"`: the API key has no Workspace. Only a principal-bound API key can have this scope. default: organization - `interface APIKeyWorkspaceScope` - `type: "workspace"` Scope type. Always `"workspace"`: the API key belongs to one Workspace. default: workspace - `workspace_id: string` ID of the Workspace the API key belongs to. Unlike the deprecated top-level `workspace_id`, this is the Workspace's real ID even for the organization's default Workspace. - `status: "active" | "archived" | "expired" | "inactive"` Status of the API key. - `"active"` - `"archived"` - `"expired"` - `"inactive"` ### Example ```typescript import Anthropic from "@anthropic-ai/sdk"; const client = new Anthropic({ apiKey: process.env["ANTHROPIC_API_KEY"] // This is the default and can be omitted }); // Automatically fetches more pages as needed. for await (const apiKey of client.organization.apiKeys.list()) { console.log(apiKey.id); } ``` #### Response (200) ```json { "data": [ { "id": "apikey_01Rj2N8SVvo6BePZj99NhmiT", "created_at": "2024-10-30T23:58:27.427722Z", "created_by": { "id": "user_01WCz1FkmYMm4gnmykNKUu3Q", "type": "user" }, "expires_at": "2024-10-30T23:58:27.427722Z", "name": "Developer Key", "partial_key_hint": "sk-ant-api03-R2D...igAA", "principal": { "type": "user_actor", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q" }, "scope": { "type": "workspace", "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ" }, "status": "active", "type": "api_key", "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ" } ], "first_id": "first_id", "has_more": true, "last_id": "last_id" } ``` ## Retrieve API Key (Admin API) `client.organization.apiKeys.retrieve(apiKeyID, options?): APIKey` **GET** `/v1/organizations/api_keys/{api_key_id}` Retrieve information about a single API key in your organization, looked up by its ID. This Admin API endpoint requires an Admin API key, is intended for programmatic key management, and never returns the key's secret value. To view or create your own API keys, go to [API keys](https://platform.claude.com/settings/keys) in the Claude Console. ### Parameters - `apiKeyID: string` (path parameter) ID of the API key. ### Returns - `interface APIKey` - `type: "api_key"` Object type. For API Keys, this is always `"api_key"`. default: api_key - `id: string` ID of the API key. - `created_at: string` RFC 3339 datetime string indicating when the API Key was created. format: date-time - `created_by: APIKeyCreatedBy | null` The ID and type of the actor that created the API key, or `null` when the creator is not recorded (legacy, workload-identity-federated, or system-created keys). - `type: "service_account" | "user"` Type of the actor that created the object. - `"service_account"` - `"user"` - `id: string` ID of the actor that created the object. - `expires_at: string | null` RFC 3339 datetime string indicating when the API Key expires, or `null` if it never expires. format: date-time - `name: string` Name of the API key. - `partial_key_hint: string | null` Partially redacted hint for the API key. - `principal: APIKeyUserActor | APIKeyServiceAccountActor | null` The principal the API key acts as (a User or a Service Account), or `null` if the API key is not bound to a principal. - `interface APIKeyUserActor` - `type: "user_actor"` Principal type. Always `"user_actor"` for a User. default: user_actor - `user_id: string` ID of the User the API key acts as. - `interface APIKeyServiceAccountActor` - `type: "service_account_actor"` Principal type. Always `"service_account_actor"` for a Service Account. default: service_account_actor - `service_account_id: string` ID of the Service Account the API key acts as. - `scope: APIKeyOrganizationScope | APIKeyWorkspaceScope` Where the API key belongs: its Workspace (`{"type": "workspace", "workspace_id": "wrkspc_..."}`, with the Workspace's real ID even when it is the organization's default Workspace), or the organization (`{"type": "organization"}`) for a principal-bound API key that has no Workspace. - `interface APIKeyOrganizationScope` - `type: "organization"` Scope type. Always `"organization"`: the API key has no Workspace. Only a principal-bound API key can have this scope. default: organization - `interface APIKeyWorkspaceScope` - `type: "workspace"` Scope type. Always `"workspace"`: the API key belongs to one Workspace. default: workspace - `workspace_id: string` ID of the Workspace the API key belongs to. Unlike the deprecated top-level `workspace_id`, this is the Workspace's real ID even for the organization's default Workspace. - `status: "active" | "archived" | "expired" | "inactive"` Status of the API key. - `"active"` - `"archived"` - `"expired"` - `"inactive"` ### Example ```typescript import Anthropic from "@anthropic-ai/sdk"; const client = new Anthropic({ apiKey: process.env["ANTHROPIC_API_KEY"] // This is the default and can be omitted }); const apiKey = await client.organization.apiKeys.retrieve("api_key_id"); console.log(apiKey.id); ``` #### Response (200) ```json { "id": "apikey_01Rj2N8SVvo6BePZj99NhmiT", "created_at": "2024-10-30T23:58:27.427722Z", "created_by": { "id": "user_01WCz1FkmYMm4gnmykNKUu3Q", "type": "user" }, "expires_at": "2024-10-30T23:58:27.427722Z", "name": "Developer Key", "partial_key_hint": "sk-ant-api03-R2D...igAA", "principal": { "type": "user_actor", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q" }, "scope": { "type": "workspace", "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ" }, "status": "active", "type": "api_key", "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ" } ``` ## Update API Key `client.organization.apiKeys.update(apiKeyID, body, options?): APIKey` **POST** `/v1/organizations/api_keys/{api_key_id}` Update API Key ### Parameters - `apiKeyID: string` (path parameter) ID of the API key. - `body: APIKeyUpdateParams` - `name?: string | null` Name of the API key. minLength: 1, maxLength: 500 - `status?: "active" | "archived" | "inactive" | null` Status of the API key. - `"active"` - `"archived"` - `"inactive"` ### Returns - `interface APIKey` - `type: "api_key"` Object type. For API Keys, this is always `"api_key"`. default: api_key - `id: string` ID of the API key. - `created_at: string` RFC 3339 datetime string indicating when the API Key was created. format: date-time - `created_by: APIKeyCreatedBy | null` The ID and type of the actor that created the API key, or `null` when the creator is not recorded (legacy, workload-identity-federated, or system-created keys). - `type: "service_account" | "user"` Type of the actor that created the object. - `"service_account"` - `"user"` - `id: string` ID of the actor that created the object. - `expires_at: string | null` RFC 3339 datetime string indicating when the API Key expires, or `null` if it never expires. format: date-time - `name: string` Name of the API key. - `partial_key_hint: string | null` Partially redacted hint for the API key. - `principal: APIKeyUserActor | APIKeyServiceAccountActor | null` The principal the API key acts as (a User or a Service Account), or `null` if the API key is not bound to a principal. - `interface APIKeyUserActor` - `type: "user_actor"` Principal type. Always `"user_actor"` for a User. default: user_actor - `user_id: string` ID of the User the API key acts as. - `interface APIKeyServiceAccountActor` - `type: "service_account_actor"` Principal type. Always `"service_account_actor"` for a Service Account. default: service_account_actor - `service_account_id: string` ID of the Service Account the API key acts as. - `scope: APIKeyOrganizationScope | APIKeyWorkspaceScope` Where the API key belongs: its Workspace (`{"type": "workspace", "workspace_id": "wrkspc_..."}`, with the Workspace's real ID even when it is the organization's default Workspace), or the organization (`{"type": "organization"}`) for a principal-bound API key that has no Workspace. - `interface APIKeyOrganizationScope` - `type: "organization"` Scope type. Always `"organization"`: the API key has no Workspace. Only a principal-bound API key can have this scope. default: organization - `interface APIKeyWorkspaceScope` - `type: "workspace"` Scope type. Always `"workspace"`: the API key belongs to one Workspace. default: workspace - `workspace_id: string` ID of the Workspace the API key belongs to. Unlike the deprecated top-level `workspace_id`, this is the Workspace's real ID even for the organization's default Workspace. - `status: "active" | "archived" | "expired" | "inactive"` Status of the API key. - `"active"` - `"archived"` - `"expired"` - `"inactive"` ### Example ```typescript import Anthropic from "@anthropic-ai/sdk"; const client = new Anthropic({ apiKey: process.env["ANTHROPIC_API_KEY"] // This is the default and can be omitted }); const apiKey = await client.organization.apiKeys.update("api_key_id"); console.log(apiKey.id); ``` #### Response (200) ```json { "id": "apikey_01Rj2N8SVvo6BePZj99NhmiT", "created_at": "2024-10-30T23:58:27.427722Z", "created_by": { "id": "user_01WCz1FkmYMm4gnmykNKUu3Q", "type": "user" }, "expires_at": "2024-10-30T23:58:27.427722Z", "name": "Developer Key", "partial_key_hint": "sk-ant-api03-R2D...igAA", "principal": { "type": "user_actor", "user_id": "user_01WCz1FkmYMm4gnmykNKUu3Q" }, "scope": { "type": "workspace", "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ" }, "status": "active", "type": "api_key", "workspace_id": "wrkspc_01JwQvzr7rXLA5AGx3HKfFUJ" } ``` ## Domain types ### API Key - `interface APIKey` - `type: "api_key"` Object type. For API Keys, this is always `"api_key"`. default: api_key - `id: string` ID of the API key. - `created_at: string` RFC 3339 datetime string indicating when the API Key was created. format: date-time - `created_by: APIKeyCreatedBy | null` The ID and type of the actor that created the API key, or `null` when the creator is not recorded (legacy, workload-identity-federated, or system-created keys). - `type: "service_account" | "user"` Type of the actor that created the object. - `"service_account"` - `"user"` - `id: string` ID of the actor that created the object. - `expires_at: string | null` RFC 3339 datetime string indicating when the API Key expires, or `null` if it never expires. format: date-time - `name: string` Name of the API key. - `partial_key_hint: string | null` Partially redacted hint for the API key. - `principal: APIKeyUserActor | APIKeyServiceAccountActor | null` The principal the API key acts as (a User or a Service Account), or `null` if the API key is not bound to a principal. - `interface APIKeyUserActor` - `type: "user_actor"` Principal type. Always `"user_actor"` for a User. default: user_actor - `user_id: string` ID of the User the API key acts as. - `interface APIKeyServiceAccountActor` - `type: "service_account_actor"` Principal type. Always `"service_account_actor"` for a Service Account. default: service_account_actor - `service_account_id: string` ID of the Service Account the API key acts as. - `scope: APIKeyOrganizationScope | APIKeyWorkspaceScope` Where the API key belongs: its Workspace (`{"type": "workspace", "workspace_id": "wrkspc_..."}`, with the Workspace's real ID even when it is the organization's default Workspace), or the organization (`{"type": "organization"}`) for a principal-bound API key that has no Workspace. - `interface APIKeyOrganizationScope` - `type: "organization"` Scope type. Always `"organization"`: the API key has no Workspace. Only a principal-bound API key can have this scope. default: organization - `interface APIKeyWorkspaceScope` - `type: "workspace"` Scope type. Always `"workspace"`: the API key belongs to one Workspace. default: workspace - `workspace_id: string` ID of the Workspace the API key belongs to. Unlike the deprecated top-level `workspace_id`, this is the Workspace's real ID even for the organization's default Workspace. - `status: "active" | "archived" | "expired" | "inactive"` Status of the API key. - `"active"` - `"archived"` - `"expired"` - `"inactive"` ### API Key Created By - `interface APIKeyCreatedBy` - `type: "service_account" | "user"` Type of the actor that created the object. - `"service_account"` - `"user"` - `id: string` ID of the actor that created the object. ### API Key Organization Scope - `interface APIKeyOrganizationScope` - `type: "organization"` Scope type. Always `"organization"`: the API key has no Workspace. Only a principal-bound API key can have this scope. default: organization ### API Key Service Account Actor - `interface APIKeyServiceAccountActor` - `type: "service_account_actor"` Principal type. Always `"service_account_actor"` for a Service Account. default: service_account_actor - `service_account_id: string` ID of the Service Account the API key acts as. ### API Key User Actor - `interface APIKeyUserActor` - `type: "user_actor"` Principal type. Always `"user_actor"` for a User. default: user_actor - `user_id: string` ID of the User the API key acts as. ### API Key Workspace Scope - `interface APIKeyWorkspaceScope` - `type: "workspace"` Scope type. Always `"workspace"`: the API key belongs to one Workspace. default: workspace - `workspace_id: string` ID of the Workspace the API key belongs to. Unlike the deprecated top-level `workspace_id`, this is the Workspace's real ID even for the organization's default Workspace.