How to create an Anthropic admin key

Where: the Anthropic Console, under organisation settings → API keys → admin keys. You need to be an organisation admin. The key is prefixed sk-ant-admin… and shown once.

What it unlocks

• Cost report — organisation spend, on a daily cadence
• Usage report — token counts by model and workspace
• API key management — list keys and deactivate them
• Workspaces and members

Like OpenAI's, it cannot make inference calls. Administration and inference are separate credential types, which is the right design.

Using it

Anthropic uses the x-api-key header and requires a version header on every request:

export ANTHROPIC_ADMIN_KEY="sk-ant-admin..."

# list active keys
curl -s "https://api.anthropic.com/v1/organizations/api_keys?status=active&limit=100" \
  -H "x-api-key: $ANTHROPIC_ADMIN_KEY" \
  -H "anthropic-version: 2023-06-01" | jq '.data[] | {id, name, partial_key_hint, workspace_id}'

# deactivate a key
curl -s -X POST "https://api.anthropic.com/v1/organizations/api_keys/$KEY_ID" \
  -H "x-api-key: $ANTHROPIC_ADMIN_KEY" \
  -H "anthropic-version: 2023-06-01" \
  -H "content-type: application/json" \
  -d '{"status":"inactive"}'

Two things worth noting against the OpenAI equivalent:

• Deactivate, don't delete. Anthropic changes a key's status rather than removing it. The credential stops working either way, and you keep the audit record.
• partial_key_hint is how you map a key you found in a log or repository to the ID you need to act on.

Forgetting anthropic-version is the most common cause of a confusing 400 here.

Reading cost

The organisation cost report returns daily buckets. Same cadence caveat as every provider: it is built for "what did yesterday cost", not "what is happening right now". If you need per-request cost attribution in real time, you need a proxy in your request path — see proxy-based vs billing-API cost tracking.

Holding it safely

An admin key can deactivate every API key in your organisation. Treat it accordingly:

• Separate storage from your inference keys — different secret store, different environment
• Never in a client application
• Named per consumer, so you can revoke one integration without breaking the rest
• Rotated when someone leaves

Is it safe to give an app your admin key? covers what to ask before handing one to a third party.

Key formats

Sources

• Anthropic — Administration API
• Anthropic Console