How to rotate an Anthropic (Claude) API key
Reissue a Claude API key: create one with the right linked account and workspace, deploy it, disable the old key, delete it, and plan for keys tied to people.
Part of the guide
AnthropicClaude API key
Starts with: sk-ant-api…- Where to issue a new one
- platform.claude.com/settings/keys
- What a leaked key reaches
- Claude API calls as its user or service account, in one workspace or in every workspace that identity can use.
- Can be scoped
- Partly
Some key types can be limited, others carry full rights.
- Expires
- Chosen at creation: 3 hours to 30 days, custom or Never; fixed afterwards
- Switching keys
- Overlap windowRevokes at once
What Crunu does here
Crunu doesn't reissue keys at providers. It shows which values to replace and keeps the new one.
Build the list for a departure with the offboarding checklistOn this page
Create a new key on the API keys page of the Claude Console with the right linked account and workspace, deploy it, check that requests succeed, then disable the old key and delete it once nothing has broken. Keys are independent, so the old and the new one work side by side during the switch. Anthropic's own steps for replacing a workspace key follow the same order: create the new key, deploy it, confirm that requests succeed, then delete the old one (Claude docs).
Crunu doesn't create, disable or delete Claude API keys. It points out which Anthropic values a departing person could read, stores the replacement as a new version of the environment, and restarts the programs that use it.
The key type decides what a departure does
When you create a key you choose what it acts as, and that choice decides when it stops working:
| Key type | Acts as | Stops working when |
|---|---|---|
| Personal key | you, with your roles | you lose access to the organization; it is archived when you're removed |
| Service account key | a service account | the service account is archived or removed from the key's workspace |
| Workspace key (legacy) | nobody: it belongs to the workspace | it expires, is disabled or deleted, or the workspace is archived |
This changes how a departure plays out. A departing developer's personal keys end with their membership, so you don't reissue those. But anything that ran on one of them breaks the moment they're removed. Anthropic warns that a shared personal key acts as one person and breaks when they leave, and recommends a service account key for CI and production services. Workspace keys still work but are legacy, and they survive their creator, so they need a real reissue if the person could read them.
The secret itself starts with sk-ant-api. The SDKs read it from ANTHROPIC_API_KEY, and the API accepts it as a bearer token or in the legacy x-api-key header.
Expiration is fixed at creation
The Console offers 3 hours, 1 day, 7 days, 30 days, a custom duration, or Never for keys you keep in a secrets manager and rotate yourself. An organization can set a maximum, which removes Never. You can't change a key's expiration afterwards. Anthropic emails the creator 7 days before expiry for keys with a lifetime of at least 14 days, and 1 day before for keys of at least 7 days. After that, requests return 401 authentication_error, and an expired key can't be reactivated.
Reissue without downtime
- In the Console, open API keys and choose Create key. Name it, pick an expiration, set Linked account to a service account for anything shared, and scope it to the workspace your integration uses.
- Save it in Crunu as
ANTHROPIC_API_KEYin the environment the service reads, for exampledata-pipeline / production. A new version appears in the environment, recorded with its author and time. - Restart the consumers. A worker started with
crunu run --restart on-changerestarts on its own when the version changes. If the new key isn't scoped to a workspace, every request must also send theanthropic-workspace-idheader, or the API answers400 invalid_request_error. - Make a real request with the new key and watch for authentication or workspace errors.
- Disable the old key. It's reversible: Re-enable returns it if a forgotten consumer appears. When you're sure, delete it; deletion is permanent, and the key stays listed as archived.
crunu run --env data-pipeline/production --restart on-change -- python worker.pyWhen to reissue a Claude key
- Someone leaves. Their personal keys stop on their own. Reissue the service account and workspace keys they could read, and move anything that ran on their personal key to a service account. In Crunu, removing the person produces a reissue checklist of the values they received, with Where to reissue pointing at the Console.
- A leak. Anthropic recommends revoking a suspected compromised key immediately, from the key's menu on the API keys page, and creating a new one on the same page (Claude Help Center). Skip the disable step here and delete.
- A schedule. Anthropic advises rotating keys periodically, and an expiration date makes the schedule hard to forget.
Workloads on AWS, Google Cloud, Azure, GitHub Actions or Kubernetes can drop static keys altogether with Workload Identity Federation, which trades an identity token from your provider for a short-lived Claude API token. There is then no sk-ant-api string to issue, distribute or rotate. What to rotate when a developer leaves covers the rest of a departure, and the offboarding checklist lists what to reissue for your stack.
Frequently asked questions
Something else? Write to support@crunu.com
What happens to my Claude API keys when I leave the organization?
Your personal keys stop working and are archived when you are removed, and they are not restored if you are invited back. Service account keys keep working after the person who created them is removed, and legacy workspace keys work regardless of their creator.
Should I disable or delete the old Anthropic key?
Disable it first. Disable is reversible, and Re-enable brings the key back if a forgotten consumer breaks. Delete is permanent: the key is archived and can't be used again. Expired keys can only be deleted.
Can I change the expiration of an existing Claude API key?
No. Expiration is set at creation and can't be changed afterwards. To shorten or extend a key's life, create a new key with the expiration you want and retire the old one.
Does Crunu rotate Claude API keys?
No. Crunu doesn't call the Claude API or the Console. It shows which Anthropic values a departing person received, stores the new key as a new environment version, and crunu run restarts the services that read it.
Sources
Every source this page relies on, with the date we last checked it.
- Claude Platform Docs: Authentication · checked October 30, 2026
- Claude Help Center: What should I do if I suspect my API key has been compromised? · checked October 30, 2026