# How to rotate an Anthropic (Claude) API key

> Reissue a Claude API key: create one with the right linked account and workspace, deploy it, disable the old key, delete it, and plan for keys tied to people.

URL: https://crunu.com/rotate/anthropic
Language: en
Updated: 2026-10-30

Create a new key on the API keys page of the Claude Console with the right linked account and workspace, deploy it, check that requests succeed, then disable the old key and delete it once nothing has broken. Keys are independent, so the old and the new one work side by side during the switch. Anthropic's own steps for replacing a workspace key follow the same order: create the new key, deploy it, confirm that requests succeed, then delete the old one ([Claude docs](https://platform.claude.com/docs/en/manage-claude/authentication)).

Crunu doesn't create, disable or delete Claude API keys. It points out which Anthropic values a departing person could read, stores the replacement as a new version of the environment, and restarts the programs that use it.

*Figure: Timeline of rotating the Claude API key. Step 1: a new key is issued while the old one keeps working. Step 2: every place that uses the key is updated, with no downtime because both keys work. Step 3: the old key is revoked. After revocation the old key stops working at once.*

## The key type decides what a departure does

When you create a key you choose what it acts as, and that choice decides when it stops working:

| Key type               | Acts as                             | Stops working when                                                      |
| ---------------------- | ----------------------------------- | ----------------------------------------------------------------------- |
| Personal key           | you, with your roles                | you lose access to the organization; it is archived when you're removed |
| Service account key    | a service account                   | the service account is archived or removed from the key's workspace     |
| Workspace key (legacy) | nobody: it belongs to the workspace | it expires, is disabled or deleted, or the workspace is archived        |

This changes how a departure plays out. A departing developer's personal keys end with their membership, so you don't reissue those. But anything that ran on one of them breaks the moment they're removed. Anthropic warns that a shared personal key acts as one person and breaks when they leave, and recommends a service account key for CI and production services. Workspace keys still work but are legacy, and they survive their creator, so they need a real reissue if the person could read them.

The secret itself starts with `sk-ant-api`. The SDKs read it from `ANTHROPIC_API_KEY`, and the API accepts it as a bearer token or in the legacy `x-api-key` header.

## Expiration is fixed at creation

The Console offers 3 hours, 1 day, 7 days, 30 days, a custom duration, or **Never** for keys you keep in a secrets manager and rotate yourself. An organization can set a maximum, which removes **Never**. You can't change a key's expiration afterwards. Anthropic emails the creator 7 days before expiry for keys with a lifetime of at least 14 days, and 1 day before for keys of at least 7 days. After that, requests return `401 authentication_error`, and an expired key can't be reactivated.

## Reissue without downtime

1. In the Console, open **API keys** and choose **Create key**. Name it, pick an expiration, set **Linked account** to a service account for anything shared, and scope it to the workspace your integration uses.
2. Save it in Crunu as `ANTHROPIC_API_KEY` in the environment the service reads, for example `data-pipeline / production`. A new version appears in the environment, recorded with its author and time.
3. Restart the consumers. A worker started with `crunu run --restart on-change` restarts on its own when the version changes. If the new key isn't scoped to a workspace, every request must also send the `anthropic-workspace-id` header, or the API answers `400 invalid_request_error`.
4. Make a real request with the new key and watch for authentication or workspace errors.
5. Disable the old key. It's reversible: **Re-enable** returns it if a forgotten consumer appears. When you're sure, delete it; deletion is permanent, and the key stays listed as archived.

```sh
crunu run --env data-pipeline/production --restart on-change -- python worker.py
```

## When to reissue a Claude key

- **Someone leaves.** Their personal keys stop on their own. Reissue the service account and workspace keys they could read, and move anything that ran on their personal key to a service account. In Crunu, removing the person produces a reissue checklist of the values they received, with **Where to reissue** pointing at the Console.
- **A leak.** Anthropic recommends revoking a suspected compromised key immediately, from the key's menu on the API keys page, and creating a new one on the same page ([Claude Help Center](https://support.claude.com/en/articles/8384961-what-should-i-do-if-i-suspect-my-api-key-has-been-compromised)). Skip the disable step here and delete.
- **A schedule.** Anthropic advises rotating keys periodically, and an expiration date makes the schedule hard to forget.

Workloads on AWS, Google Cloud, Azure, GitHub Actions or Kubernetes can drop static keys altogether with Workload Identity Federation, which trades an identity token from your provider for a short-lived Claude API token. There is then no `sk-ant-api` string to issue, distribute or rotate. [What to rotate when a developer leaves](https://crunu.com/guides/developer-offboarding-secret-rotation) covers the rest of a departure, and the [offboarding checklist](https://crunu.com/tools/offboarding-checklist) lists what to reissue for your stack.

## FAQ

### What happens to my Claude API keys when I leave the organization?

Your personal keys stop working and are archived when you are removed, and they are not restored if you are invited back. Service account keys keep working after the person who created them is removed, and legacy workspace keys work regardless of their creator.

### Should I disable or delete the old Anthropic key?

Disable it first. Disable is reversible, and Re-enable brings the key back if a forgotten consumer breaks. Delete is permanent: the key is archived and can't be used again. Expired keys can only be deleted.

### Can I change the expiration of an existing Claude API key?

No. Expiration is set at creation and can't be changed afterwards. To shorten or extend a key's life, create a new key with the expiration you want and retire the old one.

### Does Crunu rotate Claude API keys?

No. Crunu doesn't call the Claude API or the Console. It shows which Anthropic values a departing person received, stores the new key as a new environment version, and crunu run restarts the services that read it.

## Sources

- [Claude Platform Docs: Authentication](https://platform.claude.com/docs/en/manage-claude/authentication) (accessed 2026-10-30)
- [Claude Help Center: What should I do if I suspect my API key has been compromised?](https://support.claude.com/en/articles/8384961-what-should-i-do-if-i-suspect-my-api-key-has-been-compromised) (accessed 2026-10-30)