Auth Paths: API Keys, Console, OAuth, and Bedrock/Vertex

Four ways to talk to Claude

You can authenticate to Claude's surfaces four ways: a console API key from the Anthropic Console; Claude Code OAuth (the Pro/Max subscription that the CLI uses); Amazon Bedrock with AWS credentials; or Google Vertex AI with Google Cloud credentials. Each path has its own quotas, billing surface, region constraints, and feature availability. Picking is not interchangeable.

How each path actually works

API key is the most direct: set ANTHROPIC_API_KEY and call the SDK. OAuth is what the Claude Code CLI uses with a logged-in Pro/Max subscription — the Agent SDK can run on the same auth and that is how cwkPippa's Claude brain stays on Dad's existing Max plan instead of paying per token via API. Bedrock and Vertex change the call surface (different SDK clients) and unlock enterprise quota and regional residency, but trail the direct API on feature freshness.

Two-of-two safety, not single point of failure

Production projects should know which path is primary and which is the insurance policy. cwkPippa's Gemini variant runs OAuth (Cloud Code Assist) by default and can flip to a paid Gemini API key if OAuth quota or auth fails — visible sticky toast, not silent. The Claude brain runs OAuth-only by design (Anthropic API key is reserved scaffolding, not a runtime path). Knowing the policy in writing prevents 3am improvisation.

Principle: Auth path is a product decision, not a deploy detail. Document which path runs each environment.

Code

API key auth (Python)·python

import os
from anthropic import Anthropic

# Key comes from env, never hardcoded.
client = Anthropic(api_key=os.environ["ANTHROPIC_API_KEY"])

response = client.messages.create(
    model="claude-sonnet-4-6",
    max_tokens=512,
    messages=[{"role": "user", "content": "One sentence on why pinning model ids matters."}],
)
print(response.content[0].text)

OAuth auth via Claude Code (Agent SDK)·python

# Claude Agent SDK reuses the OAuth token from `claude` CLI login.
# Run `claude login` once; the SDK picks the token up automatically.
import asyncio
from claude_agent_sdk import query, ClaudeAgentOptions

async def main():
    options = ClaudeAgentOptions(
        cwd="/tmp",
        # No api_key; auth flows through the OAuth token in the user's keychain.
    )
    async for event in query(prompt="What model are you?", options=options):
        print(event)

asyncio.run(main())

Bedrock auth (TypeScript)·typescript

import AnthropicBedrock from '@anthropic-ai/bedrock-sdk';

// Auth via the standard AWS credential chain (profile, env, IAM role).
const client = new AnthropicBedrock({ awsRegion: 'us-east-1' });

const message = await client.messages.create({
  model: 'anthropic.claude-sonnet-4-6-v1:0',
  max_tokens: 256,
  messages: [{ role: 'user', content: 'One-line summary of Bedrock vs direct API.' }],
});
console.log(message.content);

Auth Paths: API Keys, Console, OAuth, and Bedrock/Vertex

Four ways to talk to Claude

How each path actually works

Two-of-two safety, not single point of failure

Code

External links

Exercise

Progress

Comments 0