The Anthropic client reads credentials from a priority chain: explicit constructor args, ANTHROPIC_API_KEY/ANTHROPIC_AUTH_TOKEN env vars, ANTHROPIC_PROFILE, workload identity federation, or disk profile — resolving them upfront so subsequent API calls are authenticated. The client accepts optional credentials, HTTP, and header customization via constructor kwargs and environment variables; explicit credential args suppress env var lookups to prevent accidental shadowing.
The canonical minimal usage of the SDK is to create an Anthropic client (reading ANTHROPIC_API_KEY from the environment by default), call client.messages.create() with model, max_tokens, and messages, and read message.content:
import os
from anthropic import Anthropic
client = Anthropic(
api_key=os.environ.get("ANTHROPIC_API_KEY"), # This is the default and can be omitted
)
message = client.messages.create(
max_tokens=1024,
messages=[
{
"role": "user",
"content": "Hello, Claude",
}
],
model="claude-opus-4-6",
)
print(message.content)
The Anthropic client resolves credentials in priority order: (1) explicit constructor arguments (api_key, auth_token, credentials, config, or profile); (2) ANTHROPIC_API_KEY / ANTHROPIC_AUTH_TOKEN environment variables; (3) the ANTHROPIC_PROFILE environment variable, which loads a named profile from disk; (4) workload identity federation environment variables (ANTHROPIC_IDENTITY_TOKEN[_FILE], ANTHROPIC_FEDERATION_RULE_ID, ANTHROPIC_ORGANIZATION_ID); (5) the active profile on disk. Full details are on Credential providers and chain.[2] When any explicit credential argument is passed to the Anthropic constructor, the ANTHROPIC_API_KEY and ANTHROPIC_AUTH_TOKEN environment variables are not consulted.[2] When an explicit api_key= or auth_token= argument shadows an explicit credentials= provider, the client emits a one-shot warning via warn_explicit_static_shadows_credentials.[2] The credential-resolution path (auto-discovery via default_credentials) is invoked only for the base Anthropic / AsyncAnthropic classes; subclasses such as AnthropicAWS and AnthropicFoundry have their own auth paths and do not accept the credentials kwarg.[2] If a credential provider exposes a bind_base_url method, the client calls it with the resolved base_url so token exchange and API calls target the same deployment without requiring duplicate URL configuration; providers without this hook must resolve their own token-exchange base_url.[2] A credential provider is an object that supplies authentication tokens on demand — for example, by fetching short-lived tokens from an identity service — allowing the Anthropic client to refresh credentials automatically without restarting, unlike a static api_key.
The ANTHROPIC_WEBHOOK_SIGNING_KEY environment variable is read as the default value for webhook_key when that constructor argument is not provided.[2] Custom HTTP headers can be injected via the ANTHROPIC_CUSTOM_HEADERS environment variable; each header is a Name: Value line, newline-delimited, and these are merged with any default_headers kwarg — the environment variable takes lower priority than the kwarg.[2]
The Anthropic client exposes instance attributes api_key, auth_token, webhook_key, credentials, _token_cache, and _custom_auth.[2] A custom http_client (an httpx.Client instance) can be passed to the Anthropic constructor; the SDK recommends using DefaultHttpxClient to retain the default limits, timeout, and follow_redirects settings.[2] The Anthropic class provides HUMAN_PROMPT and AI_PROMPT as class-level constants sourced from _constants.[2] _strict_response_validation is an undocumented, experimental constructor parameter that raises APIResponseValidationError when the API returns data not matching the expected schema; it defaults to False and may be removed or changed in the future.[2]
Sources