Claude API Authentication OAuth Setup Guide
Does the Claude API Use OAuth?
Short answer: no, not for standard developer access. Anthropic's Claude API authenticates requests with a static API key sent in an x-api-key header (or Authorization: Bearer in some tooling), not an OAuth 2.0 authorization code flow. If you landed here expecting a /oauth/authorize endpoint and a redirect dance, that's the source of the confusion — Claude.ai (the consumer chat product) uses session-based login for humans, and separately Anthropic's enterprise console supports SSO for team management. Neither of those is the mechanism your code uses to call the API.
This guide covers both paths so you set up the right one: the native Anthropic API key flow for direct access, and the OAuth-style subscription bridge you need if you want to turn an existing Claude Pro/Max login into something your backend can call like a normal REST API.
Native Anthropic API Key Setup
If you're building directly against Anthropic's API, authentication is a one-time setup:
- Create an account at the Anthropic console and add billing.
- Generate an API key from the console dashboard.
- Store it as an environment variable — never hardcode it in source or commit it to version control.
- Send it on every request.
curl https://api.anthropic.com/v1/messages \
-H "x-api-key: $ANTHROPIC_API_KEY" \
-H "anthropic-version: 2023-06-01" \
-H "content-type: application/json" \
-d '{
"model": "claude-sonnet-4-5",
"max_tokens": 1024,
"messages": [{"role": "user", "content": "Hello Claude"}]
}'There's no refresh token, no client secret, no redirect URI. The key itself is the credential, and it doesn't expire on a schedule — you rotate it manually when needed. This is simpler than OAuth but puts more responsibility on you to guard the secret: treat it like a database password, scope it to a server-side environment, and never expose it in frontend JavaScript.
Where OAuth Actually Shows Up
There are two legitimate places OAuth-like flows exist around Claude:
- Claude.ai / Claude Code login — when you sign in with Google, or use "Sign in with Anthropic" style flows, that's OAuth under the hood for human authentication to the product UI. It has nothing to do with your application's API calls.
- Enterprise SSO — larger Anthropic plans support SAML/OIDC for console access management, letting your org control who can generate or revoke API keys. Still not the mechanism your requests authenticate with.
The practical gap this leaves: if your team already pays for Claude Pro or Max subscriptions and wants to call Claude from code without provisioning a separate pay-per-token API account, there's no native Anthropic feature for that. Subscription access and API access are billed and authenticated differently by design.
Bridging Subscription Access to an API: The SubToAPI Flow
This is the actual setup most teams searching for "OAuth" end up needing. SubToAPI connects to your existing Claude access and exposes it as a standard HTTPS API with its own key format, so your app authenticates the normal way — a bearer token — regardless of what's happening behind the scenes with the subscription.
Setup looks like this:
- Sign up at /signup and connect your Claude account.
- SubToAPI issues an application API key in the format
sub_live_...from your dashboard. - Use that key as a standard Bearer token on every request to SubToAPI's endpoint.
curl https://api.subtoapi.app/v1/messages \
-H "Authorization: Bearer $SUBTOAPI_KEY" \
-H "content-type: application/json" \
-d '{
"model": "claude-sonnet-4-5",
"max_tokens": 1024,
"messages": [{"role": "user", "content": "Hello Claude"}]
}'const res = await fetch("https://api.subtoapi.app/v1/messages", {
method: "POST",
headers: {
"Authorization": `Bearer ${process.env.SUBTOAPI_KEY}`,
"content-type": "application/json",
},
body: JSON.stringify({
model: "claude-sonnet-4-5",
max_tokens: 1024,
messages: [{ role: "user", content: "Hello Claude" }],
}),
});No OAuth client registration, no scopes to configure, no redirect URIs to whitelist. The sub_live_ key is scoped to your account and visible in a dashboard alongside usage metadata per key, so you can see exactly which key made which call and revoke individual keys without touching others. Full request/response shapes are documented at /docs/messages, and streaming responses work the same way — see /docs/streaming if you're building a chat UI that needs token-by-token output.
Setting Up Keys for a Team
Whether you're on native Anthropic billing or a subscription bridge, the same key-hygiene rules apply when more than one person touches the credential:
- One key per environment. Separate keys for local dev, staging, and production so a leaked dev key doesn't take down prod.
- One key per service, where practical. If a worker process only needs read-style completions, don't hand it the same key your billing-sensitive admin tool uses.
- Rotate on offboarding. When someone leaves the team, rotate any key they had access to, not just revoke their account login.
- Never log full keys. Mask everything but the last 4 characters in application logs.
If you're running a team, SubToAPI's Team plan gives each seat its own key and usage view, which matters more than it sounds — it's the difference between "someone's script is burning tokens" and "I know exactly which key and which seat is burning tokens."
Quick Checklist Before You Ship
- Key stored in environment variables or a secrets manager, not in code
- Separate keys for dev/staging/prod
- Server-side only — never expose the key in client-side JS or mobile app bundles
- Monitoring on usage so a leaked key gets noticed fast
- A rotation plan documented somewhere your team can find it
If you're just getting started, the fastest path is the quickstart, which walks through the first authenticated call end to end, including tool use setup at /docs/tools if your use case needs function calling.
Questions
Does Claude API support OAuth 2.0 for application authentication? No. The standard Claude API uses static API keys sent via a header, not OAuth authorization flows. OAuth-style login exists for human access to Claude.ai and for enterprise SSO into the console, not for your application's API calls.
How do I authenticate if I only have a Claude Pro/Max subscription, not an API account? Anthropic doesn't offer a native way to call the API using subscription credentials. Services like SubToAPI bridge that gap by connecting to your existing access and issuing a standard bearer-token API key you can use in any HTTP client.
Is an API key as secure as OAuth tokens? Yes, if handled correctly — the risk profile is different, not worse. OAuth tokens expire and refresh automatically; API keys don't, so you're responsible for rotation, scoping per environment, and never exposing the key client-side.