Claude Console: keys, spend limits, agents and federation

What the Console is for

The Claude Console at platform.claude.com is the control panel for the Claude API, the way your own apps, scripts and back ends talk to Claude. It is separate from a claude.ai chat plan, although you can also sign in to Claude Code with a Console account.

• Organisation: your company account, with billing and members.
• Workspaces: folders inside it for separate projects, environments or teams, each with its own keys and limits. Every organisation has a Default Workspace, and a Claude Code workspace appears when someone first signs in to Claude Code with a Console account.
• Roles: workspace roles range from a user who can only try prompts, to developers who can create keys, to admins.

Only organisation admins can create workspaces, on the Workspaces page.

Create and protect an API key

1. Open API keys (platform.claude.com/settings/keys) and click Create key.
2. Give it a name that says what it is for, such as website-tutor-prod.
3. Pick a workspace, so the key only works there.
4. Choose an expiry: from 3 hours to 30 days, a custom date, or never. You cannot change it later.
5. Choose the linked account: yourself for a personal key, or a service account for a key used by a program. Personal keys stop working if you leave the organisation, so production systems should use a service account.
6. Copy the key straight into a secrets manager or your hosting platform's secret settings. It starts with sk-ant-api.

To swap a key for a new one, create the new key, put it in place, check everything works, then delete the old one. For local development, ant auth login with Anthropic's ant command-line tool signs you in without a long-lived key at all.

Spend limits and rate limits

• Usage tiers: each organisation has a tier with a monthly spending cap, which rises as you build a history of use. See yours on the Rate limits page, where you can also request an increase.
• Your own monthly limit: set it on Billing, under Spend limits. When it is reached, API requests are refused until you raise it or the month resets.
• Workspace limits: open a workspace from the Workspaces page to give it its own lower spend limit and alerts. The Default Workspace cannot have one, so put production work in its own workspace.
• Rate limits: caps on requests and tokens per minute for each model. Going over returns an error asking you to wait and retry.

A sensible setup for a small team: one workspace per project, a spend limit and alert on each, and a lower organisation limit than your tier allows, so a bug or a leaked key cannot run up a big bill.

Build an agent with Managed Agents

Managed Agents (in beta) is Anthropic's ready-made agent setup that runs on Anthropic's infrastructure. Instead of writing the loop yourself, you describe the agent and Anthropic runs it in a cloud sandbox where it can read files, run commands, search the web and use MCP servers.

• Agent: the model, instructions, tools, skills and MCP servers.
• Environment: the sandbox it works in.
• Session: one run of the agent, which you can watch, steer or stop as it goes.

You can manage agents in the Console, or define one in a markdown file and create it with the ant tool, for example ant apply coding-assistant.md. It is billed for the tokens the model uses plus a charge for each hour a session is running, and your spend limits still apply. In Claude Code, the Claude API skill can walk you through setting one up.

It suits long-running or background jobs. For a coding agent on your own machine, see the Claude Agent SDK.

Federated access: no stored keys

A stored API key is a secret that never expires unless you set it to, and it can leak from a CI settings page or a config file. Workload Identity Federation removes it. Your platform (GitHub Actions, AWS, Google Cloud, Microsoft Entra ID, Kubernetes or another OIDC provider) already proves which workload is running. Claude's SDK swaps that proof for a short-lived token that lasts minutes or hours and renews itself.

1. An organisation admin opens Workload identity in the Console settings and runs the Connect workload wizard.
2. It creates three things: a service account (the identity your program acts as), a federation issuer (your platform) and a federation rule (which workloads may get a token, for example only one repository's workflows).
3. Your program sets environment variables such as ANTHROPIC_FEDERATION_RULE_ID, ANTHROPIC_ORGANIZATION_ID and ANTHROPIC_SERVICE_ACCOUNT_ID, plus the location of its identity token, and the SDK does the rest.

Use a key for quick experiments and a laptop; use federation for production servers and CI.

Check yourself

Three quick questions to check it stuck.

Ask the tutor

Frequently asked