Skip to main content

​
Overview

OneCLI injects your Anthropic credential into requests to api.anthropic.com automatically. Agents make standard requests to the Anthropic API; the gateway adds the credential before forwarding. This lets agents use Claude models (Claude Opus, Sonnet, Haiku) without ever seeing or handling your credential directly. For routing to Claude via Google Cloud instead, see Vertex AI. For a comparison of supported LLM providers, see LLM Providers.

​
What you will set up

  • A Claude credential in OneCLI: a subscription token from claude setup-token or a Claude Console API key
  • Automatic injection into the right header on requests to api.anthropic.com
  • Per-agent access to the credential, with optional organization rules

​
Choose how to connect

Both go into the same field, and OneCLI detects which one you pasted: Admin API keys (sk-ant-admin...) can’t call Claude models, so OneCLI won’t use them.

​
Where to paste it

In the OneCLI dashboard, open your agent’s Models page, click Add LLM key, and choose Anthropic. Paste your token or key into Secret value and click Add Secret. Need help? in the window opens this page.
OneCLI Anthropic key window with the Name field, the Secret value field, the hint 'From claude setup-token, or an API key from the Claude Console', Advanced settings, and Need help?, Cancel and Add Secret buttons.

The Anthropic key window in OneCLI.

​
Option 1: Claude subscription token

Use this if you pay for a Claude plan. Usage counts against your plan instead of API billing. The free Claude plan doesn’t include Claude Code, so it can’t create a token.
1

Open a terminal

  • macOS: press Cmd + Space, type Terminal, and press Enter.
  • Windows: press the Windows key, type PowerShell, and press Enter.
  • Linux: open your terminal app (often Ctrl + Alt + T).
2

Install Claude Code

Paste the command for your system and press Enter. It shows no progress while it downloads, so give it a minute.macOS, Linux, or WSL:
Windows PowerShell:
When it finishes you’ll see Installation complete!. If it also shows Setup notes saying ~/.local/bin is not in your PATH, do the next step.
Terminal output of the Claude Code installer: Claude Code successfully installed, version and location, a Setup notes warning that ~/.local/bin is not in your PATH with the command to fix it, and Installation complete.

The installer finished. The Setup notes mean the claude command isn't on your PATH yet.

3

Make sure the claude command works

Open a new terminal window, then run:
If you see a version number, such as 2.1.296 (Claude Code), skip to the next step. If you see command not found or not recognized, add the install folder to your PATH once, for your shell:macOS (zsh, the default):
Linux (bash):
Windows PowerShell:
On Windows, close PowerShell and open a new window after this. Then run claude --version again.
Terminal running the PATH command for bash, then claude --version printing 2.1.296 (Claude Code).

After the PATH fix, claude --version prints the version.

Leftover environment variables can make Claude Code use the wrong account. Clear them in the terminal you’ll use for the next step:macOS or Linux:
Windows PowerShell:
If they come back in every new terminal, delete the matching export lines from ~/.zshrc or ~/.bashrc. On Windows, remove them under Edit the system environment variables > Environment Variables.
4

Generate the token

Run:
A browser window opens. Sign in to the Claude account that has your plan and approve. If the browser doesn’t open, copy the link the terminal shows into your browser, and paste the code it gives you back into the terminal.
Terminal running claude setup-token: Welcome to Claude Code, a note that it sets up a long-lived (1-year) auth token and needs a Claude subscription, a sign-in link, and a prompt to paste the code.

claude setup-token asks you to sign in with your Claude account.

When you approve, the terminal prints a long token that starts with sk-ant-oat. Copy all of it. The token is valid for one year.
Treat this token like a password. Anyone who has it can use your Claude plan. Don’t paste it into chats, tickets, or code.
5

Paste it into OneCLI

Paste the token into the Anthropic window as described in Where to paste it.

​
Option 2: API key from the Claude Console

Use this if you pay for API usage in the Claude Console. You don’t need a terminal.
1

Create an API key

Open Claude Console API keys and sign in. Click Create Key, name it OneCLI, and copy the key. It starts with sk-ant-api or sk-ant-usr and is shown only once.Your Console organization needs billing set up (credits or a payment method), or requests are refused.
2

Paste it into OneCLI

Paste the key into the Anthropic window as described in Where to paste it.

​
Troubleshooting

Your Claude account is on the free plan, which doesn’t include Claude Code. Upgrade to Pro, Max, Team, or Enterprise, or use Option 2 with an API key.
Copy the whole value again, with no spaces or line breaks. Tokens copied from a narrow terminal window can wrap onto a second line; paste the token into a text editor first to make sure it’s on one line.
Key rejected means Anthropic refused the key when an agent used it: it was revoked, or the subscription token expired. Billing issue or Rate limited means the plan’s usage limit was reached or the Console account has no credits. Fix it in the Claude Console, or generate a new token and update the key with the pencil icon.

​
How it works

  1. Your credential is encrypted and stored by OneCLI (AES-256-GCM at rest)
  2. When an agent sends a request to api.anthropic.com, the gateway intercepts it
  3. The gateway injects the credential into the right header
  4. The request is forwarded to Anthropic
Agents never see the raw credential. If you rotate it, update it in the dashboard and all agents pick up the new one automatically.

​
Controlling access

Access is per agent: attach the key to each agent that needs it. An agent without the grant can’t use it at all. Organization rules add guardrails on top: rate-limit requests, restrict agents to specific models by blocking certain paths, or flag high-cost operations for manual approval. Everything is checked before credential injection, so a blocked request never reaches Anthropic.

​
FAQ

Install Claude Code, run claude setup-token, and approve in the browser with the Claude account that has your plan. The terminal prints a token that starts with sk-ant-oat and is valid for one year. See Option 1 above, or the full claude setup-token guide.
Use a subscription token if you pay for a Claude Pro, Max, Team, or Enterprise plan, so usage counts against the plan. Use a Console API key for pay-as-you-go API billing. Both go into the same field, and OneCLI detects which one you pasted.
Generate a new token with claude setup-token, or create a new key in the Claude Console. Then update the key on the Models page with the pencil icon. All agents pick up the new credential automatically.
Store it in OneCLI instead of setting ANTHROPIC_API_KEY in the agent’s environment. The gateway injects the credential at the proxy, so the agent never holds it and can’t leak it. See How it works.
Yes. Attach the key only to agents that need it. Add rules to rate-limit requests, restrict models by blocking paths, or require approval for high-cost operations.